Table of Contents


APPENDIX A
The Performance Monitor Objects

If you have ever tried to use the Performance Monitor for performance tuning, then you are aware that it can be very difficult to determine what counters to monitor. Generally, this is because you have to view each object counter’s description individually. The following tables contain all of the Performance Monitor object types, object counters, and object descriptions so you can refer to them at a glance, even without the Performance Monitor running. You should be aware, however, that not every counter is listed here. If you have additional third-party drivers or system software, it could add additional counters. But almost every Windows NT Server object counter is listed, and I hope it helps you end the tedium of searching the Performance Monitor object by object to obtain a desciption of the object counter. I also hope this provides you with an easy reference to help you make more efficient use of the Performance Monitor.

Note:  Chapter 4 includes a discussion on how to use the Performance Monitor. It also includes basic discussions on monitoring the system for processor, I/O, and network bottlenecks.
Table A.1 The AppleTalk Performance Monitor object counters.
AppleTalk—AppleTalk Protocol
 
Object Counters Description
AARP Packets/sec. The number of AARP packets per second received by the AppleTalk protocol on this port.
ATP ALO Response/sec. The number of ATP at-least-once transaction responses per second on this port.
ATP Packets/sec. The number of ATP packets per second received by AppleTalk on this port.
ATP Recvd Release/sec. The number of ATP transaction release packets per second received on this port.
ATP Response Timeouts The number of ATP release timers that have expired on this port.
ATP Retries Local The number of ATP requests retransmitted on this port.
ATP Retries Remote The number of ATP requests retransmitted to this port.
ATP XO Response/sec. The number of ATP exactly-once transaction responses per second on this port.
Average Time/AARP Packet The average time in milliseconds to process an AARP packet on this port.
Average Time/ATP Packet The average time in milliseconds to process an ATP packet on this port.
Average Time/DDP Packet The average time in milliseconds to process a DDP packet on this port.
Average Time/NBP Packet The average time in milliseconds to process an NBP packet on this port.
Average Time/RTMP Packet The average time in milliseconds to process an RTMP packet on this port.
Average Time/ZIP Packet The average time in milliseconds to process a ZIP packet on this port.
Bytes In/sec. The number of bytes received per second by AppleTalk on this port.
Bytes Out/sec. The number of bytes sent per second by AppleTalk on this port.
Current Nonpaged The current amount of Nonpaged Pool memory resources used by AppleTalk.
DDP Packets/sec. The number of DDP packets per second received by AppleTalk on this port.
NBP Packets/sec. The number of NBP packets per second received by AppleTalk on this port.
Packets Dropped The number of packets dropped due to resource limitations on this port.
Packets In/sec. The number of packets received per second by AppleTalk on this port.
Packets Out/sec. The number of packets sent per second by AppleTalk on this port.
Packets Routed In/sec. The number of packets per second routed in on this port.
Packets Routed Out/sec. The number of packets per second routed out on this port.
RTMP Packets/sec. The number of RTMP packets per second received by AppleTalk on this port.
ZIP Packets/sec. The number of ZIP packets per second received by AppleTalk on this port.

Table A.2 The Browser Performance Monitor object counters.
Browser—Browser Statistics
 
Object Counters Description
Announcements Domain/sec. The rate at which a domain has announced itself to the network.
Announcements Server/sec. The rate at which the servers in this domain have announced themselves to this server.
Announcements Total/sec. The sum of Announcements Server/sec. and Announcements Domain/sec.
Duplicate Master Announcements The number of times that the master browser has detected another master browser on the same domain.
Election Packets/sec. The rate of browser election packets that have been received by this workstation.
Enumerations Domain/sec. The rate of domain browse requests that have been processed by this workstation.
Enumerations Other/sec. The rate of browse requests processed by this workstation that were not domain or server browse requests.
Enumerations Server/sec. The rate of server browse requests that have been processed by this workstation.
Enumerations Total/sec. The rate of browse requests that have been processed by this workstation. This is the sum of Enumerations Server, Enumerations Domain, and Enumerations Other per second.
Illegal Datagrams/sec. The rate of incorrectly formatted datagrams that have been received by the workstation.
Mailslot Allocations Failed The number of times the datagram receiver has failed to allocate a buffer to hold a user mailslot write.
Mailslot Opens Failed/sec. The rate of mailslot messages received by this workstation that were to be delivered to mailslots that are not present on this workstation.
Mailslot Receives Failed The number of mailslot messages that couldn’t be received due to transport failures.
Mailslot Writes Failed The total number of mailslot messages that were successfully received but were unable to be written to the mailslot.
Mailslot Writes/sec. The rate of mailslot messages that have been successfully received.
Missed Mailslot Datagrams The number of mailslot datagrams that have been discarded due to configuration or allocation limits.
Missed Server Announcements The number of server announcements that have been missed due to configuration or allocation limits.
Missed Server List Requests The number of requests to retrieve a list of browser servers that were received by this workstation but could not be processed.
Server Announce Allocations Failed/sec. The rate of server (or domain) announcements that have failed due to lack of memory.
Server List Requests/sec. The rate of requests to retrieve a list of browser servers that have been processed by this workstation.

Table A.3 The Cache Performance Monitor object counters.
Cache—The cache object type manages memory for rapid access to files. Files on Windows NT are cached in main memory in units of pages. Main memory not being used in the Working Sets of processes is available to the cache for this purpose. The cache preserves file pages in memory for as long as possible to permit access to the data through the file system without having to access the disk.
 
Object Counters Description
Async Copy Reads/sec. The frequency of reads from cache pages that involve a memory copy of the data from the cache to the application’s buffer. The application will regain control immediately even if the disk must be accessed to retrieve the page.
Async Data Maps/sec. The frequency that an application using a file system such as NTFS or HPFS maps a page of a file into the cache to read the page, and does not wish to wait for the cache to retrieve the page if it is not in main memory.
Async Fast Reads/sec. The frequency of reads from cache pages that bypass the installed file system and retrieve the data directly from the cache. Normally, file I/O requests will invoke the appropriate file system to retrieve data from a file, but this path permits direct retrieval of cache data without file system involvement if the data is in the cache. Even if the data is not in the cache, one invocation of the file system is avoided. If the data is not in the cache, the request (application program call) will not wait until the data has been retrieved from disk, but will get control immediately.
Async MDL Reads/sec. The frequency of reads from cache pages using a Memory Descriptor List (MDL) to access the pages. The MDL contains the physical address of each page in the transfer, thus permitting Direct Memory Access (DMA) of the pages. If the accessed page(s) is/are not in main memory, the calling application program will not wait for the page(s) to fault in from disk.
Async Pin Reads/sec. The frequency of reading data into the cache prior to writing the data back to disk. Pages read in this fashion are pinned in memory at the completion of the read. The file system will regain control immediately even if the disk must be accessed to retrieve the page. While pinned, a page’s physical address will not be altered.
Copy Read Hits % The percentage of cache Copy Read requests that hit the cache (i.e., did not require a disk read in order to provide access to the page in the cache ). A Copy Read is a file read operation that is satisfied by a memory copy from a cache page to the application’s buffer. The LAN Redirector uses this method for retrieving cache information, as does the LAN server for small transfers. This is a method used by the disk file systems, as well.
Copy Reads/sec. The frequency of reads from cache pages that involve a memory copy of the data from the cache to the application’s buffer. The LAN Redirector uses this method for retrieving cache information, as does the LAN server for small transfers. This is a method used by the disk file systems, as well.
Data Flush Pages/sec. The number of pages the cache has flushed to disk as a result of a request to flush or to satisfy a write-through file write request. More than one page can be transferred on each flush operation.
Data Flushes/sec. The frequency the cache has flushed its contents to disk as the result of a request to flush or to satisfy a write-through file write request. More than one page can be transferred on each flush operation.
Data Map Hits % The percentage of Data Maps in the cache that could be resolved without having to retrieve a page from the disk (i.e., the page was already in physical memory).
Data Map Pins/sec. The frequency of Data Maps in the cache that resulted in pinning a page in main memory, an action usually preparatory to writing to the file on disk. While pinned, a page’s physical address in main memory and virtual address in the cache will not be altered.
Data Maps/sec. The frequency that a file system such as NTFS or HPFS maps a page of a file into the cache to read the page.
Fast Read Not Possibles/sec. The frequency of attempts by an Application Program Interface (API) function call to bypass the file system to get at cache data, which could not be honored without invoking the file system.
Fast Read Resource Misses/sec. The frequency of cache misses necessitated by the lack of available resources to satisfy the request.
Fast Reads/sec. The frequency of reads from cache pages that bypass the installed file system and retrieve the data directly from the cache. Normally, file I/O requests invoke the appropriate file system to retrieve data from a file, but this path permits direct retrieval of cache data without file system involvement if the data is in the cache. Even if the data is not in the cache, one invocation of the file system is avoided.
Lazy Write Flushes/sec. The frequency the cache’s Lazy Write thread has written to disk. Lazy Writing is the process of updating the disk after the page has been changed in memory, so the application making the change to the file does not have to wait for the disk write to complete before proceeding. More than one page can be transferred on each write operation.
Lazy Write Pages/sec. The frequency the cache’s Lazy Write thread has written to disk. Lazy Writing is the process of updating the disk after the page has been changed in memory, so the application making the change to the file does not have to wait for the disk write to complete before proceeding. More than one page can be transferred on a single disk write operation.
MDL Read Hits % The percentage of cache Memory Descriptor List (MDL) Read requests that hit the cache (i.e., did not require disk accesses in order to provide memory access to the page(s) in the cache).
MDL Reads/sec. The frequency of reads from cache pages that use a Memory Descriptor List (MDL) to access the data. The MDL contains the physical address of each page involved in the transfer, and thus can employ a hardware Direct Memory Access (DMA) device to effect the copy. The LAN server uses this method for large transfers out of the server.
Pin Read Hits % The percentage of cache Pin Read requests that hit the cache (i.e., did not require a disk read in order to provide access to the page in the cache ). While pinned, a page’s physical address in the cache will not be altered. The LAN Redirector uses this method for retrieving cache information, as does the LAN server for small transfers. This is usually the method used by the disk file systems, as well.
Pin Reads/sec. The frequency of reading data into the cache preparatory to writing the data back to disk. Pages read in this fashion are pinned in memory at the completion of the read. While pinned, a page’s physical address in the cache will not be altered.
Sync Copy Reads/sec. The frequency of reads from cache pages that involve a memory copy of the data from the cache to the application’s buffer. The file system will not regain control until the copy operation is complete, even if the disk must be accessed to retrieve the page.
Sync Data Maps/sec. The frequency that a file system such as NTFS or HPFS maps a page of a file into the cache to read the page, and wishes to wait for the cache to retrieve the page if it is not in main memory.
Sync Fast Reads/sec. The frequency of reads from cache pages that bypass the installed file system and retrieve the data directly from the cache. Normally, file I/O requests invoke the appropriate file system to retrieve data from a file, but this path permits direct retrieval of cache data without file system involvement if the data is in the cache. Even if the data is not in the cache , one invocation of the file system is avoided. If the data is not in the cache, the request (application program call) will wait until the data has been retrieved from disk.
Sync MDL Reads/sec. The frequency of reads from cache pages that use a Memory Descriptor List (MDL) to access the pages. The MDL contains the physical address of each page in the transfer, thus permitting Direct Memory Access (DMA) of the pages. If the accessed page(s) is/are not in main memory, the caller will wait for the page(s) to fault in from the disk.
Sync Pin Reads/sec. The frequency of reading data into the cache preparatory to writing the data back to disk. Pages read in this fashion are pinned in memory at the completion of the read. The file system will not regain control until the page is pinned in the cache , in particular if the disk must be accessed to retrieve the page. While pinned, a page’s physical address in the cache will not be altered.

Table A.4 The FTP Server Performance Monitor object counters.
FTP Server—The FTP Server object type includes counters specific to the FTP Server service.
 
