File Server Operational Guide
This document was uploaded by user and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this DMCA report form. Report DMCA
Overview
Download & View File Server Operational Guide as PDF for free.
More details
- Words: 18,318
- Pages: 87
Managing the Windows Server Platform
File Service Product Operations Guide
The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.
This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), but only for the purposes provided in the express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred.
2003 Microsoft Corporation. All rights reserved. Microsoft, Active Directory, ActiveX, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
File Service Product Operations Guide
iii
Contents Introduction to Product Operations Guide........................................................................... ............1 Document Purpose................................................................................................................. .....1 Intended Audience.................................................................................................................. .....1 How to Use This Guide............................................................................................................. ...1 Background.............................................................................................................. ...................2 High-Level Processes for Maintaining Windows Server 2003 File Service.....................................5 Overview............................................................................................................. ........................5 Required Technology............................................................................................................ .......6 Maintenance Processes Checklist........................................................................................... ....7 Operating Quadrant................................................................................................ .................7 Supporting Quadrant...................................................................................................... ........11 Optimizing Quadrant.................................................................................................. ............13 Changing Quadrant............................................................................................................... .15 Detailed Maintenance Processes.............................................................................................. ....17 Overview.......................................................................................................... .........................17 Process: Data backup, restore, and recovery operations............................................. .............18 Task: Run daily incremental backup...................................................................................... .18 Process: Data backup, restore, and recovery operations............................................. .............20 Task: Run weekly normal backup.............................................................. ............................20 Process: Design for service recovery....................................................................... .................22 Task: Update automated system recovery (ASR) backup.............................................. ........22 Process: Design for service recovery....................................................................... .................24 Task: Validate ASR recovery....................................................................................... ...........24 Process: Maintaining the directory................................................................. ...........................26 Task: Back up DFS namespace configuration............................................. ..........................26 Process: Data backup, restore, and recovery operations............................................. .............27 Task: Verify previous day’s backup job........................................................ ..........................27 Process: Storage resource management................................................................ ..................30 Task: Monitor available disk space......................................................................................... 30 Process: Storage resource management................................................................ ..................33 Task: Review disk fragmentation............................................................... ............................33 Process: Data backup, restore, and recovery operations............................................. .............36 Task: Verify restore......................................................................................... .......................36 Process: Managing resources and service performance.................................................... .......37 Task: Capture service performance statistics..................................................................... ....37 Task: Capture service usage statistics...................................................................... .............41 Process: Perform monitoring....................................................................................... ..............44 Task: Review quota levels................................................................................................... ...44 Process: Reviewing configuration items....................................................................... .............46 Task: Compliance check—verify that shares are created in the proper location....................46 Process: Problem recording and classification............................................................ ..............47 Task: Review daily problem management report............................................. ......................47 Process: Investigation and diagnosis................................................................. .......................49 Task: Create weekly service activity report........................................................ ....................49 Process: Incident closure.................................................................................. ........................51 Task: Roll up activity report into monthly metric..................................................... ................51 Process: Managing resources and service performance.................................................... .......52 Task: Captures size of DFS namespace................................................................... .............52 Process: Managing resources and service performance.................................................... .......54 Task: Create quota report............................................................................. .........................54 Task: Create a service performance and usage report.................................. ........................55 Task: Create a system load and utility report..................................................... ....................56 Process: Managing the directory............................................................................... ................57
iv
Managing the Windows Server Platform
