Performance Analysis of Logs (PAL) Tool

Commented Issue: Some graphs not displaying correctly

moff — Tue, 19 Aug 2008 16:01:24 GMT

I've noticed a problem where the graphs for processor and disk counters display extra values on the X-axis. It appears that the analysis interval adds the time splices correctly in the beginning of the graph, but doesn't spread them out properly and adds additional values on the end. I've run the analysis under different configurations and with numerous captures from different servers and received the same result.

The graphs for memory display correctly. I've attached examples of each.

The settings for the analysis were:

Threshold File - System Overview
Analysis Interval - AUTO
Version - v1.3 Beta 5
Comments: ** Comment from web user: moff **

just to add, i've got the blg file still if you want

Commented Issue: Some graphs not displaying correctly

moff — Tue, 19 Aug 2008 15:54:54 GMT

I've just encountered this too, see attached files, generated from the same log file. The one created with AUTO time slicing has worked, the one created with ALL time slicing hasn't

Created Issue: Type mismatch: 'join'

abean — Fri, 15 Aug 2008 20:18:00 GMT

===============================ERROR========================================
[ProcessArguments]
C:\Program Files\PAL\PAL v1.3 Beta 9\PAL.vbs(1639, 13) Microsoft VBScript runtim
e error: Type mismatch: 'Join'

I receive this when attempting to analyze perfmon output files created by PSSDiag. Any thoughts?

Thanks

New Post: Microsoft Web Archive format (*.mht) as output option

cfeduke — Tue, 12 Aug 2008 15:49:25 GMT

I've found it very useful to turn the *.htm and accompanying directories into Microsoft Web Archive format (*.mht). The advantage to *.mht is that the resulting file has all of the image resources contained within it so you don't need to send both a HTML file and a directory to someone via email or store both artifacts on the network for posterity. This format can be viewed on Windows through Internet Explorer and on OS X by giving it a *.eml extension by Mail.app (I'm unaware of a Linux viewer however). It would be nice to have *.mht as a third output option on the PAL wizard. To create a *.mht file in C# (which is likely of limited use since PAL output is performed by VBScript, but I'm sure VBScript could invoke CDO):

1. Add a reference to "Microsoft CDO for Windows 2000" to the project (interop).
2. Source code looks something like...

using System;
using System.IO;
using CDO;
...
const string __url = "file:///{0}";
var htmlFileName = "path to PAL output.htm";
var message = new MessageClass();
message.CreateMHTMLBody(String.Format(__url, htmlFileName), CDO.CdoMHTMLFlags.cdoSuppressNone, "", "");
var stream = message.GetStream();
var outputPath = Path.GetDirectoryName(htmlFileName) + "\\" + Path.GetFileNameWithoutExtension(htmlFileName) + ".mht";
stream.SaveToFile(outputPath, ADODB.SaveOptionsEnum.adSaveCreateOverWrite);

Created Release: PAL v1.3 Beta 9 (Aug 11, 2008)

Mon, 11 Aug 2008 07:29:12 GMT

Changes since PAL v1.3 Beta 8:

Bug Fix: Log row too long: When there are a large number of counters in a log, Log Parser fails to process it with the error, "Log row too long". This is fixed by increasing the buffer size using the CSVInMaxRowSize registry key. In this build, PAL automatically detects the size needed and sets the size to the correct amount plus 1K extra. In order for this to work properly, PAL must be ran with administrator privileges in order to write the registry key.
Behavior Change: The PAL installation wizard now detects if Microsoft Office Web Components 2003 is installed and if Microsoft Log Parser v2.2 is installed. If they are not installed, then the installer points the user to the installation URL for the respective product.
Bug Fix: Fixed a bug where the chart (image files) were not available when the HTML PAL report is moved to a different directory.
Bug Fix: Fixed the Available MBytes decreasing trend threshold.
Threshold Update: Fixed that "The number of concurrent database session are greater than 80% of its throttling threshold for this host instance" threshold in the BizTalk 2006 threshold file, so that if the counter value is 0 (disabled), then ignore it.
Threshold Update: Changed the Process\% Processor Time to be divided by the number of processors.
Threshold Update: Set the Processor Queue Length thresholds to be Warning at greater than 10 x NumberOfProcessors and Critical at greater than 20 x NumberOfProcessors.
Win2008 Hyper-V: A Windows Server 2008 Hyper-V threshold file has been added to PAL. This is a beta release of this threshold file pending review from other subject matter experts.
New Feature: The UI now supports time range restrictions - meaning the perfmon log can be restricted to a time range.