Object Counters Description
Bytes Received/sec. The rate in which data bytes are received by the FTP Server.
Bytes Sent/sec. The rate in which data bytes are sent by the FTP Server.
Bytes Total/sec. The sum of Bytes Sent/sec. and Bytes Received/sec. This is the total rate of bytes transferred by the FTP Server.
Connection Attempts The number of connection attempts that have been made to the FTP Server.
Current Anonymous Users The number of anonymous users currently connected to the FTP Server.
Current Connections The current number of connections to the FTP Server.
Current NonAnonymous Users The number of nonanonymous users currently connected to the FTP Server.
Files Received The total number of files received by the FTP Server.
Files Sent The total number of files sent by the FTP Server.
Files Total The sum of Files Sent and Files Received. This is the total number of files transferred by the FTP Server.
Logon Attempts The number of logon attempts that have been made by the FTP Server.
Maximum Anonymous Users The maximum number of anonymous users simultaneously connected to the FTP Server.
Maximum Connections The maximum number of simultaneous connections to the FTP Server.
Maximum NonAnonymous Users The maximum number of nonanonymous users simultaneously connected to the FTP Server.
Total Anonymous Users The total number of anonymous users that have ever connected to the FTP Server.
Total NonAnonymous Users The total number of nonanonymous users that have ever connected to the FTP Server.

Table A.5 The Gateway Service For NetWare Performance Monitor object counters.
Gateway Service For NetWare—Gateway Service For NetWare object type
 
Object Counters Description
Bytes Received/sec. The rate of bytes coming in to the Redirector from the network. It includes all application data as well as network protocol information (such as packet headers).
Bytes Total/sec. The rate in which the Redirector is processing data bytes. This includes all application and file data in addition to information such as packet headers.
Bytes Transmitted/sec. The rate in which bytes are leaving the Redirector to the network. It includes all application data as well as network protocol information (such as packet headers and the like).
Connect NetWare 2.x The number of connections to NetWare 2.x servers.
Connect NetWare 3.x The number of connections to NetWare 3.x servers.
Connect NetWare 4.x The number of connections to NetWare 4.x servers.
File Data Operations/sec. The rate in which the Redirector is processing data operations. Hopefully, one operation includes many bytes. We say hopefully here because each operation has overhead. You can determine the efficiency of this path by dividing the Bytes/sec. by this counter to determine the average number of bytes transferred/operation.
File Read Operations/sec. The rate in which applications are asking the Redirector for data. Each call to a file system or similar Application Program Interface (API) call counts as one operation.
File Write Operations/sec. The rate in which applications are sending data to the Redirector. Each call to a file system or similar Application Program Interface (API) call counts as one operation.
Packet Burst IO/sec. The sum of Packet Burst Read NCPs/sec. and Packet Burst Write NCPs/sec.
Packet Burst Read NCP Count/sec. The rate of NetWare Core Protocol requests for Packet Burst Read. Packet Burst is a windowing protocol that improves performance.
Packet Burst Read Timeouts/sec. The rate in which the NetWare Service needs to retransmit a Burst Read Request because the NetWare server took too long to respond.
Packet Burst Write NCP Count/sec. The rate of NetWare Core Protocol requests for Packet Burst Write. Packet Burst is a windowing protocol that improves performance.
Packet Burst Write Timeouts/sec. The rate in which the NetWare Service needs to retransmit a Burst Write Request because the NetWare server took too long to respond.
Packets Received/sec. The rate in which the Redirector is receiving packets (also called SMBs or Server Message Blocks). Network transmissions are divided into packets. The average number of bytes received in a packet can be obtained by dividing Bytes Received/sec. by this counter. Some packets received might not contain incoming data. For example, an acknowledgment to a write made by the Redirector would count as an incoming packet.
Packets/sec. The rate in which the Redirector is processing data packets. Hopefully, one packet includes many bytes. We say hopefully here because each packet has protocol overhead. You can determine the efficiency of this path by dividing the Bytes/sec. by this counter to determine the average number of bytes transferred/packet. You can also divide this counter by Operations/sec. to determine the average number of packets per operation, another measure of efficiency.
Packets Transmitted/sec. The rate in which the Redirector is sending packets (also called SMBs or Server Message Blocks). Network transmissions are divided into packets. The average number of bytes transmitted in a packet can be obtained by dividing Bytes Transmitted/sec. by this counter.
Read Operations Random/sec. The rate, on a file-by-file basis, in which reads are made that are not sequential. If a read is made using a particular file handle, and then is followed by another read that is not immediately the contiguous next byte, this counter is incremented by one.
Read Packets/sec. The rate in which read packets are being placed on the network. Each time a single packet is sent with a request to read data remotely, this counter is incremented by one.
Server Disconnects The number of times a server has disconnected your Redirector. (See also Gateway Service For NetWare: Server Reconnects.)
Server Reconnects The number of times your Redirector has had to reconnect to a server in order to complete a new active request. You can be disconnected by the server if you remain inactive for too long. Even locally, if all your remote files are closed, the Redirector will keep your connections intact for (nominally) 10 minutes. Such inactive connections are called dormant connections. Reconnecting is expensive in time.
Server Sessions The number of active security objects the Redirector is managing. For example, a Logon to a server followed by a network access to the same server will establish one connection, but two sessions.
Write Operations Random/sec. The rate, on a file-by-file basis, in which writes are made that are not sequential. If a write is made using a particular file handle, and then is followed by another write that is not immediately the next contiguous byte, this counter is incremented by one.
Write Packets/sec. The rate in which writes are being sent to the network. Each time a single packet is sent with a request to write remote data, this counter is incremented by one.

Table A.6 The ICMP Performance Monitor object counters.
ICMP—The ICMP object type includes those counters that describe the rates that ICMP messages are received and sent by a certain entity using the ICMP protocol. It also describes various error counts for the ICMP protocol.
 
Object Counters Description
Messages Outbound Errors The number of ICMP messages that this entity did not send due to problems discovered within ICMP, such as lack of buffers. This value should not include errors discovered outside the ICMP layer, such as the inability of IP to route the resultant datagram. In some implementations, no errors can contribute to this counter’s value.
Messages Received Errors The number of ICMP messages that the entity received but determined as having errors (bad ICMP checksums, bad length, and so forth).
Messages Received/sec. The rate in which ICMP messages are received by the entity. The rate includes those messages received in error.
Messages/sec. The total rate in which ICMP messages are received and sent by the entity. The rate includes those messages received or sent in error.
Messages Sent/sec. The rate in which ICMP messages are attempted to be sent by the entity. The rate includes those messages sent in error.
Received Address Mask Reply The number of ICMP Address Mask Reply messages received.
Received Address Mask Request The number of ICMP Address Mask Request messages received.
Received Dest. Unreachable The number of ICMP Destination Unreachable messages received.
Received Echo Reply/sec. The rate of ICMP Echo Reply messages received.
Received Echo/sec. The rate of ICMP Echo messages received.
Received Parameter Problem The number of ICMP Parameter Problem messages received.
Received Redirect/sec. The rate of ICMP Redirect messages received.
Received Source Quench The number of ICMP Source Quench messages received.
Received Time Exceeded The number of ICMP Time Exceeded messages received.
Received Timestamp Reply/sec. The rate of ICMP Timestamp Reply messages received.
Received Timestamp/sec. The rate of ICMP Timestamp (request) messages received.
Sent Address Mask Reply The number of ICMP Address Mask Reply messages sent.
Sent Address Mask Request The number of ICMP Address Mask Request messages sent.
Sent Destination Unreachable The number of ICMP Destination Unreachable messages sent.
Sent Echo Reply/sec. The rate of ICMP Echo Reply messages sent.
Sent Echo/sec. The rate of ICMP Echo messages sent.
Sent Parameter Problem The number of ICMP Parameter Problem messages sent.
Sent Redirect/sec. The rate of ICMP Redirect messages sent.
Sent Source Quench The number of ICMP Source Quench messages sent.
Sent Time Exceeded The number of ICMP Time Exceeded messages sent.
Sent Timestamp Reply/sec. The rate of ICMP Timestamp Reply messages sent.
Sent Timestamp/sec. The rate of ICMP Timestamp (request) messages sent.

Table A.7 The IP Performance Monitor object counters.
IP—The IP object type includes those counters that describe the rates that IP datagrams are received and sent by a certain computer using the IP protocol. It also describes various error counts for the IP protocol.
 
Object Counters Description
Datagrams Forwarded/sec. The rate of input datagrams for which this entity was not the final IP destination, as a result of which an attempt was made to find a route to forward them to the final destination. In entities that do not act as IP Gateways, this rate will include only those packets that were Source-Routed via this entity, and the Source-Route option processing was successful.
Datagrams Outbound Discarded The number of output IP datagrams for which no problems were encountered to prevent their transmission to their destination, but which were discarded (e.g., for lack of buffer space). This counter would include datagrams counted in Datagrams Forwarded/sec. if any such packets met this (discretionary) discard criterion.
Datagrams Outbound No Route The number of IP datagrams discarded because no route could be found to transmit them to their destination. This counter includes any packets counted in Datagrams Forwarded/sec. that meet this “no route” criterion.
Datagrams Received Address Errors The number of input datagrams discarded because the IP address in their IP headers’ destination field was not a valid address to be received at this entity. This count includes invalid addresses (e.g., 0.0. 0.0) and addresses of unsupported classes (e.g., Class E). For entities that are not IP Gateways and therefore do not forward datagrams, this counter includes datagrams discarded because the destination address was not a local address.
Datagrams Received Delivered/sec. The rate input datagrams are successfully delivered to IP user-protocols (including ICMP).
Datagrams Received Discarded The number of input IP datagrams for which no problems were encountered to prevent their continued processing, but which were discarded (e.g., for lack of buffer space). This counter does not include any datagrams discarded while awaiting reassembly.
Datagrams Received Header Errors The number of input datagrams discarded due to errors in their IP headers, including bad checksums, version number mismatch, other format errors, time-to-live exceeded, errors discovered in processing their IP options, and so forth.
Datagrams Received Unknown Protocol The number of locally addressed datagrams received successfully but discarded because of an unknown or unsupported protocol.
Datagrams Received/sec. The rate in which IP datagrams are received from the interfaces, including those in error.
Datagrams/sec. The rate in which IP datagrams are received from or sent to the interfaces, including those in error. Any forwarded datagrams are not included in this rate.
Datagrams Sent/sec. The rate in which IP datagrams are supplied to IP for transmission by local IP user-protocols (including ICMP). This counter does not include any datagrams counted in Datagrams Forwarded/sec.
Fragment Reassembly Failures The number of failures detected by the IP re-assembly algorithm (for whatever reason: timed out, errors, and so forth). This is not necessarily a count of discarded IP fragments because some algorithms (notably RFC 815) can lose track of the number of fragments by combining them as they are received.
Fragmentation Failures The number of IP datagrams that have been discarded because they needed to be fragmented at this entity but could not be, e.g., because their “Don’t Fragment” flag was set.
Fragmented Datagrams/sec. The rate in which datagrams are successfully fragmented at this entity.
Fragments Created/sec. The rate in which IP datagram fragments have been generated as a result of fragmentation at this entity.
Fragments Reassembled/sec. The rate in which IP fragments are successfully reassembled.
Fragments Received/sec. The rate in which IP fragments that need to be reassembled at this entity are received.

Table A.8 The Logical Disk Performance Monitor object counters.
Logical Disk—A Logical Disk object type is a partition on a hard or fixed disk drive and assigned a drive letter, such as C. Disks can be partitioned into distinct sections where they can store file, program, and page data. The disk is read to retrieve these items, and written to record changes to them.
 
Object Counters Description
% Disk Read Time The percentage of elapsed time that the selected disk drive is busy servicing read requests.
% Disk Time The percentage of elapsed time that the selected disk drive is busy servicing read or write requests.
% Disk Write Time The percentage of elapsed time that the selected disk drive is busy servicing write requests.
% Free Space The ratio of the free space available on the logical disk unit to the total usable space provided by the selected logical disk drive.
Avg. Disk Bytes/Read The average number of bytes transferred from the disk during read operations.
Avg. Disk Bytes/Transfer The average number of bytes transferred to or from the disk during write or read operations.
Avg. Disk Bytes/Write The average number of bytes transferred to the disk during write operations.
Avg. Disk Read/sec. The average time in seconds of a read of data from the disk.
Avg. Disk Transfer/sec. The time in seconds of the average disk transfer.
Avg. Disk Write/sec. The average time in seconds of a write of data to the disk.
Disk Bytes/sec. The rate in which bytes are transferred to or from the disk during write or read operations.
Disk Queue Length The number of requests outstanding on the disk at the time the performance data is collected. It includes requests in service at the time of the snapshot. This is an instantaneous length, not an average over the time interval. Multispindle disk devices can have multiple requests active at one time, but other concurrent requests are awaiting service. This counter can reflect a transitory high or low queue length, but if there is a sustained load on the disk drive, it is likely that this will be consistently high. Requests are experiencing delays proportional to the length of this queue minus the number of spindles on the disks. This difference should average less than two for good performance.
Disk Read Bytes/sec. The rate in which bytes are transferred from the disk during read operations.
Disk Reads/sec. The rate of read operations on the disk.
Disk Transfers/sec. The rate of read and write operations on the disk.
Disk Write Bytes/sec. The rate in which bytes are transferred to the disk during write operations.
Disk Writes/sec. The rate of write operations on the disk.
Free Megabytes Free Megabytes displays the unallocated space on the disk drive in megabytes. One megabyte = 1,048,576 bytes.