Task: Check status of DFS.................................................................................................. ...57 Process: Investigation and diagnosis................................................................. .......................59 Task: Respond to daily service request................................................................................ ..59 Process: Change classification and authorization................................................ .....................61 Task: Attend CAB meeting................................................................................. ....................61 Task: Review emergency change request.................................................... .........................62 Process: Reviewing configuration items....................................................................... .............65 Task: Capture configuration snapshot............................................................................. .......65 Processes by MOF Role Clusters.................................................................................. ...............68 Operations Role Cluster....................................................................................................... ..68 Support Role Cluster............................................................................................................. .69 Release Role Cluster................................................................................................. ............69 Infrastructure Role Cluster....................................................................................... ..............70 Security Role Cluster........................................................................................... ..................71 Partner Role Cluster....................................................................................... .......................71 Troubleshooting.................................................................................................... ........................72 Overview.......................................................................................................... .........................72 Problem #1: “Path not found” or empty folder......................................................... ...............72 Problem #2: Slow connection time................................................................................... ......73 Problem #3: How to troubleshoot FRS-enabled DFS directories...........................................74 Problem #4: Using Defrag.exe on a disk that hosts FRS-replicated content..........................75 Problem #5: DFS links not visible.................................................................... ......................76 Problem #6: DFS root does not appear in MMC.................................................... ................77 Problem #7: NTFS file system log file size bottlenecks......................................................... .78 Problem #8: Excessive CPU use by Clussvc.exe or Rsrcmon.exe .......................................79 Problem #9: "A DFS root already exists in this cluster node"....................................... ..........80 Problem #10: DNS name problems................................................................ .......................81
File Service Product Operations Guide
Contributors Program Manager Jeff Yuhas, Microsoft, USA
Lead Writers Michael Sarabosing, Covestic, USA Akil Washington, Covestic, USA
Other Contributors Steve Barnard, Microsoft Consulting Services Shiloh Cleofe, Microsoft Corporation
Test Manager Greg Gicewicz, Microsoft Corporation
QA Manager Jim Ptaszynski, Microsoft Corporation
Lead Technical Writer Jerry Dyer, Microsoft Corporation
Lead Technical Editor Laurie Dunham, Microsoft Corporation
Technical Editors Bill Karn, Volt Technical Services Patricia Rytkonen, Volt Technical Services
Production Editor Kevin Klein, Volt Technical Services
v
1 Introduction to Product Operations Guide Document Purpose This guide describes processes and procedures for improving the management of Microsoft® Windows Server™ 2003 File Service in an information technology (IT) infrastructure.
Intended Audience This material should be useful for anyone planning to deploy this product into an existing IT infrastructure, especially one based on the IT Infrastructure Library (ITIL) —a comprehensive set of best practices for IT service management—and Microsoft Operations Framework (MOF). It is aimed primarily at two main groups: IT managers and IT support staff (including analysts and service-desk specialists).
How to Use This Guide This guide is divided into five main chapters. The first chapter provides basic background information. The second chapter provides a high-level checklist of the tasks required for maintaining this product. The third chapter takes a more detailed look at the tasks described in the maintenance section. The fourth chapter organizes tasks by the MOF role cluster responsible for each task. The fifth chapter provides information about common troubleshooting techniques for Windows Server 2003 File Service. The guide may be read as a single volume, including the detailed maintenance and troubleshooting sections. Reading the document this way will provide the necessary context so that later material can be understood more readily. However, some people will prefer to use the document as a reference, looking up information only as they need it.
2
Managing the Windows Server Platform
Background This guide is based on Microsoft Solutions for Management (MSM). MSM provides a combination of best practices, best-practice implementation services, and bestpractice automation, all of which help customers achieve operational excellence as demonstrated by high quality of service, industry reliability, availability, and security, and low total cost of ownership (TCO). These MSM best practices are based on MOF, a structured, yet flexible approach centered around ITIL. MOF includes guidelines on how to plan, deploy, and maintain IT operational processes in support of mission-critical service solutions. Central to MOF—and to understanding the structure of this guide—are the MOF Process and Team Models. The Process Model and its underlying service management functions (SMFs) are the foundation for the process-based approach that this guide recommends for maintaining a product. The Team Model and its role clusters offer guidance for ensuring the proper people are assigned to operational roles. Figure 1 shows the MOF Process Model combined with the SMFs that make up each quadrant of the Process Model.
Figure 1 MOF Process Model and SMFs
File Service Product Operations Guide
3
Figure 2 shows the MOF Team Model, along with some of the many functional roles or function teams that might exist in service management organizations. These roles and function teams are shown mapped to the MOF role cluster to which they would likely belong.
Change management Release/systems engineering Configuration control/asset management Software distribution/licensing Intellectual property protection Quality assurance Network and system security Intrusion detection Virus protection Release Audit and compliance admin Contingency planning
Enterprise architecture Infrastructure engineering Capacity management Cost/IT budget management Resource and long-range planning
Security
Infrastructure
Partner
Support
Maintenance vendors Environment support Managed services, outsourcers, trading partners Software/hardware suppliers
Operations
Messaging operations Database operations Network administration Monitoring/metrics Availability management
Figure 2 MOF Team Model and examples of functional roles or teams
Service desk/help desk Production/production support Problem management Service level management
4
Managing the Windows Server Platform
The MOF Team Model is built on six quality goals, which are described and matched with the applicable team role cluster in Table 1. Table 1. MOF Team Model Quality Goals and Role Clusters Quality goal
Team role cluster
Effective release and change management. Accurate inventory tracking of all IT services and systems.