Released: PAL v1.3 Beta 9 (Aug 11, 2008)

Mon, 11 Aug 2008 07:29:12 GMT

Changes since PAL v1.3 Beta 8:

Bug Fix: Log row too long: When there are a large number of counters in a log, Log Parser fails to process it with the error, "Log row too long". This is fixed by increasing the buffer size using the CSVInMaxRowSize registry key. In this build, PAL automatically detects the size needed and sets the size to the correct amount plus 1K extra. In order for this to work properly, PAL must be ran with administrator privileges in order to write the registry key.
Behavior Change: The PAL installation wizard now detects if Microsoft Office Web Components 2003 is installed and if Microsoft Log Parser v2.2 is installed. If they are not installed, then the installer points the user to the installation URL for the respective product.
Bug Fix: Fixed a bug where the chart (image files) were not available when the HTML PAL report is moved to a different directory.
Bug Fix: Fixed the Available MBytes decreasing trend threshold.
Threshold Update: Fixed that "The number of concurrent database session are greater than 80% of its throttling threshold for this host instance" threshold in the BizTalk 2006 threshold file, so that if the counter value is 0 (disabled), then ignore it.
Threshold Update: Changed the Process\% Processor Time to be divided by the number of processors.
Threshold Update: Set the Processor Queue Length thresholds to be Warning at greater than 10 x NumberOfProcessors and Critical at greater than 20 x NumberOfProcessors.
Win2008 Hyper-V: A Windows Server 2008 Hyper-V threshold file has been added to PAL. This is a beta release of this threshold file pending review from other subject matter experts.
New Feature: The UI now supports time range restrictions - meaning the perfmon log can be restricted to a time range.

New Post: Counters not showing in report

ClintH — Sat, 09 Aug 2008 05:27:47 GMT

It should have processed it. The output in the command window and/or log will tell you the counters that each analysis matched on and if any counters are missing it will mention which ones it was expecting. This is because some of the analysis require more than one counter to process. In the case of the counters that you mentioned, each of those should process stand alone. If you post the latest %temp%\{GUID}PAL.log file, then that will help.

New Post: STATS ONLY

ClintH — Sat, 09 Aug 2008 05:23:52 GMT

My apologies for taking so long to reply. Other work is keeping me busy. Can you post it to the Issue Tracker area, or try sending it to me again (clinth@microsoft.com)? I tried searching my email today for your email, but can't seem to find it. Thank you.

Commented Issue: Unknown parameter -y

ClintH — Fri, 08 Aug 2008 01:35:45 GMT

Hello,
I get an error:

uknown parameter -y
Syntax comman is not correct

Where could be a problem?

Peter
Comments: ** Comment from web user: ClintH **

I don't know for sure other than a possible bug with Relog.exe. I have brought this up with the Windows Product team. In the meantime, try to get another perfmon log.

Commented Issue: No Reports Generated

ClintH — Fri, 08 Aug 2008 01:34:46 GMT

I have installed PAL and all required components. It runs for about 1/2 hour and then gives errors and produces no reports.
Comments: ** Comment from web user: ClintH **

If you are running it on Windows Vista, then try running it elevated as administrator. A non-elevated application cannot write to other drives such as H: drive in your case.

Commented Issue: Document paths incorrectly parsed

ClintH — Fri, 08 Aug 2008 01:28:36 GMT

(Tested with PAL 1.3 Beta 7)
Comments: ** Comment from web user: ClintH **

Okay, I fixed this in v1.3 Beta 9 which I will post soon.
The problem is that Log Parser considered the \uXXXX to be a Unicode sequence, so I had to escape it with a double backslash in front of it.

Commented Issue: Document paths incorrectly parsed

ClintH — Thu, 07 Aug 2008 22:20:15 GMT

(Tested with PAL 1.3 Beta 7)
Comments: ** Comment from web user: ClintH **

I might be able to escape this in the SQL query in Log Parser. I'll give this a try and if it works, I'll fix it in v1.3 Beta 9.