Table A.9 The MacFile Server Performance Monitor object counters.
MacFile Server—Services for Macintosh AFP File Server.
 
Object Counters Description
Current Files Open The number of internal files currently open in the MacFile Server. This count does not include files opened on behalf of Macintosh clients.
Current NonPaged Memory The current amount of nonpaged memory resources used by the MacFile Server.
Current Paged Memory The current amount of paged memory resources used by the MacFile Server.
Current Queue Length The number of outstanding work items waiting to be processed.
Current Sessions The number of sessions currently connected to the MacFile Server. Indicates current server activity.
Current Threads The current number of threads used by MacFile Server. Indicates how busy the server is.
Data Read/sec. The number of bytes read from disk per second.
Data Received/sec. The number of bytes received from the network per second. Indicates how busy the server is.
Data Transmitted/sec. The number of bytes sent on the network per second. Indicates how busy the server is.
Data Written/sec. The number of bytes written to disk per second.
Failed Logons The number of failed logon attempts to the MacFile Server. Can indicate whether password-guessing programs are being used to crack the security on the server.
Max NonPaged Memory The maximum amount of nonpaged memory resources used by the MacFile Server.
Max Paged Memory The maximum amount of paged memory resources used by the MacFile Server.
Maximum Files Open The maximum number of internal files open at one time in the MacFile Server. This count does not include files opened on behalf of Macintosh clients.
Maximum Queue Length The maximum number of outstanding work items waiting at one time.
Maximum Sessions The maximum number of sessions connected at one time to the MacFile Server. Indicates the usage level of the server.
Maximum Threads The maximum number of threads used by MacFile Server. Indicates the peak usage level of the server.

Table A.10 The Memory Performance Monitor object counters.
Memory—The Memory object type includes those counters that describe the behavior of both real and virtual memory on the computer. Real memory is allocated in units of pages. Virtual memory can exceed real memory in size, causing page traffic as virtual pages are moved between disk and real memory.
 
Object Counters Description
Available Bytes The size of the virtual memory currently on the Zeroed, Free, and Standby lists. Zeroed and Free memory is ready for use, with Zeroed memory cleared to zeros. Standby memory is memory removed from a process’s Working Set but still available. Notice that this is an instantaneous count, not an average over the time interval.
Cache Bytes The number of bytes currently in use by the system cache. The system cache is used to buffer data retrieved from disk or LAN. The system cache uses memory not in use by active processes in the computer.
Cache Bytes Peak The maximum number of bytes used by the system cache. The system cache is used to buffer data retrieved from disk or LAN. The system cache uses memory not in use by active processes in the computer.
Cache Faults/sec. The number of cache faults per second. Cache faults occur whenever the cache manager does not find a file’s page in the immediate cache and must ask the memory manager to locate the page elsewhere in memory or on the disk so that it can be loaded into the immediate cache.
Commit Limit The size (in bytes) of virtual memory that can be committed without having to extend the paging file(s). If the paging file(s) can be extended, this is a soft limit.
Committed Bytes The size of virtual memory (in bytes) that has been committed (as opposed to simply reserved). Committed memory must have backing (i.e., disk) storage available, or must be assured never to need disk storage (because main memory is large enough to hold it). Notice that this is an instantaneous count, not an average over the time interval.
Demand Zero Faults/sec. The number of page faults for pages that must be filled with zeros before the fault is satisfied. If the Zeroed list is not empty, the fault can be resolved by removing a page from the Zeroed list.
Free System Page Table Entries The number of Page Table Entries not currently in use by the system.
Page Faults/sec. A count of the page faults in the processor. A page fault occurs when a process refers to a virtual memory page that is not in its Working Set in main memory. A page fault will not cause the page to be fetched from disk if that page is on the standby list, and hence already in main memory, or if it is in use by another process with which the page is shared.
Page Reads/sec. The number of times the disk was read to retrieve pages of virtual memory necessary to resolve page faults. Multiple pages can be read during a disk read operation.
Page Writes/sec. A count of the number of times pages have been written to the disk because they were changed since they were last retrieved. Each write operation can transfer a number of pages.
Pages Input/sec. The number of pages read from the disk to resolve memory references to pages that were not in memory at the time of the reference. This counter includes paging traffic on behalf of the system cache to access file data for applications. This is an important counter to observe if you are concerned about excessive memory pressure (that is, thrashing) and the excessive paging that can result.
Pages Output/sec. A count of the number of pages that are written to disk because the pages have been modified in main memory.
Pages/sec. The number of pages read from the disk or written to the disk to resolve memory references to pages that were not in memory at the time of the reference. This is the sum of Pages Input/sec. and Pages Output/sec. This counter includes paging traffic on behalf of the system cache to access file data for applications. This is the primary counter to observe if you are concerned about excessive memory pressure (that is, thrashing) and the excessive paging that can result.
Pool Nonpaged Allocs The number of calls to allocate space in the system Nonpaged Pool. Nonpaged Pool is a system memory area where space is acquired by operating system components as they accomplish their tasks. Nonpaged Pool pages cannot be paged out to the paging file but, instead, remain in main memory as long as they are allocated.
Pool Nonpaged Bytes The number of bytes in the Nonpaged Pool, a system memory area where space is acquired by operating system components as they accomplish their appointed tasks. Nonpaged Pool pages cannot be paged out to the paging file but, instead, remain in main memory as long as they are allocated.
Pool Paged Allocs The number of calls to allocate space in the system Paged Pool. Paged Pool is a system memory area where space is acquired by operating system components as they accomplish their appointed tasks. Paged Pool pages can be paged out to the paging file when not accessed by the system for sustained periods of time.
Pool Paged Bytes The number of bytes in the Paged Pool, a system memory area where space is acquired by operating system components as they accomplish their appointed tasks. Paged Pool pages can be paged out to the paging file when not accessed by the system for sustained periods of time.
Pool Paged Resident Bytes The size of the Paged Pool resident in core memory. This is the actual cost of the Paged Pool allocation, because this is actively in use and using real physical memory.
System Cache Resident Bytes The number of bytes currently resident in the global disk cache.
System Code Resident Bytes The number of bytes of System Code Total Bytes currently resident in core memory. This is the code Working Set of the pageable executive. In addition to this, there is another [sim]300K of nonpaged kernel code.
System Code Total Bytes The number of bytes of pageable pages in NTOSKRNL.EXE, AHL.DLL, and the boot drivers and file systems loaded by ntldr/osloader.
System Driver Resident Bytes The number of bytes of System Driver Total Bytes currently resident in core memory. This number is the code Working Set of the pageable drivers. In addition to this, there is another [sim]700K of nonpaged driver code.
System Driver Total Bytes The number of bytes of pageable pages in all other loaded device drivers.
Transition Faults/sec. The number of page faults resolved by recovering pages that were in transition (i.e., being written to disk at the time of the page fault. The pages were recovered without additional disk activity).
Write Copies/sec. The number of page faults that have been satisfied by making a copy of a page when an attempt to write to the page is made. This is an economical way of sharing data because the copy of the page is only made on an attempt to write to the page; otherwise, the page is shared.

Table A.11 The NBT Connection Performance Monitor object counters.
NBT Connection—The NBT Connection object type includes those counters that describe the rates that bytes are received and sent over a single NBT connection connecting the local computer with some remote computer. The connection is identified by the name of the remote computer.
 
Object Counters Description
Bytes Received/sec. The rate in which bytes are received by the local computer over an NBT connection to some remote computer. All bytes received by the local computer over the particular NBT connection are counted.
Bytes Sent/sec. The rate in which bytes are sent by the local computer over an NBT connection to some remote computer. All bytes sent by the local computer over the particular NBT connection are counted.
Total Bytes/sec. The rate in which bytes are sent or received by the local computer over an NBT connection to some remote computer. All bytes sent or received by the local computer over the particular NBT connection are counted.

Table A.12 The NetBEUI Performance Monitor object counters.
NetBEUI—The NetBEUI protocol handles data transmission for network activity that follows the NetBIOS End User Interface standard.
 
Object Counters Description
Bytes Total/sec. The sum of Frame Bytes/sec. and Datagram Bytes/sec. This is the total rate of bytes sent to or received from the network by the protocol, but only counts the bytes in frames (packets) that carry data.
Connection Session Timeouts The number of connections that were dropped due to a session timeout. This number is an accumulator and shows a running total.
Connections Canceled The number of canceled connections. This number is an accumulator and shows a running total.
Connections No Retries The total count of connections that were successfully made on the first try. This number is an accumulator and shows a running total.
Connections Open The number of connections currently open for this protocol. This counter shows the current count only and does not accumulate over time.
Connections With Retries The total count of connections that were made after retrying the attempt. A retry occurs when the first connection attempt failed. This number is an accumulator and shows a running total.
Datagram Bytes Received/sec. The rate in which datagram bytes are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagram Bytes/sec. The rate in which datagram bytes are processed by the computer. This counter is the sum of datagram bytes that are sent as well as received per second. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagram Bytes Sent/sec. The rate in which datagram bytes are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams Received/sec. The rate in which datagrams are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams/sec. The rate in which datagrams are processed by the computer. This counter displays the sum of datagrams sent and datagrams received per second. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams Sent/sec. The rate in which datagrams are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Disconnects Local The number of session disconnections initiated by the local computer. This number is an accumulator and shows a running total.
Disconnects Remote The number of session disconnections initiated by the remote computer. This number is an accumulator and shows a running total.
Expirations Ack The count of T2 timer expirations.
Expirations Response The count of T1 timer expirations.
Failures Adapter The number of connections dropped due to an adapter failure. This number is an accumulator and shows a running total.
Failures Link The number of connections dropped due to a link failure. This number is an accumulator and shows a running total.
Failures No Listen The number of connections rejected because the remote computer was not listening for connection requests.
Failures Not Found The number of connection attempts that failed because the remote computer could not be found. This number is an accumulator and shows a running total.
Failures Resource Local The number of connections that failed because of resource problems or shortages on the local computer. This number is an accumulator and shows a running total.
Failures Resource Remote The number of connections that failed because of resource problems or shortages on the remote computer. This number is an accumulator and shows a running total.
Frame Bytes Re-Sent/sec. The rate in which data bytes are re-sent by the computer. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes Received/sec. The rate in which data bytes are received by the computer. This counter only counts the frames (packets) that carry data.
Frame Bytes Rejected/sec. The rate in which data bytes are rejected. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes/sec. The rate in which data bytes are processed by the computer. This counter is the sum of data frame bytes sent and received per second. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes Sent/sec. The rate in which data bytes are sent by the computer. This counter only counts the bytes in frames (packets) that carry data.
Frames Re-Sent/sec. The rate in which data frames (packets) are re-sent by the computer. This counter only counts the frames (packets) that carry data.
Frames Received/sec. The rate in which data frames are received by the computer. This counter only counts the frames (packets) that carry data.
Frames Rejected/sec. The rate in which data frames are rejected. This counter only counts the frames (packets) that carry data.
Frames/sec. The rate in which data frames (packets) are processed by the computer. This counter is the sum of data frames sent and data frames received per second. This counter only counts the frames (packets) that carry data.
Frames Sent/sec. The rate in which data frames are sent by the computer. This counter only counts the frames (packets) that carry data.
Packets Received/sec. The rate in which packets are received by the computer. This counter counts all packets processed by the computer—control as well as data packets.
Packets/sec. The rate in which packets are processed by the computer. This count is the sum of packets sent and packets received per second. This counter includes all packets processed by the computer—control as well as data packets.
Packets Sent/sec. The rate in which packets are sent by the computer. This counter counts all packets sent by the computer—control as well as data packets.
Piggyback Ack Queued/sec. The rate at which piggybacked acknowledgments are queued. Piggyback acknowledgments are acknowledgments to received packets that are to be included in the next outgoing packet to the remote computer.
Piggyback Ack Timeouts The number of times a piggybacked acknowledgment could not be sent because there was no outgoing packet to the remote computer on which to piggyback. A piggyback ack is an acknowledgment to a received packet that is sent along in an outgoing data packet to the remote computer. If no outgoing packet is sent within the timeout period, then an ack packet is sent and this counter is incremented.
Window Send Average The running average number of data bytes that were sent before waiting for an acknowledgment from the remote computer.
Window Send Maximum The maximum number of bytes of data that will be sent before waiting for an acknowledgment from the remote computer.