Release
Management of physical environments and infrastructure tools.
Infrastructure
Quality customer support and a service culture.
Support
Predictable, repeatable, and automated system management.
Operations
Mutually beneficial relationships with service and supply partners.
Partner
Protected corporate assets, controlled authorization, and proactive security planning.
Security
Further information about MSM and MOF is available at http://www.microsoft.com/solutions/msm/techinfo/default.asp, or search for the topic on TechNet at http://www.microsoft.com/technet/default.asp. You can also contact your local Microsoft or partner representative.
2 High-Level Processes for Maintaining Windows Server 2003 File Service Overview Every company consists of employees (people), activities that these employees perform (processes), and tools that help them perform these activities (technology). Regardless of what the business is, it most likely consists of people, processes, and technology working together to achieve a common goal. Table 2 illustrates this point. Table 2. Examples of People, Process, and Technology Working Together Area
People
Process
Technology
Auto repair industry
Mechanic
Repair manual
Socket set
Software development industry
Programmer
Project plan
Compiler, debugger
IT operations
IT technician
Microsoft Operations Framework
Windows Server 2003 File Service
At the heart of any IT organization is the ability to efficiently manage file resources while keeping them available and secure for users. As the network expands with more users located on-site, in remote locations, or even at partner companies, IT administrators face an increasingly heavy burden. This product operations guide combines people and process with technology to offer best-practice advice for the maintenance of Windows Server 2003 file services.
6
Managing the Windows Server Platform
Required Technology Table 3 lists the tools or technologies used in the procedures described in this guide. All tools should be accessed from a Windows Server 2003 server console, except in those cases where a link is provided. All tools should be accessed from a Windows Server 2003 server console, except in those cases where a link is provided. Table 3. File Service Tools or Technologies Required Technology
Description
Location
Disk Defragmenter
Tool used to analyze volumes for fragmentation. Also used to defragment volumes.
Start > All Programs > Accessories > System Tools > Disk Defragmenter
System Monitor (formerly known as Performance Monitor)
Tool used to collect data on server health and performance
Start > All Programs > Administrative Tools > System Monitor
Event Viewer
Tool used to monitor and gather information on system, security, and application events
Start > All Programs > Administrative Tools > Event Viewer
Quota Entries window
To be used to view and configure quotas on a volume
On the properties page of a NTFS volume
Microsoft Distributed File System (DFS) Microsoft Management Console (MMC)
Tool used to monitor DFS namespace, including roots, links, and targets
Start > All Programs > Administrative Tools > Distributed File System
Disk Cleanup
Tool used to remove temporary files, Internet cache files, and unnecessary program files
Start > All Programs > Accessories > System Tools > Disk Cleanup
Backup
Tool used to perform backup and restore operations
Start > All Programs > Accessories > System Tools > Backup
Ntfrsutl.exe
Tool used for troubleshooting FRS on DFS
Windows Server 2003 Support Tools
Dfsutil.exe
Tool used to configure and troubleshoot DFS
Windows Server 2003 Support Tools
File Service Product Operations Guide
Recommended Technology
7
Description
Location
Srvinfo.exe
Tool used to gather system information from servers
Windows Server 2003 Resource Kit
Volperf.exe
Tool used to install performance objects and counters for volume shadow service
Windows Server 2003 Resource Kit
Fsutil.exe
Tool used to manage Windows® file system
\Winnt\System32
Iologsum.cmd
Tool used for troubleshooting FRS on DFS
Windows Server 2003 Support Tools
Windows Management Instrumentation (WMI)
Tool used to configure WMI settings such as permissions for authorized users and groups and turning error logging on or off
Start > Run > type wmimgmt.msc
Maintenance Processes Checklist The following checklists provide a quick reference for those product maintenance processes that must be performed on a regular basis. These process lists are a summary of the processes described in subsequent sections of this guide. They are limited to those processes required for maintaining the product.
