PAL implementation - practices

Oct 24, 2008 at 4:48 PM

First off, PAL is the best integration of Perfmon Logs and Thresholds I have ever since.  In literally just a few minutes you get the big picture analysis with highlights of where bottlenecks occur.  Kudos to ClintH and mikelag!!

I would like to start a discussion regarding best implementation practices for Perfom and PAL.  Keeping in mind that deployment should be hassle free to admins, and the reports will be produced in a central location.  The env I work in involves a mix on Win2000/2003, SQL2000/2005, Biztalk 2006, and IIS 5/6. Active Directory.  About 200 servers in total located in 4 states.
1.- Logman collects data in csv format (smaller that blg) each hour in 5 minute interval
2.- Perfmon is configure to restart upon reboot
2.- Each hour the latest file is ftp to a central reporting server, local files are cleaned up every 7 days
3.- Deployment has been packaged using a batch file. It includes detecting the OS on the target server and sending logman.exe and helper dll file to make it compatible to 2003 One caveat I have found is that on 2003 servers, logman must pass a username/pass for Perfom to run as, otherwise it will not start.  I have been supplying this info manually as I do not want to code passwords in conf files.  Also, the type of threshold file is selected at deployment time.
4. - All threshold files include and additional check for Outgoing packets errors.  This is being tested
5.- Each night the central server executes PAL against the files collected to the prior day.  We get 1 report for each hour.  Later we would like to be able to convert the csv files to blg, combine them and resample them so that we can have daily/weekly/reports reports
6.- Reports are available via a link.  User picks day/hour of interest.

I am interested in reading other implementation experiences; I think the desired goal is common. And PAL has provided the light at the end of the tunnel.  Will be happy to provide how-tos and scripts that make all the above happen.  Keep in mind that some of the steps done above apply to our env and most likely will have to be adapted to yours...

One are of improvement would be to make the reporting side write above all the entries that DO contain alerts.  The report Title should be customizable as well.... 


Oct 25, 2008 at 9:10 AM
Hi Carias,

Thank you for the feedback. This makes it all worth the time and effort to create it. :-)

Be careful about using CSV files for perfmon logs. CSV files will not catch new processes that get created. For example, if you started the perfmon log, then started a new process on that server, then perfmon will not log the new process. Use BLG files because they track new process creations. Try it you'll see. I consider this a bug in Microsoft Performance Logs and Alerts service. So long story short, only use binary (*.blg) for your log file format.

Also, Microsoft System Center Operations Manager (SCOM) 2007 has the ability to roll up performance counters like you are doing, so that might be something to consider. I'm working on synchronizing the thresholds we use in PAL with the management packs.

Thanks again for sharing your experiences. A lot of us can relate with it.
Feb 23, 2011 at 7:36 AM

Also, I've noticed csv files cannot always be parsed for date/time information.  So best practice (recommendation) holds as above, use binary format.