Table A.13 The NetBEUI Resource Performance Monitor object counters.
NetBEUI Resource—The NetBEUI Resource object tracks the use of resources (buffers) by the NetBEUI protocol.
 
Object Counters Description
Times Exhausted The number of times all the resources (buffers) were in use. The number in parentheses following the resource name is used to identify the resource in Event Log messages.
Used Average The current number of resources (buffers) in use at this time. The number in parentheses following the resource name is used to identify the resource in Event Log messages.
Used Maximum The maximum number of NetBEUI resources (buffers) in use at any point in time. This value is useful in sizing the maximum resources provided. The number in parentheses following the resource name is used to identify the resource in Event Log messages.

Table A.14 The Network Interface Performance Monitor object counters.
Network Interface—The Network Interface object type includes those counters that describe the rates in which bytes and packets are received and sent over a network TCP/IP connection. It also describes various error counts for the same connection.
 
Object Counters Description
Bytes Received/sec. The rate in which bytes are received on the interface, including framing characters.
Bytes Sent/sec. The rate in which bytes are sent on the interface, including framing characters.
Bytes Total/sec. The rate in which bytes are sent and received on the interface, including framing characters.
Current Bandwidth An estimate of the interface’s current bandwidth in bits per second (bps). For interfaces that do not vary in bandwidth or for those where no accurate estimation can be made, this value is the nominal bandwidth.
Output Queue Length The length of the output packet queue (in packets). If this is longer than two, delays are being experienced, and the bottleneck should be found and eliminated if possible. The requests are queued by NDIS in this implementation, so this will always be zero.
Packets Outbound Discarded The number of outbound packets that were chosen to be discarded even though no errors had been detected to prevent their being transmitted. One possible reason for discarding such a packet could be to free up buffer space.
Packets Outbound Errors The number of outbound packets that could not be transmitted because of errors.
Packets Received Discarded The number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for discarding such a packet could be to free up buffer space.
Packets Received Errors The number of inbound packets that contained errors, preventing them from being deliverable to a higher-layer protocol.
Packets Received Non-Unicast/sec. The rate in which non-unicast (that is, subnet broadcast or subnet multicast) packets are delivered to a higher-layer protocol.
Packets Received/sec. The rate in which packets are received on the network interface.
Packets Received Unicast/sec. The rate (subnet) unicast packets are delivered to a higher-layer protocol.
Packets Received Unknown The number of packets received via the interface that were discarded because of an unknown or unsupported protocol.
Packets/sec. The rate in which packets are sent and received on the network interface.
Packets Sent Non-Unicast/sec. The rate in which packets are requested to be transmitted to non-unicast (that is, subnet broadcast or subnet multicast) addresses by higher-level protocols. The rate includes discarded and unsent packets.
Packets Sent/sec. The rate in which packets are sent on the network interface.
Packets Sent Unicast/sec. The rate in which packets are requested to be transmitted to subnet-unicast addresses by higher-level protocols. The rate includes discarded and unsent packets.

Table A.15 The Network Segment Performance Monitor object counters.
Network Segment—Provides network statistics for the local network segment via the Network Monitor Service.
 
Object Counters Description
% Broadcast Frames Percentage of network bandwidth that is made up of broadcast traffic on this network segment.
% Multicast Frames Percentage of network bandwidth that is made up of multicast traffic on this network segment.
% Network Utilization Percentage of network bandwidth in use on this network segment.
Broadcast Frames Received/sec. The number of broadcast frames received per second on this network segment.
Multicast Frames Received/sec. The number of multicast frames received per second on this network segment.
Total Bytes Received/sec. The number of bytes received per second on this network segment.
Total Frames Received/sec. The total number of frames received per second on this network segment.

Table A.16 The NWLink IPX Performance Monitor object counters.
NWLink IPX—The NWLink IPX transport handles datagram transmission to and from computers using the IPX protocol.
 
Object Counters Description
Bytes Total/sec. The sum of Frame Bytes/sec. and Datagram Bytes/sec. This is the total rate of bytes sent to or received from the network by the protocol, but only counts the bytes in frames (packets) that carry data.
Connection Session Timeouts The number of connections dropped due to a session timeout. This number is an accumulator and shows a running total.
Connections Canceled The number of canceled connections. This number is an accumulator and shows a running total.
Connections No Retries The total count of connections that were successfully made on the first try. This number is an accumulator and shows a running total.
Connections Open The number of connections currently open for this protocol. This counter shows the current count only and does not accumulate over time.
Connections With Retries The total count of connections that were made after retrying the attempt. A retry occurs when the first connection attempt failed. This number is an accumulator and shows a running total.
Datagram Bytes Received/sec. The rate in which datagram bytes are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagram Bytes/sec. The rate in which datagram bytes are processed by the computer. This counter is the sum of datagram bytes that are sent as well as received per second. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagram Bytes Sent/sec. The rate in which datagram bytes are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams Received/sec. The rate in which datagrams are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams/sec. The rate in which datagrams are processed by the computer. This counter displays the sum of datagrams sent and datagrams received per second. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams Sent/sec. The rate in which datagrams are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Disconnects Local The number of session disconnections initiated by the local computer. This number is an accumulator and shows a running total.
Disconnects Remote The number of session disconnections initiated by the remote computer. This number is an accumulator and shows a running total.
Expirations Ack The count of T2 timer expirations.
Expirations Response The count of T1 timer expirations.
Failures Adapter The number of connections dropped due to an adapter failure. This number is an accumulator and shows a running total.
Failures Link The number of connections dropped due to a link failure. This number is an accumulator and shows a running total.
Failures No Listen The number of connections rejected because the remote computer was not listening for connection requests.
Failures Not Found The number of connection attempts that failed because the remote computer could not be found. This number is an accumulator and shows a running total.
Failures Resource Local The number of connections that failed because of resource problems or shortages on the local computer. This number is an accumulator and shows a running total.
Failures Resource Remote The number of connections that failed because of resource problems or shortages on the remote computer. This number is an accumulator and shows a running total.
Frame Bytes Re-Sent/sec. The rate in which data bytes are re-sent by the computer. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes Received/sec. The rate in which data bytes are received by the computer. This counter only counts the frames (packets) that carry data.
Frame Bytes Rejected/sec. The rate in which data bytes are rejected. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes/sec. The rate in which data bytes are processed by the computer. This counter is the sum of data frame bytes sent and received per second. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes Sent/sec. The rate in which data bytes are sent by the computer. This counter only counts the bytes in frames (packets) that carry data.
Frames Re-Sent/sec. The rate in which data frames (packets) are re-sent by the computer. This counter only counts the frames (packets) that carry data.
Frames Received/sec. The rate in which data frames are received by the computer. This counter only counts the frames (packets) that carry data.
Frames Rejected/sec. The rate in which data frames are rejected. This counter only counts the frames (packets) that carry data.
Frames/sec. The rate in which data frames (packets) are processed by the computer. This counter is the sum of data frames sent and data frames received per second. This counter only counts those frames (packets) that carry data.
Frames Sent/sec. The rate in which data frames are sent by the computer. This counter only counts the frames (packets) that carry data.
Packets Received/sec. The rate that packets are received by the computer. This counter counts all packets processed by the computer—control as well as data packets.
Packets/sec. The rate that packets are processed by the computer. This count is the sum of packets sent and packets received per second. This counter includes all packets processed by the computer—control as well as data packets.
Packets Sent/sec. The rate that packets are sent by the computer. This counter counts all packets sent by the computer—control as well as data packets.
Piggyback Ack Queued/sec. The rate in which piggybacked acknowledgments are queued. Piggyback acknowledgments are acknowledgments to received packets that are to be included in the next outgoing packet to the remote computer.
Piggyback Ack Timeouts The number of times a piggyback acknowledgment could not be sent because there was no outgoing packet to the remote computer on which to piggyback. A piggyback ack is an acknowledgment to a received packet that is sent along in an outgoing data packet to the remote computer. If no outgoing packet is sent within the timeout period, then an ack packet is sent, and this counter is incremented.
Window Send Average The running average number of data bytes that were sent before waiting for an acknowledgment from the remote computer.
Window Send Maximum The maximum number of bytes of data that will be sent before waiting for an acknowledgment from the remote computer.

Table A.17 The NWLink NetBIOS Performance Monitor object counters.
NWLink NetBIOS—The NWLink NetBIOS protocol layer handles the interface to applications communicating over the IPX transport.
 
Object Counters Description
Bytes Total/sec. The sum of Frame Bytes/sec. and Datagram Bytes/sec. This is the total rate of bytes sent to or received from the network by the protocol, but only counts the bytes in frames (packets) that carry data.
Connection Session Timeouts The number of connections dropped due to a session timeout. This number is an accumulator and shows a running total.
Connections Canceled The number of canceled connections. This number is an accumulator and shows a running total.
Connections No Retries The total count of connections that were successfully made on the first try. This number is an accumulator and shows a running total.
Connections Open The number of connections currently open for this protocol. This counter shows the current count only and does not accumulate over time.
Connections With Retries The total count of connections that were made after retrying the attempt. A retry occurs when the first connection ttempt failed. This number is an accumulator and shows a running total.
Datagram Bytes Received/sec. The rate in which datagram bytes are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagram Bytes/sec. The rate in which datagram bytes are processed by the computer. This counter is the sum of datagram bytes that are sent as well as received per second. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagram Bytes Sent/sec. The rate in which datagram bytes are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams Received/sec. The rate in which datagrams are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams/sec. The rate in which datagrams are processed by the computer. This counter displays the sum of datagrams sent and datagrams received per second. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams Sent/sec. The rate in which datagrams are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Disconnects Local The number of session disconnections initiated by the local computer. This number is an accumulator and shows a running total.
Disconnects Remote The number of session disconnections initiated by the remote computer. This number is an accumulator and shows a running total.
Expirations Ack The count of T2 timer expirations.
Expirations Response The count of T1 timer expirations.
Failures Adapter The number of connections dropped due to an adapter failure. This number is an accumulator and shows a running total.
Failures Link The number of connections dropped due to a link failure. This number is an accumulator and shows a running total.
Failures No Listen The number of connections rejected because the remote computer was not listening for connection requests.
Failures Not Found The number of connection attempts that failed because the remote computer could not be found. This number is an accumulator and shows a running total.
Failures Resource Local The number of connections that failed because of resource problems or shortages on the local computer. This number is an accumulator and shows a running total.
Failures Resource Remote The number of connections that failed because of resource problems or shortages on the remote computer. This number is an accumulator and shows a running total.
Frame Bytes Re-Sent/sec. The rate in which data bytes are re-sent by the computer. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes Received/sec. The rate in which data bytes are received by the computer. This counter only counts the frames (packets) that carry data.
Frame Bytes Rejected/sec. The rate in which data bytes are rejected. This counter only counts the bytes in data frames (packets) that carry data.
Frame Bytes/sec. The rate in which data bytes are processed by the computer. This counter is the sum of data frame bytes sent and received per second. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes Sent/sec. The rate in which data bytes are sent by the computer. This counter only counts the bytes in frames (packets) that carry data.
Frames Re-Sent/sec. The rate in which data frames (packets) are re-sent by the computer. This counter only counts the frames (packets) that carry data.
Frames Received/sec. The rate in which data frames are received by the computer. This counter only counts the frames (packets) that carry data.
Frames Rejected/sec. The rate in which data frames are rejected by the computer. This counter only counts the frames (packets) that carry data.
Frames/sec. The rate in which data frames (or packets) are processed by the computer. This counter is the sum of data frames sent and data frames received per second. This counter only counts the frames (packets) that carry data.
Frames Sent/sec. The rate in which data frames are sent by the computer. This counter only counts the frames (packets) that carry data.
Packets Received/sec. The rate in which packets are received by the computer. This counter counts all packets processed by the computer—control as well as data packets.
Packets/sec. The rate in which packets are processed by the computer. This count is the sum of packets sent and packets received per second. This counter includes all packets processed by the computer—control as well as data packets.
Packets Sent/sec. The rate in which packets are sent by the computer. This counter counts all packets sent by the computer—control as well as data packets.
Piggyback Ack Queued/sec. The rate in which piggybacked acknowledgments are queued. Piggyback acknowledgments are acknowledgments to received packets that are to be included in the next outgoing packet to the remote computer.
Piggyback Ack Timeouts The number of times a piggyback acknowledgment could not be sent because there was no outgoing packet to the remote computer on which to piggyback. A piggyback ack is an acknowledgment to a received packet that is sent along in an outgoing data packet to the remote computer. If no outgoing packet is sent within the timeout period, then an ack packet is sent, and this counter is incremented.
Window Send Average The running average number of data bytes that were sent before waiting for an acknowledgment from the remote computer.
Window Send Maximum The maximum number of bytes of data that will be sent before waiting for an acknowledgment from the remote computer.