Operating Quadrant The processes for this section are based on the service management function guides that make up the MOF Operating Quadrant. For more information on the MOF Process Model and the SMFs, see http://www.microsoft.com/solutions/msm and http://www.microsoft.com/mof.
8
Managing the Windows Server Platform
Storage Management SMF Daily Processes Process Name
Related SMFs
MOF Role Cluster
Storage resource management
Infrastructure
Data backup, restore, and recovery operations
Support Weekly Processes
Process Name
Related SMFs
MOF Role Cluster
Storage resource management
Infrastructure
Data backup, restore, and recovery operations
Support Monthly Processes
Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name Data backup, restore, and recovery operations
Related SMFs
MOF Role Cluster Operations
File Service Product Operations Guide
9
Service Monitoring and Control SMF Daily Processes Process Name
Related SMFs
Perform monitoring
MOF Role Cluster Infrastructure
Weekly Processes Process Name
Related SMFs
MOF Role Cluster
There are no weekly processes for this SMF. Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
10
Managing the Windows Server Platform
Directory Services Administration SMF Daily Processes Process Name
Related SMFs
Maintaining the directory
MOF Role Cluster Infrastructure
Weekly Processes Process Name
Related SMFs
MOF Role Cluster
There are no weekly processes for this SMF. Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
File Service Product Operations Guide
11
Supporting Quadrant The processes for this section are based on the SMF guides that make up the MOF Supporting Quadrant.
Incident Management SMF Daily Processes Process Name
Related SMFs
Investigation and diagnosis
MOF Role Cluster Support
Weekly Processes Process Name
Related SMFs
Investigation and diagnosis
MOF Role Cluster Support
Monthly Processes Process Name
Related SMFs
Incident closure
MOF Role Cluster Operations
As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
12
Managing the Windows Server Platform
Problem Management SMF Daily Processes Process Name
Related SMFs
Problem recording and classification
MOF Role Cluster Operations
Weekly Processes Process Name
Related SMFs
MOF Role Cluster
There are no weekly processes for this SMF. Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
File Service Product Operations Guide
13
Optimizing Quadrant The tasks for this section are based on the SMF guides that make up the MOF Optimizing Quadrant.
Availability Management SMF Daily Processes Process Name
Related SMFs
MOF Role Cluster
There are no daily processes for this SMF. Weekly Processes Process Name
Related SMFs
Design for recovery
MOF Role Cluster Operations
Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. Quarterly Processes Process Name
Related SMFs
Design for recovery
MOF Role Cluster Operations
As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster Operations
14
Managing the Windows Server Platform
Capacity Management SMF Daily Processes Process Name
Related SMFs
MOF Role Cluster
Managing resources and service performance
Operations
Managing resources and service performance
Operations Weekly Processes
Process Name
Related SMFs
Managing resources and service performance
MOF Role Cluster Infrastructure
Monthly Processes Process Name
Related SMFs
Managing resources and service performance
MOF Role Cluster Infrastructure
As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
File Service Product Operations Guide
15
Changing Quadrant The processes for this section are based on the SMF guides that make up the MOF Changing Quadrant.
Change Management SMF Daily Processes Process Name
Related SMFs
Change classification
MOF Role Cluster Infrastructure
Weekly Processes Process Name
Related SMFs
Change authorization
MOF Role Cluster Infrastructure
Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
16
Managing the Windows Server Platform
Configuration Management SMF Daily Processes Process Name
Related SMFs
MOF Role Cluster
There are no daily processes for this SMF. Weekly Processes Process Name
Related SMFs
MOF Role Cluster
There are no weekly processes for this SMF. Monthly Processes Process Name
Related SMFs
Reviewing configuration items
MOF Role Cluster Infrastructure
As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
3 Detailed Maintenance Processes Overview This chapter provides detailed information about the processes that must be performed in order to maintain Windows Server 2003 File Service. The chapter is first arranged according to the MOF quadrant to which each process belongs. The quadrants are: ●
Operating Quadrant
●
Supporting Quadrant
●
Optimizing Quadrant
●
Changing Quadrant
Within each quadrant, the processes are further arranged according to the MOF SMF guides that make up that quadrant, the particular Team Model role cluster to which the process belongs, and the time (daily, weekly, monthly, or as-needed) when the process occurs. For more information about the MOF Process Model and the MOF SMF guides that make up each quadrant of the model, see http://www.microsoft.com/solutions/msm. For more information about the MOF Team Model and team role clusters, see http://www.microsoft.com/mof.