Commented Issue: Unknow parameter -y

ClintH — Thu, 07 Aug 2008 22:02:02 GMT

Hello,
I get an error:

uknown parameter -y
Syntax comman is not correct

Where could be a problem?

Peter
Comments: ** Comment from web user: ClintH **

This is a problem with Relog.exe and/or a corrupted BLG file. I'm following up with the Windows Product team on this. In the meantime, try to create another BLG file.

Commented Issue: could not complete performance analyze with "Object required: 'oAlert'"

Firemedic1975 — Wed, 06 Aug 2008 23:59:24 GMT

I'm trying to analyze one of exchange server (2007) performance logs. But it's crashes in somewhere.

Do we need to open an issue for tracking that error, any ideas ?

SELECT QUANTIZE([(PDH-CSV 4.0) (GTB Daylight Time)(-180)], 66) AS Interval, MIN(
TO_REAL([\\GMMAILBOX1\MSExchange ADAccess Processes(powershell EMS _Total)\LDAP
Search Time])) AS min, AVG(TO_REAL([\\GMMAILBOX1\MSExchange ADAccess Processes(p
owershell EMS _Total)\LDAP Search Time])) AS avg, MAX(TO_REAL([\\GMMAILBOX1\MSEx
change ADAccess Processes(powershell EMS _Total)\LDAP Search Time])) AS max FROM
C:\Users\kekici\AppData\Local\Temp\2\{2F534B0F-D792-4CAA-9B23-C19911F68051}\_Fi
lteredPerfmonLog.csv GROUP BY Interval
SELECT QUANTIZE([(PDH-CSV 4.0) (GTB Daylight Time)(-180)], 66) AS Interval, MIN(
TO_REAL([\\GMMAILBOX1\MSExchange ADAccess Processes(Microsoft.Exchange.Monitorin
g UNKNOWN _Total)\LDAP Search Time])) AS min, AVG(TO_REAL([\\GMMAILBOX1\MSExchan
ge ADAccess Processes(Microsoft.Exchange.Monitoring UNKNOWN _Total)\LDAP Search
Time])) AS avg, MAX(TO_REAL([\\GMMAILBOX1\MSExchange ADAccess Processes(Microsof
t.Exchange.Monitoring UNKNOWN _Total)\LDAP Search Time])) AS max FROM C:\Users\k
ekici\AppData\Local\Temp\2\{2F534B0F-D792-4CAA-9B23-C19911F68051}\_FilteredPerfm
onLog.csv GROUP BY Interval
C:\Program Files (x86)\PAL\PAL v1.3 Beta 7\PAL.vbs(2747, 25) Microsoft VBScript
runtime error: Object required: 'oAlert'

C:\Program Files (x86)\PAL\PAL v1.3 Beta 7>
Comments: ** Comment from web user: Firemedic1975 **

I was having the same problem; however when I put the blg in the directory where PAL resides C:|Program Files\PAL and was able to successfully analyze the file. I have only tried it from the command line - not the GUI

New Post: HTML generated don't show charts

PNeves — Thu, 31 Jul 2008 15:14:12 GMT

Hi All,

Just wanted to share an issue I've come across when using the PAL Script.

I have developed an automatic process (scripting) of collecting performance logs from servers and uploading to a central server.
On this central server I run every night another script that uses those performance logs and generates the html pages with charts.
One issue has come up:
When using long server names, when writing the HTML page the folder for each server is truncated to 8.3 names (e.g. \SERVER~1\...)
When opening the HTML page directly from the browser (File://....) I can see correctly the pics ... but when opening the same page from a web server (http://localhost/...) those same pics don't show.
That is due to the security restriction of IIS to access 8.3 names on NTFS partitions.