Table A.18 The NWLink SPX Performance Monitor object counters.
NWLink SPX—The NWLink SPX transport handles data transmission and session connections for computers using the SPX protocol.
 
Object Counters Description
Bytes Total/sec. The sum of Frame Bytes/sec. and Datagram Bytes/sec. This is the total rate of bytes sent to or received from the network by the protocol, but it only counts the bytes in frames (packets) that carry data.
Connection Session Timeouts The number of connections dropped due to a session timeout. This number is an accumulator and shows a running total.
Connections Cancelled The number of cancelled connections. This number is an accumulator and shows a running total.
Connections No Retries The total count of connections that were successfully made on the first try. This number is an accumulator and shows a running total.
Connections Open The number of connections currently open for this protocol. This counter shows the current count only and does not accumulate over time.
Connections With Retries The total count of connections that were made after retrying the attempt. A retry occurs when the first connection attempt failed. This number is an accumulator and shows a running total.
Datagram Bytes Received/sec. The rate in which datagram bytes are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagram Bytes/sec. The rate in which datagram bytes are processed by the computer. This counter is the sum of datagram bytes that are sent as well as received per second. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagram Bytes Sent/sec. The rate in which datagram bytes are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams Received/sec. The rate in which datagrams are received by the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams/sec. The rate in which datagrams are processed by the computer. This counter displays the sum of datagrams sent and datagrams received per second. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Datagrams Sent/sec. The rate in which datagrams are sent from the computer. A datagram is a connectionless packet whose delivery to a remote computer is not guaranteed.
Disconnects Local The number of session disconnections initiated by the local computer. This number is an accumulator and shows a running total.
Disconnects Remote The number of session disconnections initiated by the remote computer. This number is an accumulator and shows a running total.
Expirations Ack The count of T2 timer expirations.
Expirations Response The count of T1 timer expirations.
Failures Adapter The number of connections dropped due to an adapter failure. This number is an accumulator and shows a running total.
Failures Link The number of connections dropped due to a link failure. This number is an accumulator and shows a running total.
Failures No Listen The number of connections rejected because the remote computer was not listening for connection requests.
Failures Not Found The number of connection attempts that failed because the remote computer could not be found. This number is an accumulator and shows a running total.
Failures Resource Local The number of connections that failed because of resource problems or shortages on the local computer. This number is an accumulator and shows a running total.
Failures Resource Remote The number of connections that failed because of resource problems or shortages on the remote computer. This number is an accumulator and shows a running total.
Frame Bytes Re-Sent/sec. The rate in which data bytes are re-sent by the computer. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes Received/sec. The rate in which data bytes are received by the computer. This counter only counts the frames (packets) that carry data.
Frame Bytes Rejected/sec. The rate in which data bytes are rejected. This counter only counts the bytes in data frames (packets) that carry data.
Frame Bytes/sec. The rate in which data bytes are processed by the computer. This counter is the sum of data frame bytes sent and received per second. This counter only counts the bytes in frames (packets) that carry data.
Frame Bytes Sent/sec. The rate in which data bytes are sent by the computer. This counter only counts the bytes in frames (packets) that carry data.
Frames Re-Sent/sec. The rate in which data frames (packets) are re-sent by the computer. This counter only counts the frames (packets) that carry data.
Frames Received/sec. The rate in which data frames are received by the computer. This counter only counts the frames (packets) that carry data.
Frames Rejected/sec. The rate in which data frames are rejected by the computer. This counter only counts the frames (packets) that carry data.
Frames/sec. The rate in which data frames (packets) are processed by the computer. This counter is the sum of data frames sent and data frames received per second. This counter only counts the frames (packets) that carry data.
Frames Sent/sec. The rate in which data frames are sent by the computer. This counter only counts the frames (packets) that carry data.
Packets Received/sec. The rate in which packets are received by the computer. This counter counts all packets processed by the computer—control as well as data packets.
Packets/sec. The rate in which packets are processed by the computer. This count is the sum of packets sent and packets received per second. This counter includes all packets processed by the computer—control as well as data packets.
Packets Sent/sec. The rate in which packets are sent by the computer. This counter counts all packets sent by the computer—control as well as data packets.
Piggyback Ack Queued/sec. The rate in which piggybacked acknowledgments are queued. Piggyback acknowledgments are acknowledgments to received packets that are to be included in the next outgoing packet to the remote computer.
Piggyback Ack Timeouts The number of times a piggyback acknowledgment could not be sent because there was no outgoing packet to the remote computer on which to piggyback. A piggyback ack is an acknowledgment to a received packet that is sent along in an outgoing data packet to the remote computer. If no outgoing packet is sent within the timeout period, then an ack packet is sent, and this counter is incremented.
Window Send Average The running average number of data bytes that were sent before waiting for an acknowledgment from the remote computer.
Window Send Maximum The maximum number of bytes of data that will be sent before waiting for an acknowledgment from the remote computer.

Table A.19 The Objects Performance Monitor object counters.
Objects—The Objects object type is a meta-object that contains information about the objects in existence on the computer. This information can be used to detect the unnecessary consumption of computer resources. Each object requires memory to store basic information about the object.
 
Object Counters Description
Events The number of events in the computer at the time of data collection. Notice that this is an instantaneous count, not an average over time.
Mutexes The number of mutexes in the computer at the time of data collection. This is an instantaneous count, not an average over the time interval. Mutexes are used by threads to assure only one thread is executing some section of code.
Processes The number of processes in the computer at the time of data collection. Notice that this is an instantaneous count, not an average over the time interval. Each process represents the running of a program.
Sections The number of sections in the computer at the time of data collection. Notice that this is an instantaneous count, not an average over the time interval. A section is a portion of virtual memory created by a process for storing data. A process can share sections with other processes.
Semaphores The number of semaphores in the computer at the time of data collection. Notice that this is an instantaneous count, not an average over the time interval. Threads use semaphores to obtain exclusive access to data structures that they share with other threads.
Threads The number of threads in the computer at the time of data collection. Notice that this is an instantaneous count, not an average over the time interval. A thread is the basic executable entity that can execute instructions in a processor.

Table A.20 The Paging File Performance Monitor object counters.
Paging File—Displays information about the system’s Page File(s).
 
Object Counters Description
% Usage The amount of the Page File instance in use in percent. (See also Process: Page File Bytes.)
% Usage Peak The peak usage of the Page File instance in use in percent. (See also Process: Page File Bytes Peak.)

Table A.21 The Physical Disk Performance Monitor object counters.
Physical Disk—A Physical Disk object type is a hard or fixed disk drive. It will contain one or more logical partitions. Disks are used to store file, program, and paging data. The disk is read to retrieve these items, and written to record changes to them.
 
Object Counters Description
% Disk Read Time The percentage of elapsed time that the selected disk drive is busy servicing read requests.
% Disk Time The percentage of elapsed time that the selected disk drive is busy servicing read or write requests.
% Disk Write Time The percentage of elapsed time that the selected disk drive is busy servicing write requests.
Avg. Disk Bytes/Read The average number of bytes transferred from the disk during read operations.
Avg. Disk Bytes/Transfer The average number of bytes transferred to or from the disk during write or read operations.
Avg. Disk Bytes/Write The average number of bytes transferred to the disk during write operations.
Avg. Disk Read/sec. The average time in seconds of a read of data from the disk.
Avg. Disk Transfer/sec. The time in seconds of the average disk transfer.
Avg. Disk Write/sec. The average time in seconds of a write of data to the disk.
Disk Bytes/sec. The rate in which bytes are transferred to or from the disk during write or read operations.
Disk Queue Length The number of requests outstanding on the disk at the time the performance data is collected. It includes requests in service at the time of the snapshot. This is an instantaneous length, not an average over the time interval. Multispindle disk devices can have multiple requests active at one time, but other concurrent requests are awaiting service. This counter can reflect a transitory high or low queue length, but if there is a sustained load on the disk drive, it is likely that this will be consistently high. Requests are experiencing delays proportional to the length of this queue minus the number of spindles on the disks. This difference should average less than two for good performance.
Disk Read Bytes/sec. The rate in which bytes are transferred from the disk during read operations.
Disk Reads/sec. The rate of read operations on the disk.
Disk Transfers/sec. The rate of read and write operations on the disk.
Disk Write Bytes/sec. The rate in which bytes are transferred to the disk during write operations.
Disk Writes/sec. The rate of write operations on the disk.

Table A.22 The Process Performance Monitor object counters.
Process—The Process object type is created when a program is run. All the threads in a process share the same address space and have access to the same data.
 
Object Counters Description
% Privileged Time The percentage of elapsed time that this process’s threads have spent executing code in privileged mode. When a Windows NT system service is called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or they can be implicit, such as when a page fault or an interrupt occurs. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of your application can appear in other subsystem processes in addition to the privileged time in your process.
% Processor Time The percentage of elapsed time that all of the threads of this process used the processor to execute instructions. An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle certain hardware interrupts or trap conditions might be counted for this process.
% User Time The percentage of elapsed time that this process’s threads have spent executing code in use mode. Applications execute in user mode, as do subsystems like the window manager and the graphics engine. Code executing in user mode cannot damage the integrity of the Windows NT Executive, Kernel, and device drivers. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of your application can appear in other subsystem processes in addition to the privileged time in your process.
Elapsed Time The total elapsed time (in seconds) this process has been running.
Handle Count The total number of handles currently open by this process. This number is the sum of the handles currently open by each thread in this process.
ID the unique identifier of this process ID Process numbers are reused, so they only identify a process for the lifetime of that process.
Page Faults/sec. The rate of page faults by the threads executing in this process. A page fault occurs when a thread refers to a virtual memory page that is not in its Working Set in main memory. This will not cause the page to be fetched from disk if it is on the standby list (and hence already in main memory) or if it is in use by another process with which the page is shared.
Page File Bytes The current number of bytes this process has used in the paging file(s). Paging files are used to store pages of memory used by the process that are not contained in other files. Paging files are shared by all processes, and lack of space in paging files can prevent other processes from allocating memory.
Page File Bytes Peak The maximum number of bytes this process has used in the paging file(s). Paging files are used to store pages of memory used by the process that are not contained in other files. Paging files are shared by all processes, and lack of space in paging files can prevent other processes from allocating memory.
Pool Nonpaged Bytes The number of bytes in the Nonpaged Pool, a system memory area where space is acquired by operating-system components as they accomplish their appointed tasks. Nonpaged Pool pages cannot be paged out to the paging file but, instead, remain in main memory as long as they are allocated.
Pool Paged Bytes The number of bytes in the Paged Pool, a system memory area where space is acquired by operating system components as they accomplish their appointed tasks. Paged Pool pages can be paged out to the paging file when not accessed by the system for sustained periods of time.
Priority Base The current base priority of this process. Threads within a process can raise and lower their own base priority relative to the process’s base priority.
Private Bytes The current number of bytes this process has allocated that cannot be shared with other processes.
Thread Count The number of threads currently active in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread.
Virtual Bytes The current size in bytes of the virtual address space the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and by using too much, the process could limit its ability to load libraries.
Virtual Bytes Peak The maximum number of bytes of virtual address space the process has used at any one time. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and by using too much, the process could limit its ability to load libraries.
Working Set The current number of bytes in the Working Set of this process. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed, they will then be soft-faulted back into the Working Set before they leave main memory.
Working Set Peak The maximum number of bytes in the Working Set of this process at any point in time. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process, even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed, they will then be soft-faulted back into the Working Set before they leave main memory.