18
Managing the Windows Server Platform
Operating Quadrant
Storage Management SMF
Support Role Cluster
Daily
Process: Data backup, restore, and recovery operations Description Backing up, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that those processes fulfill business requirements and service level objectives.
Task: Run daily incremental backup Purpose Performing regularly scheduled backups is an integral part of any file service operations environment. A good backup strategy should include daily incremental or differential backups as well as weekly backups. Numerous strategies exist regarding the frequency and types of backup jobs that an operations team can implement.
File Service Product Operations Guide
19
Procedure: Configure incremental backup job 1. Start Backup utility and select the Backup tab. 2. Select the drives, folders, and files that will be included in the backup. It is a good idea to include the system state information as part of the backup operation. 3. On the Tools menu, click Options. In the Options window, on the Backup Log tab, select Detailed, and click OK. Backup logs can be vital to troubleshooting and recording status of the backup operation. The default setting in Windows Server 2003 is for backup logs to contain such summary information as loading a tape, starting the backup, backing up files, backing up bytes, or failing to open a file. Some operations environments require more detail information—specifically, what files are being backed up for a particular backup job. 4. On the Tools menu, click Options. In the Options window, click the Backup Type tab. In the Default Backup Type drop-down list, select Incremental, and click OK. 5. In Backup Destination, select one of the following: ●
Choose file to back up files and folders to a file. This is the default setting.
●
Choose a tape device if you want to back up files and folders to a tape.
6. In Backup media or file name, select one of the following: ●
If you are backing up files and folders to a file, enter the path and file name of the backup (.bkf) file.
●
If you are backing up files and folders to tape, choose the tape you want to use.
7. Click Start Backup, then click Advanced, select Data Verification, and click OK. 8. Click Schedule and enter the logon name and password that the backup will run as, and then click OK. In the Schedule Job Options window, enter the name for the backup job—for example, "ServerName-IncBackup-Date," and click OK. 9. In the Schedule Job window, confirm that the Schedule tab is selected. Under Schedule Task, select Weekly and click the days of the week you want the incremental job to run. In Start time, enter the time you want the backup to start and click OK. 10. Enter the logon name and password that the backup job will run as and then click OK. Click OK again to exit the window. The daily incremental job is now scheduled to run. Dependencies None Technology Required Backup.exe
20
Managing the Windows Server Platform
Operating Quadrant
Storage Management SMF
Support Role Cluster
Weekly
Process: Data backup, restore, and recovery operations Description Storing, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that backup and recovery processes fulfill business requirements and service level objectives.
Task: Run weekly normal backup Purpose Performing regularly scheduled backups is an integral part of any file service operations environment. A good backup strategy should include daily incremental or differential backups as well as weekly backups. Numerous strategies exist regarding the frequency and types of backup jobs that an operations team can implement.
Procedure: Configure normal backup job 1. Start the Backup utility. 2. On the Backup tab, select the drives, folders, and files that will be included in the backup job. It is a good idea to include the system state information as part of the backup operation. 3. On the Tools menu, click Options. In the Options window, click the Backup Log tab, select Detailed, and click OK. Backup logs can be vital for troubleshooting and recording status of the backup operation. The default setting in Windows Server 2003 is for backup logs to contain summary information such as loading a tape, starting the backup, backing up files, backing up bytes, or failing to open a file. Some operations environments require more detailed information—specifically, what files are being backed up for a particular backup job. 4. On the Tools menu, click Options. In the Options window, click the Backup Type tab. In the Default Backup Type drop-down list, select Normal and click OK. 5. In Backup Destination, select one of the following: ●
Choose a file to back up files and folders to a file. This is the default setting.
●
Choose a tape device if you want to backup files and folders to a tape.
File Service Product Operations Guide
21
6. In Backup media or file name, select one of the following: ●
If you are backing up files and folders to a file, enter the path and file name of the backup (.bkf) file.
●
If you are backing up files and folders to tape, choose the tape you want to use.