The Solution I found to have PAL generating HTML pages that can be viewed on the company intranet was to disable this compatibility feature (8.3 names) of NTFS.
For that I used the command:
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="ProgId" content="Word.Document"> <meta name="Generator" content="Microsoft Word 12"> <meta name="Originator" content="Microsoft Word 12"> <link rel="File-List" href="file:///C:%5CDOCUME%7E1%5Cpneves.COP%5CLOCALS%7E1%5CTemp%5Cmsohtmlclip1%5C01%5Cclip_filelist.xml"> <link rel="themeData" href="file:///C:%5CDOCUME%7E1%5Cpneves.COP%5CLOCALS%7E1%5CTemp%5Cmsohtmlclip1%5C01%5Cclip_themedata.thmx"> <link rel="colorSchemeMapping" href="file:///C:%5CDOCUME%7E1%5Cpneves.COP%5CLOCALS%7E1%5CTemp%5Cmsohtmlclip1%5C01%5Cclip_colorschememapping.xml"> <style>  </style>

fsutil.exe behavior set disable8dot3 1

Problem solved!

<o:p></o:p>

New Post: STATS ONLY

Riesaz — Tue, 29 Jul 2008 09:48:18 GMT

Hello Clint and thank you for helping me.

I have this problem with all the counter of Physycal Disk and with Processor % Processor Time.

I will try to paste the XML file.

New Post: STATS ONLY

ClintH — Tue, 29 Jul 2008 00:38:16 GMT

The results of the analysis should only be "Stats Only" only if you have not specified any thresholds. Please send me or post the threshold file (XML), so I can see what is going on. Did you add the threshold using the PAL Editor?

Created Release: PAL v1.3 Beta 8 (Jul 28, 2008)

Tue, 29 Jul 2008 00:36:12 GMT

Win2008 Hyper-V: A Windows Server 2008 Hyper-V threshold file has been added to PAL. This is a beta release of this threshold file pending review from other subject matter experts.
New Feature: The UI now supports time range restrictions - meaning the perfmon log can be restricted to a time range.
Behavior Change: SQL Server processes are excluded from the high virtual memory analysis because it is normal for it to consume as much virtual memory as it can. This applies to all SQL related threshold files.
Behavior Change: Multiselection of perfmon logs has been added back to the Counter Log Path control. This is to allow the merge of log files. Warning: Merging of log files can produce unpredictable results.
UI Change: Changed "Add and Restart" to "Add to Queue" in the Execution portion of the wizard.
Bug Fix: Fixed a bug where the answers to the questions all become the same when you add a new item to the queue and when the user changes the threshold file.
New Feature: Mike Lagase has provided us with new Microsoft Exchange Server 2007 threshold files. This is the first release of them. Mike has blogged about it here http://blogs.technet.com/mikelag/archive/2007/12/13/exchange-performance-troubleshooting-using-the-pal-tool.aspx.
New Feature: The PAL.vbs file now supports a beginning time and end time - meaning if you only want a specific time range of the perfmon log analyzed, then you can specify the begin and end times. This was very helpful during my last performance lab. It's not in the user interface yet, but you can use it in this release by specifying the arguments like this: /BEGINTIME:"05/31/2008 20:55:25" /ENDTIME:"05/31/2008 21:55:25".
Behavior Change: The Process percent processor time is now based on the number of processors - meaning if a process is taking up more than x CPU divided by the number of processors.
Bug Fix: The "SQLServer:Buffer Manager Page life expectancy" analysis in the SQL2005.xml threshold file was missing the ISCOUNTEROBJECTREGULAREXPRESSION="True" attribute and not processing the analysis for named instances of SQL Server. This has been fixed.
Bug Fix: Fixed the ASP.NET Execution Times counter in the IIS threshold file, so that it will match counter instances.
New Feature: Added the ratio of analyses processed to total analyses in the threshold file to the end of the output command prompt.
New Feature: The path to the debug log file is mentioned at the end of the output command prompt.
Bug Fix: The path to the PAL.vbs script was changing to the path of the log files. This has really has been fixed this time.
Behavior Change: The settings of the output directory, analysis interval, and Threshold file path now persist when you add a new item to the queue. Previously they reverted to their default settings.
Bug Fix: Fixed a bug where the PAL.vbs path changed when a new output directory is selected.
Bug Fix: The setup file was not prompting for security elevation on Vista. This is fixed now, but will install under the elevated user.
New Feature: Able to specify the HTML report file name.
New Feature: Able to specify the XML report file name.
New Feature: Queuing up command. Added options at the end of the wizard to choose to execute immediately, exectute, then restart the wizard, or add to queue and restart the wizard.
New Feature: An output directory can now be specified for the HTML report. If omitted, then the default "PAL Reports" directory will be used under the user's My Documents folder. Use the argument "/OUTPUTDIR" to specify the output directory.
New Feature: Able to run multiple PAL.vbs instances at the same time.
New UI: The user interface has been changed to be a Wizard versus an open form.
Bug Fix: In perfmon logs containing data counter data from multiple computers, PAL was only processing one of the counters of the same name. This is now fixed.
Bug Fix: The main form was showi