Table A.23 The Processor Performance Monitor object counters.
Processor—Processor Time is expressed as a percentage of the elapsed time that a processor is busy executing a non-idle thread. It can be viewed as the fraction of the time spent doing useful work. Each processor is assigned an idle thread in the idle process that consumes the unproductive processor cycles not used by any other threads.
 
Object Counters Description
% DPC Time The percentage of elapsed time that the processor spent in Deferred Procedure Calls (DPCs). When a hardware device interrupts the processor, the Interrupt Handler can elect to execute the majority of its work in a DPC. DPCs run at lower priority than interrupts, and so permit interrupts to occur while DPCs are being executed. Deferred Procedure Calls are executed in Privileged Mode, so this is a component of processor: % Privileged Time. This counter can help determine the source of excessive time being spent in Privileged Mode.
% Interrupt Time The percentage of elapsed time that the processor spent handling hardware Interrupts. When a hardware device interrupts the processor, the Interrupt Handler will execute to handle the condition, usually by signaling I/O completion and possibly issuing another pending I/O request. Some of this work can be done in a Deferred Procedure Call (see Processor: % DPC Time). However, time spent in DPCs is not counted as time in Interrupts. Interrupts are executed in Privileged Mode, so this is a component of Processor: % Privileged Time. This counter can help determine the source of excessive time being spent in Privileged Mode.
% Privileged Time The percentage of processor time spent in Privileged Mode in non-idle threads. The Windows NT service layer, the Executive routines, and the Windows NT Kernel execute in Privileged Mode. Device drivers for most devices other than graphics adapters and printers also execute in Privileged Mode. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of your application could appear in other subsystem processes in addition to the Privileged Time in your process.
% Processor Time A percentage of the elapsed time that a processor is busy executing a non-idle thread. It can be viewed as the fraction of the time spent doing useful work. Each processor is assigned an idle thread in the idle process that consumes the unproductive processor cycles not used by any other threads.
% User Time The percentage of processor time spent in User Mode in non-idle threads. All application code and subsystem code execute in User Mode. The graphics engine, graphics device drivers, printer device drivers, and the window manager also execute in User Mode. Code executing in User Mode cannot damage the integrity of the Windows NT Executive, Kernel, and device drivers. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of your application could appear in other subsystem processes in addition to the Privileged Time in your process.
APC Bypasses/sec. The rate kernel APC interrupts were short-circuited.
DPC Bypasses/sec. The rate Dispatch interrupts were short-circuited.
DPC Rate The average rate DPC objects are queued to this processor’s DPC queue per clock tick.
DPCs Queued/sec. The rate DPC objects are queued to this processor’s DPC queue.
Interrupts/sec. The number of device interrupts the processor is experiencing. A device interrupts the processor when it has completed a task or when it otherwise requires attention. Normal thread execution is suspended during interrupts. An interrupt might cause the processor to switch to another, higher-priority thread. Clock interrupts are frequent and periodic, and create a background of interrupt activity.

Table A.24 The RAS Port Performance Monitor object counters.
RAS Port—The RAS object type handles individual ports of the RAS device on your system.
 
Object Counters Description
Alignment Errors The total number of Alignment Errors for this connection. Alignment Errors occur when a byte received is different from the byte expected.
Buffer Overrun Errors The total number of Buffer Overrun Errors for this connection. Buffer Overrun Errors occur when the software cannot handle the rate in which data is received.
Bytes Received The total number of bytes received for this connection.
Bytes Received/sec. The number of bytes received per second.
Bytes Transmitted The total number of bytes transmitted for this connection.
Bytes Transmitted/sec. The number of bytes transmitted per second.
CRC Errors The total number of CRC Errors for this connection. CRC Errors occur when the frame received contains erroneous data.
Frames Received The total number of data frames received for this connection.
Frames Received/sec. The number of frames received per second.
Frames Transmitted The total number of data frames transmitted for this connection.
Frames Transmitted/sec. The number of frames transmitted per second.
Percent Compression In The compression ratio for bytes being received.
Percent Compression Out The compression ratio for bytes being transmitted.
Serial Overrun Errors The total number of Serial Overrun Errors for this connection. Serial Overrun Errors occur when the hardware cannot handle the rate in which data is received.
Timeout Errors The total number of Timeout Errors for this connection. Timeout Errors occur when an expected acknowledgment is not received in time.
Total Errors The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors for this connection.
Total Errors/sec. The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors per second.

Table A.25 The RAS Total Performance Monitor object counters.
RAS Total—The RAS object type handles all combined ports of the RAS device on your system.
 
Object Counters Description
Alignment Errors The total number of Alignment Errors for this connection. Alignment Errors occur when a byte received is different from the byte expected.
Buffer Overrun Errors The total number of Buffer Overrun Errors for this connection. Buffer Overrun Errors occur when the software cannot handle the rate in which data is received.
Bytes Received The total number of bytes received for this connection.
Bytes Received/sec. The number of bytes received per second.
Bytes Transmitted The total number of bytes transmitted for this connection.
Bytes Transmitted/sec. The number of bytes transmitted per second.
CRC Errors The total number of CRC Errors for this connection. CRC Errors occur when the frame received contains erroneous data.
Frames Received The total number of data frames received for this connection.
Frames Received/sec. The number of frames received per second.
Frames Transmitted The total number of data frames transmitted for this connection.
Frames Transmitted/sec. The number of frames transmitted per second.
Percent Compression In The compression ratio for bytes being received.
Percent Compression Out The compression ratio for bytes being transmitted.
Serial Overrun Errors The total number of Serial Overrun Errors for this connection. Serial Overrun Errors occur when the hardware cannot handle the rate in which data is received.
Timeout Errors The total number of Timeout Errors for this connection. Timeout Errors occur when an expected acknowledgment is not received in time.
Total Errors The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors for this connection.
Total Errors/sec. The total number of CRC, Timeout, Serial Overrun, Alignment, and Buffer Overrun Errors per second.

Table A.26 The Redirector Performance Monitor object counters.
Redirector—The Redirector is the object that manages network connections to other computers that originate from your own computer.
 
Object Counters Description
Bytes Received/sec. The rate of bytes coming in to the Redirector from the network. It includes all application data as well as network protocol information, such as packet headers.
Bytes Total/sec. The rate in which the Redirector is processing data bytes. This includes all application and file data in addition to protocol information, such as packet headers.
Bytes Transmitted/sec. The rate in which bytes are leaving the Redirector to the network. It includes all application data as well as network protocol information, such as packet headers.
Connects Core The number of connections you have to servers running the original MS-Net SMB protocol, including MS-Net itself, Xenix, and Vax’s.
Connects Lan Manager 2.0 The number of connections to Lan Manager 2.0 servers, including LMX servers.
Connects Lan Manager 2.1 The number of connections to Lan Manager 2.1 servers, including LMX servers.
Connects Windows NT The number of connections to Windows NT computers. Good choice!
Current Commands The number of requests to the Redirector that are currently queued for service. If this number is much larger than the number of network adapter cards installed in the computer, then the network(s) and/or the server(s) being accessed are seriously bottlenecked.
File Data Operations/sec. The rate in which the Redirector is processing data operations. Hopefully, one operation includes many bytes. We say hopefully here because each operation has overhead. You can determine the efficiency of this path by dividing the Bytes/sec. by this counter to determine the average number of bytes transferred/operation.
File Read Operations/sec. The rate in which applications are asking the Redirector for data. Each call to a file system or similar Application Program Interface (API) call counts as one operation.
File Write Operations/sec. The rate in which applications are sending data to the Redirector. Each call to a file system or similar Application Program Interface (API) call counts as one operation.
Network Errors/sec. The number of serious unexpected errors that generally indicate the Redirector and one or more servers are having serious communication difficulties. For example, an SMB (Server Message Blocks) protocol error will generate a Network Error. These result in an entry in the system Event Log, so look there for details.
Packets Received/sec. The rate in which the Redirector is receiving packets (also called SMBs or Server Message Blocks). Network transmissions are divided into packets. The average number of bytes received in a packet can be obtained by dividing Bytes Received/sec. by this counter. Some packets received might not contain incoming data. For example, an acknowledgment to a write made by the Redirector would count as an incoming packet.
Packets/sec. The rate in which the Redirector is processing data packets. Hopefully, one packet includes many bytes. We say hopefully here because each packet has protocol overhead. You can determine the efficiency of this path by dividing the Bytes/sec. by this counter to determine the average number of bytes transferred/packet. You can also divide this counter by Operations/sec. to determine the average number of packets per operation, another measure of efficiency.
Packets Transmitted/sec. The rate in which the Redirector is sending packets (also called SMBs or Server Message Blocks). Network transmissions are divided into packets. The average number of bytes transmitted in a packet can be obtained by dividing Bytes Transmitted/sec. by this counter.
Read Bytes Cache/sec. The rate in which applications on your computer are accessing the Cache using the Redirector. Some of these data requests might be satisfied by merely retrieving the data from the system Cache on your own computer if it happened to be used recently and there was room to keep it in the cache. Requests that miss the cache will cause a page fault (see Redirector: Read Bytes Paging/sec.).
Read Bytes Network/sec. The rate in which applications are reading data across the network. For one reason or another the data was not in the system cache, and these bytes actually came across the network. Dividing this number by Bytes Received/sec. will indicate the “efficiency” of data coming in from the network, because all of these bytes are real application data (see Redirector: Bytes Received/sec.).
Read Bytes NonPaging/sec. The bytes read by the Redirector in response to normal file requests by an application when they are redirected to come from another computer. In addition to file requests, this counter includes other methods of reading across the network, such as Named Pipes and Transactions. This counter does not count network protocol information, just application data.
Read Bytes Paging/sec. The rate the Redirector is attempting to read bytes in response to page faults. Page faults are caused by loading modules (such as programs and libraries), by a miss in the cache (see Redirector: Read Bytes Cache/sec.), or by files directly mapped into the address space of applications (a high-performance feature of Windows NT).
Read Operations Random/sec. The rate, on a file-by-file basis, reads are made that are not sequential. If a read is made using a particular file handle, and then is followed by another read that is not immediately the contiguous next byte, this counter is incremented by one.
Read Packets Small/sec. The rate that reads less than one-fourth of the server’s negotiated buffer size are made by applications. Too many of these could indicate a waste of buffers on the server. This counter is incremented once for each read. It does not count packets.
Read Packets/sec. The rate that read packets are being placed on the network. Each time a single packet is sent with a request to read data remotely, this counter is incremented by one.
Reads Denied/sec. The rate the server is unable to accommodate requests for Raw Reads. When a read is much larger than the server’s negotiated buffer size, the Redirector requests a Raw Read, which, if granted, would permit the transfer of the data without lots of protocol overhead on each packet. To accomplish this, the server must lock out other requests, so the request is denied if the server is really busy.
Reads Large/sec. The rate that reads over two times the server’s negotiated buffer size are made by applications. Too many of these could place a strain on server resources. This counter is incremented once for each read. It does not count packets.
Server Disconnects The number of times a server has disconnected your Redirector. (See also Redirector: Server Reconnects.)
Server Reconnects The number of times your Redirector has had to reconnect to a server in order to complete a new active request. You can be disconnected by the server if you remain inactive for too long. Even locally, if all your remote files are closed, the Redirector will keep your connections intact for (nominally) 10 minutes. Such inactive connections are called dormant connections. Reconnecting is expensive in time.
Server Sessions The number of active security objects the Redirector is managing. For example, a Logon to a server followed by a network access to the same server will establish one connection, but two sessions.
Server Sessions Hung The number of active sessions that are timed out and unable to proceed due to a lack of response from the remote server.
Write Bytes Cache/sec. The rate in which applications on your computer are writing to the cache using the Redirector. The data might not leave your computer immediately but could be retained in the cache for further modification before being written to the network. This saves network traffic. Each write of a byte into the cache is counted here.
Write Bytes Network/sec. The rate in which your applications are writing data across the network. Either the system cache was bypassed, as for Named Pipes or Transactions, or the cache wrote the bytes to make room for other data. Dividing this counter by Bytes Transmitted/sec. will indicate the “efficiency” of data written to the network, because all of these bytes are real application data (see Redirector: Bytes Transmitted/sec.).
Write Bytes NonPaging/sec. The rate of the bytes that are written by the Redirector in response to normal file outputs by an application when they are redirected to go to another computer. In addition to file requests, this counter includes other methods of writing across the network, such as Named Pipes and Transactions. This counter does not count network protocol information, just application data.
Write Bytes Paging/sec. The rate in which the Redirector is attempting to write bytes changed in the pages being used by applications. The program data changed by modules (such as programs and libraries) that were loaded over the network are paged out when no longer needed. Other output pages come from the cache (see Redirector: Write Bytes Cache/sec.).
Write Operations Random/sec. The rate, on a file-by-file basis, writes are made that are not sequential. If a write is made using a particular file handle, and then followed by another write that is not immediately the next contiguous byte, this counter is incremented by one.
Write Packets/sec. The rate that writes are being sent to the network. Each time a single packet is sent with a request to write remote data, this counter is incremented by one.
Write Packets Small/sec. The rate that writes are made by applications that are less than one-fourth of the server’s negotiated buffer size. Too many of these could indicate a waste of buffers on the server. This counter is incremented once for each write—it counts writes, not packets.
Writes Denied/sec. The rate that the server is unable to accommodate requests for Raw Writes. When a write is much larger than the server’s negotiated buffer size, the Redirector requests a Raw Write, which, if granted, would permit the transfer of the data without lots of protocol overhead on each packet. To accomplish this, the server must lock out other requests, so the request is denied if the server is really busy.
Writes Large/sec. The rate that writes are made by applications that are over two times the server’s negotiated buffer size. Too many of these could place a strain on server resources. This counter is incremented once for each write—it counts writes, not packets.