7. Click Start Backup, click Advanced, select Data Verification, and click OK. 8. Click the Schedule, enter the logon name and password that the backup job will run as, and then click OK. 9. In the Schedule Job Options window, enter the name for the backup job, such as "Increment Backup," and click OK. 10. In the Schedule Job window, confirm the Schedule tab is selected. Under Schedule Task, select Weekly and click the days of the week you want the incremental job to run. In Start Time, enter the time you want the backup job to start, and click OK. 11. Enter the logon name and password that the backup job will run as and then click OK. 12. Click OK. The weekly normal job is now scheduled to run. Dependencies None Technology Required Backup.exe
22
Managing the Windows Server Platform
Optimizing Quadrant
Availability Management SMF
Operations Role Cluster
Weekly
Process: Design for service recovery Description Regardless of how well designed and managed an IT service is, problems with its delivery can still occur—whether as the result of an unexpected event or even the failure of a countermeasure deployed to protect the service. A major design consideration for high availability is a reactive one, charged with recovering service as quickly and efficiently as possible. Rapid recovery may also be the appropriate design choice for a particular availability risk if an effective countermeasure proves to be too expensive for the customer to justify.
Task: Update automated system recovery (ASR) backup Purpose There is a potential for a system failure during the lifetime of a file server. Several startup options, such as safe mode and last known good configuration, are available to use to recover from system failure. However, automated system recovery (ASR) backups should be included in the regular maintenance of your file server to act as a last resort in system recovery. ASR will back up the system files necessary for starting the file server. Other data should be included as part of the daily and weekly backup jobs for the server. ASR backups are performed using Backup in interactive mode. They cannot be scheduled.
Procedure 1: Get media for ASR backup ASR backup requires a blank 1.44-MB disk to save system settings, and media such as tapes or compact discs that will contain the backup files. 1. A separate media set is recommended for ASR backups. The media set should be stored in a secure location, separate from data backup files. 2. Store the 1.44-MB disk with the ASR backup set it was created with. You must have the disk that was created with the ASR backup set in order to perform ASR recovery.
Procedure 2: Create ASR backup 1. Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup. 2. On the Jobs menu, click New. 3. On the Tools menu, click ASR Wizard. 4. Follow the instructions that appear on the screen.
File Service Product Operations Guide
23
Procedure 3: File server does not have a floppy disk drive 1. Perform an ASR backup on the computer without the floppy disk drive. ASR backup will log an error. 2. Copy the Asr.sif and Asrpnp.sif files located in the %systemroot%\Repair directory to another computer with a floppy disk drive, and then copy those files onto a disk. Dependencies ●
File server should have a floppy disk drive. Procedure 3 provides a workaround to copy system files to a disk, but a floppy disk drive is required for ASR recovery.
●
You must be a member of an administrators or backup operators group to perform ASR.
Technology Required Backup.exe
24
Managing the Windows Server Platform
Optimizing Quadrant
Availability Management SMF
Operations Role Cluster
Quarterly
Process: Design for service recovery Description Regardless of how well designed and managed an IT service is, problems with its delivery can still occur—whether as the result of an unexpected event or even the failure of a countermeasure deployed to protect the service. A major design consideration for high availability is a reactive one, charged with recovering service as quickly and efficiently as possible. Rapid recovery may also be the appropriate design choice for a particular availability risk if an effective countermeasure proves to be too expensive for the customer to justify.
Task: Validate ASR recovery Purpose The ASR backup must be validated in order to confirm the integrity of the backup process. The operations team must also be familiar with the hardware and software involved in the ASR recovery process.
Procedure 1: Prepare for ASR recovery 1. Retrieve the latest ASR backup media set and disk from the secure location. Verify that the media and disks are from the same backup. 2. Retrieve the media set for the most recent normal backup of the server. 3. Retrieve the original Windows Server 2003 installation CD. 4. Retrieve any mass storage device driver files supplied by the manufacturer. Verify that you have this file before beginning the recovery operation. 5. Configure the recovery server hardware.
Procedure 2: Perform ASR recovery 1. Insert the original Windows Server 2003 installation CD. 2. Restart the server. If prompted to press a key to start the computer from the CD, press the requested key. 3. If you have a separate driver file as described in Procedure 1, Step 4, use the driver as part of the Setup by pressing F6 when prompted. 4. Press F2 when prompted at the beginning of the text-only mode section of Setup. You will be prompted to insert the ASR disk you have previously created. 5. Follow the directions on the screen. 6. If you have a separate driver file as described in Procedure 1, Step 4, press F6 (a second time) when prompted after the system restarts. 7. Follow the directions on the screen.