Released: PAL v1.3 Beta 8 (Jul 28, 2008)

Tue, 29 Jul 2008 00:36:12 GMT

Win2008 Hyper-V: A Windows Server 2008 Hyper-V threshold file has been added to PAL. This is a beta release of this threshold file pending review from other subject matter experts.
New Feature: The UI now supports time range restrictions - meaning the perfmon log can be restricted to a time range.
Behavior Change: SQL Server processes are excluded from the high virtual memory analysis because it is normal for it to consume as much virtual memory as it can. This applies to all SQL related threshold files.
Behavior Change: Multiselection of perfmon logs has been added back to the Counter Log Path control. This is to allow the merge of log files. Warning: Merging of log files can produce unpredictable results.
UI Change: Changed "Add and Restart" to "Add to Queue" in the Execution portion of the wizard.
Bug Fix: Fixed a bug where the answers to the questions all become the same when you add a new item to the queue and when the user changes the threshold file.
New Feature: Mike Lagase has provided us with new Microsoft Exchange Server 2007 threshold files. This is the first release of them. Mike has blogged about it here http://blogs.technet.com/mikelag/archive/2007/12/13/exchange-performance-troubleshooting-using-the-pal-tool.aspx.
New Feature: The PAL.vbs file now supports a beginning time and end time - meaning if you only want a specific time range of the perfmon log analyzed, then you can specify the begin and end times. This was very helpful during my last performance lab. It's not in the user interface yet, but you can use it in this release by specifying the arguments like this: /BEGINTIME:"05/31/2008 20:55:25" /ENDTIME:"05/31/2008 21:55:25".
Behavior Change: The Process percent processor time is now based on the number of processors - meaning if a process is taking up more than x CPU divided by the number of processors.
Bug Fix: The "SQLServer:Buffer Manager Page life expectancy" analysis in the SQL2005.xml threshold file was missing the ISCOUNTEROBJECTREGULAREXPRESSION="True" attribute and not processing the analysis for named instances of SQL Server. This has been fixed.
Bug Fix: Fixed the ASP.NET Execution Times counter in the IIS threshold file, so that it will match counter instances.
New Feature: Added the ratio of analyses processed to total analyses in the threshold file to the end of the output command prompt.
New Feature: The path to the debug log file is mentioned at the end of the output command prompt.
Bug Fix: The path to the PAL.vbs script was changing to the path of the log files. This has really has been fixed this time.
Behavior Change: The settings of the output directory, analysis interval, and Threshold file path now persist when you add a new item to the queue. Previously they reverted to their default settings.
Bug Fix: Fixed a bug where the PAL.vbs path changed when a new output directory is selected.
Bug Fix: The setup file was not prompting for security elevation on Vista. This is fixed now, but will install under the elevated user.
New Feature: Able to specify the HTML report file name.
New Feature: Able to specify the XML report file name.
New Feature: Queuing up command. Added options at the end of the wizard to choose to execute immediately, exectute, then restart the wizard, or add to queue and restart the wizard.
New Feature: An output directory can now be specified for the HTML report. If omitted, then the default "PAL Reports" directory will be used under the user's My Documents folder. Use the argument "/OUTPUTDIR" to specify the output directory.
New Feature: Able to run multiple PAL.vbs instances at the same time.
New UI: The user interface has been changed to be a Wizard versus an open form.
Bug Fix: In perfmon logs containing data counter data from multiple computers, PAL was only processing one of the counters of the same name. This is now fixed.
Bug Fix: The main form was showi

Commented Issue: could not complete performance analyze with "Object required: 'oAlert'"

rosab — Tue, 22 Jul 2008 19:38:27 GMT

I am having the same issue.