Table A.27 The Server Performance Monitor object counters.
Server—Server is the process that interfaces the services from the local computer to the network services.
 
Object Counters Description
Blocking Requests Rejected The number of times the server has rejected blocking SMBs due to an insufficient count of free work items. Indicates whether the maxworkitems or minfreeworkitems server parameters need tuning.
Bytes Received/sec. The number of bytes the server has received from the network. Indicates how busy the server is.
Bytes Total/sec. The number of bytes the server has sent to and received from the network. This value provides an overall indication of how busy the server is.
Bytes Transmitted/sec. The number of bytes the server has sent on the network. Indicates how busy the server is.
Context Blocks Queued/sec. The rate in which work context blocks had to be placed on the server’s FSP queue to await server action.
Errors Access Permissions The number of times that opens on behalf of clients have failed with STATUS_ACCESS_DENIED. Can indicate whether somebody is randomly attempting to access files in hopes of getting at something that was not properly protected.
Errors Granted Access The number of times accesses to files opened successfully were denied. Can indicate attempts to access files without proper access authorization.
Errors Logon The number of failed logon attempts to the server. Can indicate whether password-guessing programs are being used to crack the security on the server.
Errors System The number of times an internal Server Error was detected. Unexpected errors usually indicate a problem with the server.
File Directory Searches The number of searches for files currently active in the server. Indicates current server activity.
Files Open The number of files currently opened in the server. Indicates current server activity.
Files Opened Total The number of successful open attempts performed by the server of behalf of clients. Useful in determining the amount of file I/O, overhead for path-based operations, and the effectiveness of oplocks.
Logon/sec. The rate of all interactive logons, network logons, service logons, successful logons, and failed logons.
Logon Total The number of interactive logons, network logons, service logons, successful logons, and failed logons since the machine was last rebooted.
Pool Nonpaged Bytes The number of bytes of nonpageable computer memory the server is currently using. Can help in determining good values for the maxnonpagedmemoryusage parameter.
Pool Nonpaged Failures The number of times allocations from Nonpaged Pool have failed. Indicates that the computer’s physical memory is too small.
Pool Nonpaged Peak The maximum number of bytes of Nonpaged Pool the server has had in use at any one point. Indicates how much physical memory the computer should have.
Pool Paged Bytes The maximum number of bytes of Paged Pool the server has had allocated. Indicates the proper sizes of the Page File(s) and physical memory.
Pool Paged Failures The number of times allocations from Paged Pool have failed. Indicates that the computer’s physical memory of pagefile is too small.
Pool Paged Peak The number of bytes of pageable computer memory the server is currently using. Can help in determining good values for the maxpagedmemoryusage parameter.
Server Sessions The number of sessions currently active in the server. Indicates current server activity.
Sessions Errored Out The number of sessions that have been closed due to unexpected error conditions. Indicates how frequently network problems are causing dropped sessions on the server.
Sessions Forced Off The number of sessions that have been forced to logoff. Can indicate how many sessions were forced to logoff due to logon time constraints.
Sessions Logged Off The number of sessions that have terminated normally. Useful in interpreting the Sessions Times Out and Sessions Errored Out statistics[md]allows percentage calculations.
Sessions Timed Out The number of sessions that have been closed due to their idle time exceeding the autodisconnect parameter for the server. Shows whether the autodisconnect setting is helping to conserve resources.
Work Item Shortages The number of times STATUS_DATA_NOT_ACCEPTED was returned at receive indication time. This occurs when no work item is available or can be allocated to service the incoming request. Indicates whether the initworkitems or maxworkitems parameters need tuning.

Table A.28 The Server Work Queues Performance Monitor object counters.
Server Work Queues—Server Work Queues explain text.
 
Object Counters Description
Active Threads The number of threads currently working on a request from the server client for this CPU. The system keeps this number as low as possible to minimize unnecessary context switching. This is an instantaneous count for the CPU, not an average over time.
Available Threads The number of server threads on this CPU not currently working on requests from a client. The server dynamically adjusts the number of threads to maximize server performance.
Available Work Items Every request from a client is represented in the server as a work item, and the server maintains a pool of available work items per CPU to speed processing. This is the instantaneous number of available work items for this CPU. A sustained near-zero value indicates the need to increase the MinFreeWorkItems registry value for the Server service. This value will always be zero in the Blocking Queue instance.
Borrowed Work Items Every request from a client is represented in the server as a work item, and the server maintains a pool of available work items per CPU to speed processing. When a CPU runs out of work items, it borrows a free work item from another CPU. An increasing value of this running counter could indicate the need to increase the MaxWorkItems or MinFreeWorkItems registry values for the Server service. This value will always be zero in the Blocking Queue instance.
Bytes Received/sec. The rate at which the server is receiving bytes from the network clients on this CPU. This value is a measure of how busy the server is.
Bytes Sent/sec. The rate in which the server is sending bytes to the network clients on this CPU. This value is a measure of how busy the server is.
Bytes Transferred/sec. The rate in which the server is sending and receiving bytes with the network clients on this CPU. This value is a measure of how busy the server is.
Context Blocks Queued/sec. Context Blocks Queued per second is the rate work context blocks had to be placed on the server’s FSP queue to await server action.
Current Clients The instantaneous count of the clients being serviced by this CPU. The server actively balances the client load across all of the CPUs in the system. This value will always be zero in the Blocking Queue instance.
Queue Length The current length of the server work queue for this CPU. A sustained queue length greater than four could indicate processor congestion. This is an instantaneous count, not an average over time.
Read Bytes/sec. The rate the server is reading data from files for the clients on this CPU. This value is a measure of how busy the server is.
Read Operations/sec. The rate the server is performing file read operations for the clients on this CPU. This value is a measure of how busy the server is. This value will always be zero in the Blocking Queue instance.
Total Bytes/sec. The rate the server is reading and writing data to and from the files for the clients on this CPU. This value is a measure of how busy the server is.
Total Operations/sec. The rate the server is performing file read and file write operations for the clients on this CPU. This value is a measure of how busy the server is. This value will always be zero in the Blocking Queue instance.
Work Item Shortages Every request from a client is represented in the server as a work item, and the server maintains a pool of available work items per CPU to speed processing. A sustained value greater than zero indicates the need to increase the MaxWorkItems registry value for the Server service. This value will always be zero in the Blocking Queue instance.
Write Bytes/sec. The rate the server is writing data to files for the clients on this CPU. This value is a measure of how busy the server is.
Write Operations/sec. The rate the server is performing file write operations for the clients on this CPU. This value is a measure of how busy the server is. This value will always be zero in the Blocking Queue instance.

Table A.29 The SNA Adapter SnaDlc1 Performance Monitor object counters.
SNA Adapter SnaDlc1—SNA Adapter SnaDlc1
 
Object Counters Description
Adapter Failures The number of times since startup that a network adapter has encountered an error condition.
Connection Failures The number of times since startup that a connection has encountered an error condition.
Data Bytes Received/sec. The number of data bytes received per second.
Data Bytes Transmitted/sec. The number of data bytes transmitted per second.
Frames Received/sec. The number of data frames received per second. A frame is an information structure recognized by one of the various protocols related to SNA. Frames contain multiple bytes of data.
Frames Transmitted/sec. The number of data frames transmitted per second. A frame is an information structure recognized by one of the various protocols related to SNA. Frames contain multiple bytes of data.
Successful Connects The number of times since startup that a successful connection has been made.
Throughput Bytes/sec. The total number of bytes flowing through the SNA server per second. This includes both incoming and outgoing bytes, and is a good indicator of how heavily your SNA server is loaded.
Throughput Frames/sec. The total number of data frames flowing through the SNA server per second. This includes both incoming and outgoing frames, and is a good indicator of how heavily your SNA server is loaded.

Table A.30 The SNA Logical Unit Sessions Performance Monitor object counters.
SNA Logical Unit Sessions—SNA Logical Unit Sessions
 
Object Counters Description
Data Bytes Received/sec. The number of data bytes received per second.
Data Bytes Transmitted/sec. The number of data bytes transmitted per second.
Throughput Bytes/sec. The total number of bytes flowing through the SNA server per second. This includes both incoming and outgoing bytes, and is a good indicator of how heavily your SNA server is loaded.

Table A.31 The SQL Server Performance Monitor object counters.
SQL Server—SQL Server
 
Object Counters Description
Cache—Avg. Free Page Scan The average number of cache buffers scanned by the Lazy Writer each time it searches for unused buffers to replenish the free pool.
Cache Hit Ratio The percentage of time that a requested data page was found in the data cache (instead of being read from disk).
Cache—Max. Free Page Scan The maximum number of data cache buffers scanned by the Lazy Writer while searching for unused buffers to replenish the free pool.
Cache—Number Of Free Buffers The number of data cache buffers currently in the free pool.
I/O—Batch Average Size The average number of 2K pages written to disk during a Batch I/O operation. The checkpoint thread is the primary user of Batch I/O.
I/O—Batch Max Size The maximum number of 2K pages written to disk during a Batch I/O operation. The checkpoint thread is the primary user of Batch I/O.
I/O—Batch Writes/sec. The number of 2K pages written to disk per second using Batch I/O. The checkpoint thread is the primary user of Batch I/O.
I/O—Lazy Writes/sec. The number of 2K pages flushed to disk per second by the Lazy Writer.
I/O—Log Writes/sec. The number of log pages physically written to disk per second.
I/O—Outstanding The number of physical writes pending.
I/O—Outstanding Reads The number of physical reads pending.
I/O—Page Reads/sec. The number of physical page reads per second.
I/O—Single Page Writes/sec. The number of single page writes performed per second (does not include log writes, cache flushes (Lazy Writer), or batch writes).
I/O—Trans./ Log Record The number of transactions packed into a log record before the log record was written to disk.
I/O—Transactions/sec. The number of Transact-SQL command batches executed per second.
NET—Command Queue Length The number of client requests that are waiting to be handled by the SQL Server working threads.
NET—Network Reads/sec. The number of tabular data stream (TDS) packets read from the network.
NET—Network Writes/sec. The number of tabular data stream (TDS) packets written to the network.
User Connections The number of open user connections.