File Service Product Operations Guide
25
Procedure 3: Restore data files to the recovery server 1. Start the Backup utility. 2. On the Welcome tab, click Restore Wizard (Advanced). 3. Click Next. 4. Select the items to be restored from the latest normal backup set and click Next. 5. At this point, you can click Finish to start the restore or click the Advanced button for more options. If you decide to configure Advanced options, the following is a list of items that should be selected. ●
Restore files to original location
●
Leave existing files
●
Restore security settings
●
Restore junction points but not the folders and file data they reference
●
Preserve existing volume mount points
Dependencies ●
ASR recovery requires that the recovery server have the same hardware and disk configuration as the server where the ASR backup was performed.
●
Perform regular ASR backup.
●
Manufacturer-supplied device drivers for mass storage devices.
Technology Required Backup.exe
26
Managing the Windows Server Platform
Operating Quadrant
Directory Services Administration SMF
Infrastructure Role Cluster
Daily
Process: Maintaining the directory Purpose The data contained in the directory is, or very soon will be, critical to the base operation and productivity of the organization. If the directory becomes unavailable for any reason—for example, through equipment failure or data corruption—the business will suffer from lost productivity and financial loss. Developing sound backup and restore procedures for the directory and supporting system components ensures that no critical directory data and configuration information will be lost.
Task: Back up DFS namespace configuration Purpose This task creates a backup of the DFS namespace and a restoration script to resolve issues with DFS objects.
Procedure 1: Export DFS namespace Windows Server 2003 Support Tools include the Dfsutil.exe in the can be used to export the DFS namespace configuration into a script that can be used later for restoration. The following command will export the links: Dfsutil /Root :\\dfsname\root /Export: where filename is the name of the script that will contain the DFS namespace configuration for restoration.
Procedure 2: Automate DFS configuration export This process can be automated using Microsoft Windows Shell Scripting. The following is a simple command that can read an input file. Each line of the input file lists a DFS root: echo off for /f %%i in (input.txt) do dfsutil.exe /view:%%i /export: exit where filename is the name of the file that will contain the report. Dependencies None Technology Required ●
Dfsutil.exe
●
Windows Host Script
File Service Product Operations Guide
Operating Quadrant
Storage Management SMF
27
Support Role Cluster
Weekly
Process: Data backup, restore, and recovery operations Description Storing, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that operations fulfill business requirements and service level objectives.
Task: Verify previous day’s backup job Purpose This task provides guidance on verifying the integrity of the daily scheduled backup. Regardless of the utility used to provide backup service to the file server, the operations team should verify each backup job after its completion. This verification allows the operations team to resolve issues concerning backups that may put the organization at risk of data loss.
Procedure 1: Verify completion of backup You can use Event Viewer to verify whether a backup started and completed, and if any errors were encountered during the backup operation. 1. Start Event Viewer. 2. Right-click Application Log, and click Properties, highlight View, and select Filter. 3. In Event Source, click the drop-down menu, select Backup, and click OK. 4. Search for the following events: ●
Event 8000. This event signals the start of a backup on a volume. You should receive this event for each volume in the backup job.
●
Event 8001. This event signals the end of a backup on a volume. You should receive n-1 of this event for a backup job, where n is equal to the number of volumes in the backup job. When a volume has been backed up successfully, Event 8001 will be logged as an informational event. When errors are encountered backing up a volume, Event 8001 will be logged as an error event.
●
Event 8019. This event signals the end of the backup operation. You should receive one 8019 event per backup job.
28
Managing the Windows Server Platform
Procedure 2: Review the backup log Backup logs can be vital for troubleshooting and recording status of the backup operation. The default setting in Windows Server 2003 is for backup logs to contain summary information such as loading a tape, starting the backup, backing up files, backing up bytes, or failing to open a file. Some operations environments require more detailed information—specifically, what files are being backed up for a particular backup job. To get more detailed logging in the backup logs 1. Start the Backup utility. 2. On the Tools menu, click Options. 3. In the Options window, click the Backup Log tab, select Detailed, and click OK. Backup logs will now contain detailed information regarding the backup operations. To review the backup log 1. Start Backup utility. 2. On the Tools menu, click Reports. 3. In the Backup Report dialog box, select the previous night’s backup report, and click View.