Table A.32 The SQL Server Locks Performance Monitor object counters.
SQL Server Locks—SQL Server-Locks
 
Object Counters Description
Extent Locks—Exclusive A count of exclusive extent locks.
Extent Locks—Shared A count of shared extent locks.
Extent Locks—Total A count of all extent locks.
Intent Locks—Exclusive A count of exclusive intent locks.
Intent Locks—Shared A count of shared intent locks.
Intent Locks—Total A count of all intent locks.
Page Locks Exclusive A count of exclusive page locks.
Page Locks—Shared A count of shared page locks.
Page Locks—Total A count of all page locks.
Page Locks—Update A count of update page locks.
Table Locks—Exclusive A count of exclusive table locks.
Table Locks—Shared A count of shared table locks.
Table Locks—Total A count of all table locks.
Total Blocking Locks A count of all locks blocking other processes.
Total Demand Locks A count of all demand locks.
Total Exclusive Locks A count of all exclusive locks.
Total Locks A count of all locks being used by SQL Server.
Total Shared Locks A count of all shared locks.

Table A.33 The SQL Server Log Performance Monitor object counters.
SQL Server Log—SQL Server Log
 
Object Counters Description
Log Size (MB) The amount of space allocated to the transaction log.
Log Space Used (%) The percentage of the transaction log that is used.

Table A.34 The SQL Server Users Performance Monitor object counters.
SQL Server Users—SQL Server Users
 
Object Counters Description
CPU Time The cumulative CPU time for a user connection (and checkpoint process).
Locks Held The number of locks held by a user connection.
Memory (2K Pages) The amount of memory (in 2K pages) allocated to a user connection.
Physical I/O The number of disk reads and writes for the current statement.

Table A.35 The System Performance Monitor object counters.
System—The System object type includes those counters that apply to all processors on the computer collectively. These counters represent the activity of all processors in the computer.
 
Object Counters Description
% Total DPC Time The sum of % DPC Time of all processors divided by the number of processors in the system. (See Processor: % DPC Time for details.)
% Total Interrupt Time The sum of % Interrupt Time of all processors divided by the number of processors in the system. (See Processor: % Interrupt Time for details.)
% Total Privileged Time The average percentage of time spent in privileged mode by all processors. On a multiprocessor system, if all processors are always in privileged mode, this is 100 percent, and if 1/4th of the processors are in privileged mode, this is 25 percent. When a Windows NT system service is called, the service will often run in privileged mode in order to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit, or they can be implicit, such as when a page fault or an Interrupt occurs. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of an application could appear in other subsystem processes in addition to the Privileged Time in the application process.
% Total Processor Time The average percentage of time that all the processors on the system are busy executing non-idle threads. On a multiprocessor system, if all processors are always busy, this is 100 percent, if all processors are 50 percent busy, this is 50 percent, and if 1/4th of the processors are busy, this is 25 percent. It can be viewed as the fraction of the time spent doing useful work. Each processor is assigned an idle thread in the idle process, which consumes those unproductive processor cycles not used by any other threads.
% Total User Time The average percentage of time spent in User mode by all processors. On a multiprocessor system, if all processors are always in User mode, this is 100 percent, if all processors are 50 percent in User mode, this is 50 percent, and if 1/4th of the processors are in User mode, this is 25 percent. Applications execute in User Mode, as do subsystems, like the window manager and the graphics engine. Code executing in User Mode cannot damage the integrity of the Windows NT Executive, Kernel, and device drivers. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of an application could appear in other subsystem processes in addition to the Privileged Time in the application process.
Alignment Fixups/sec. The rate of alignment faults fixed by the system.
Context Switches/sec. The rate of switches from one thread to another. Thread switches can occur either inside a single process or across processes. A thread switch can be caused either by one thread asking another for information, or by a thread being preempted by another, higher-priority thread becoming ready to run. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of an application could appear in other subsystem processes in addition to the Privileged Time in the application. Switching to the subsystem process causes one Context Switch in the application thread. Switching back causes another Context Switch in the subsystem thread.
Exception Dispatches/sec. The rate of exceptions dispatched by the system.
File Control Bytes/sec. An aggregate of bytes transferred for all file-system operations that are neither reads nor writes. These operations usually include file-system control requests or requests for information about device characteristics or status.
File Control Operations/sec. An aggregate of all file-system operations that are neither reads nor writes. These operations usually include file-system control requests or requests for information about device characteristics or status.
File Data Operations/sec. The rate in which the computer is issuing read and write operations to file system devices. It does not include File Control Operations.
File Read Bytes/sec. An aggregate of the bytes transferred for all the file-system read operations on the computer.
File Read Operations/sec. An aggregate of all the file-system read operations on the computer.
File Write Bytes/sec. Aggregate of the bytes transferred for all the file-system write operations on the computer.
File Write Operations/sec. An aggregate of all the file-system write operations on the computer.
Floating Emulations/sec. The rate of floating emulations performed by the system.
Processor Queue Length The instantaneous length of the processor queue in units of threads. This counter is always zero, unless you are also monitoring a thread counter. All processors use a single queue in which threads wait for processor cycles. This length does not include the threads that are currently executing. A sustained processor queue length greater than two generally indicates processor congestion. This is an instantaneous count, not an average over the time interval.
System Calls The frequency of calls to Windows NT system service routines. These routines perform all of the basic scheduling and synchronization of activities on the computer, and provide access to non-graphical devices, memory management, and name-space management.
System Up Time Total time (in seconds) that the computer has been operational since it was last started.
Total Interrupts/sec. The rate the computer is receiving and servicing hardware interrupts. Some devices that can generate interrupts are the system timer, the mouse, data communication lines, network interface cards, and other peripheral devices. This counter provides an indication of how busy these devices are on a computer-wide basis. (See also Processor: Interrupts/sec.)

Table A.36 The TCP Performance Monitor object counters.
TCP—The TCP object type includes the counters that describe the rates that TCP segments are received and sent by a certain entity using the TCP protocol. In addition, it describes the number of TCP connections that are in each of the possible TCP connection states.
 
Object Counters Description
Connection Failures The number of times TCP connections have made a direct transition to the CLOSED state from the SYN-SENT state or the SYN-RCVD state, plus the number of times TCP connections have made a direct transition to the LISTEN state from the SYN-RCVD state.
Connections Active The number of times TCP connections have made a direct transition to the SYN-SENT state from the CLOSED state.
Connections Established The number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT.
Connections Passive The number of times TCP connections have made a direct transition to the SYN-RCVD state from the LISTEN state.
Connections Reset The number of times TCP connections have made a direct transition to the CLOSED state from either the ESTABLISHED state or the CLOSE-WAIT state.
Segments Received/sec. The rate segments are received, including those received in error. This count includes segments received on currently established connections.
Segments Retransmitted/sec. The rate segments are retransmitted, that is, segments transmitted containing one or more previously transmitted bytes.
Segments/sec. The rate TCP segments are sent or received using the TCP protocol.
Segments Sent/sec. The rate segments are sent, including those on current connections, but excluding those containing only retransmitted bytes.

Table A.37 The Thread Performance Monitor object counters.
Thread—The Thread object type is the basic object that executes instructions in a processor. Every running process has at least one thread.
 
Object Counters Description
% Privileged Time The percentage of elapsed time that this thread has spent executing code in Privileged Mode. When a Windows NT system service is called, the service will often run in Privileged Mode in order to gain access to system-private data. Such data is protected from access by threads executing in User Mode. Calls to the system can be explicit, or they can be implicit, such as when a page fault or an interrupt occurs. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of your application could appear in other subsystem processes in addition to the Privileged Time in your process.
% Processor Time The percentage of elapsed time that this thread used the processor to execute instructions. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Code executed to handle certain hardware interrupts or trap conditions might be counted for this thread.
% User Time The percentage of elapsed time that this thread has spent executing code in User Mode. Applications execute in User Mode, as do subsystems, like the window manager and the graphics engine. Code executing in User Mode cannot damage the integrity of the Windows NT Executive, Kernel, and device drivers. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of your application could appear in other subsystem processes in addition to the Privileged Time in your process.
Context Switches/sec. The rate of switches from one thread to another. Thread switches can occur either inside a single process or across processes. A thread switch can be caused either by one thread asking another for information, or by a thread being preempted by another, higher- priority thread becoming ready to run. Unlike some early operating systems, Windows NT uses process boundaries for subsystem protection in addition to the traditional protection of User and Privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows NT on behalf of an application can appear in other subsystem processes in addition to the Privileged Time in the application. Switching to the subsystem process causes one Context Switch in the application thread. Switching back causes another Context Switch in the subsystem thread.
Elapsed Time The total elapsed time (in seconds) this thread has been running.
ID Process The unique identifier of this process. ID Process numbers are reused, so they only identify a process for the lifetime of that process.
ID Thread The unique identifier of this thread. ID Thread numbers are reused, so they only identify a thread for the lifetime of that thread.
Priority Base The current base priority of this thread. The system can raise the thread’s dynamic priority above the base priority, if the thread is handling user input, or lower it towards the base priority, if the thread becomes computer bound.
Priority Current The current dynamic priority of this thread. The system can raise the thread’s dynamic priority above the base priority, if the thread is handling user input, or lower it towards the base priority, if the thread becomes computer bound.
Start Address The starting virtual address for this thread.
Thread State The current state of the thread. It is 0 for Initialized, 1 for Ready, 2 for Running, 3 for Standby, 4 for Terminated, 5 for Wait, 6 for Transition, 7 for Unknown. A Running thread is using a processor, and a Standby thread is about to use one. A Ready thread wants to use a processor but is waiting for a processor because none is free. A thread in Transition is waiting for a resource in order to execute, such as waiting for its execution stack to be paged in from disk. A Waiting thread has no use for the processor because it is waiting for a peripheral operation to complete or a resource to become free.
Thread Wait Reason Only applicable when the thread is in the Wait state (see Thread: Thread State.) It is 0 or 7 when the thread is waiting for the Executive, 1 or 8 for a Free Page, 2 or 9 for a Page In, 3 or 10 for a Pool Allocation, 4 or 11 for an Execution Delay, 5 or 12 for a Suspended condition, 6 or 13 for a User Request, 14 for an Event Pair High, 15 for an Event Pair Low, 16 for an LPC Receive, 17 for an LPC Reply, 18 for Virtual Memory, 19 for a Page Out, and 20 and higher are not assigned at the time of this writing. Event pairs are used to communicate with protected subsystems (see Thread: Context Switches/sec.).

Table A.38 The UDP Performance Monitor object counters.
UDP—The UDP object type includes those counters that describe the rates that UDP datagrams are received and sent by a certain entity using the UDP protocol. It also describes various error counts for the UDP.
 
Object Counters Description
Datagrams No Port/sec. The rate of received UDP datagrams for which there was no application at the destination port.
Datagrams Received Errors The number of received UDP datagrams that could not be delivered for reasons other than the lack of an application at the destination port.
Datagrams/sec. The rate UDP datagrams are sent or received by the entity.
Datagrams Received/sec. The rate UDP datagrams are delivered to UDP users.
Datagrams Sent/sec. The rate UDP datagrams are sent from the entity.

Table A.39 The WINS Server Performance Monitor object counters.
WINS Server—The WINS Server object type includes counters specific to the WINS Server service.
 
Object Counters Description
Failed Queries/sec. The total number of failed queries per second.
Failed Releases/sec. The total number of failed releases per second.
Group Conflicts/sec. The rate in which group registration received by the WINS server resulted in conflicts with records in the database.
Group Registrations/sec. The rate in which group registrations are received by the WINS server.
Group Renewals/sec. The rate in which group renewals are received by the WINS server.
Queries/sec. The rate in which queries are received by the WINS server.
Releases/sec. The rate in which releases are received by the WINS server.
Successful Queries/sec. The total number of successful queries per second.
Successful Releases/sec. The total number of successful releases per second.
Total Number Of Conflicts/sec. The sum of the unique and group conflicts per second. This is the total rate in which conflicts were seen by the WINS server.
Total Number Of Registrations/sec. The sum of the unique and group registrations per second. This is the total rate in which registrations are received by the WINS server.
Total Number Of Renewals/sec. The sum of the unique and group renewals per second. This is the total rate in which renewals are received by the WINS server.
Unique Conflicts/sec. The rate in which unique registrations/renewals received by the WINS server resulted in conflicts with records in the database.
Unique Registrations/sec. The rate in which unique registrations are received by the WINS server.
Unique Renewals/sec. The rate in which unique renewals are received by the WINS server.


Table of Contents