File Service Product Operations Guide
29
Procedure 3: Report backup problems to incident management Use your organization's incident management process to record the following conditions in your environment. This procedure describes some of the steps that should be followed when filling out the incident management report. 1. Event 8000 is not logged in the application log. When this occurs, the file server is at risk of data loss. Verify that the backup job has not been deleted. Review the start time for the job to verify that it has not been modified. 2. Event 8000 is not logged for all volumes on the server. When this occurs, a volume is at risk of data loss. Review the backup configuration for the backup job to see if the volume has been removed from the backup job. Check the configuration management database (CMDB) to see if the volume has been removed from the backup job. 3. Event 8001 is logged as a warning event in the application log. Review the backup log by searching for the "Warning:" string in the body of the log. Record what the warning is and the reason for the warning. 4. Event 8019 is not logged in the application log. This means the backup job is still running. Review the application log and record the last volume to trigger a successful 8001 informational event. Record the last volume to trigger an 8000 event. Dependencies ●
Backup jobs are logged to disk
●
Incident management process
Technology Recommended ●
Backup
●
Third-party backup software
30
Managing the Windows Server Platform
Operating Quadrant
Storage Management SMF
Infrastructure Role Cluster
Daily
Process: Storage resource management Description Storage resource management (SRM) is a key storage management activity that ensures that important storage devices, such as disks, are formatted and installed with appropriate file systems. In addition, SRM includes using management technologies to monitor storage resources in order to ensure that they meet availability, capacity, and performance requirements.
Task: Monitor available disk space Purpose This task proactively monitors disk space on a volume to control the allocation of disk space and to provide reporting for capacity planning. It mitigates any problems that may result in rapid file growth on a volume. In an IT environment, it is important to set alerts on a logical volume at differing capacity levels. Some alerts are informational so that the status of the disk volume can be reported. Other alerts are used to warn the operations team of a real problem with capacity on a volume. The following are suggested thresholds on a volume: ●
Sixty-five percent capacity. It is important to note that a particular volume is at 65 percent or more full. This means that volume has only 35 percent or less capacity for growth.
●
Seventy-five percent capacity. When a volume is 75 percent full, consider creating new shares on another volume.
●
Ninety percent capacity. Volumes that are at 90 percent capacity should not have file shares created on them. Volumes that are at 90 percent should be included in the problem management report. Once the ninety percent–capacity threshold is reached and an alert is generated, an administrator should initiate appropriate changes such as increasing available capacity, or begin to migrate the shares to higher-capacity subsystems. Additional administrative actions might include performing disk defragmentation and disk cleanup. (See Task: Review Disk Fragmentation.)
File Service Product Operations Guide
31
Procedure 1: Configure alert 1. Start System Monitor. 2. Expand the Performance Logs and Alerts node, right-click Alerts, and click New Alert Settings. 3. Type Jobs Spooling and click OK. 4. On the General tab, click Add, and select the following object, instance, and counter: Object Logical Disk Space
Instance Each Logical Volume Instance.
Counter % Free Space
5. In the Alert when the value is drop-down box, select Over and enter the limit for your environment. 6. On the Action tab, the default selection is Log an entry in the application event log. 7. Select the Schedule tab, click Start Log At, and enter the start time for the alert. 8. Click Apply, and then click OK. The alert is activated and will have a green status indicating that it is logging information based on the configuration and schedule.
Procedure 2: Stop creating share alert ●
Review the event log for Event 2031: Event Type: Information Event Source: SysmonLog Event Category: None Event ID: 2031 Description: Counter: \\Servername\LogicalDisk(driveletter)\% Free Space has tripped its alert threshold. The counter value of n is under the limit value of n.
When you begin to receive Event 2031, the capacity of the volume must be included in the daily problem management report. This alert can indicate when to stop creating new shares on a volume. The remaining space on the volume is used to accommodate data growth on existing shares. This alert will continue be written to the application log until the alert is stopped. It is okay to stop the alert, but once a volume has triggered the Stop Creating Share alert, the capacity should always be included in the daily problem management report.
32
Managing the Windows Server Platform
Procedure 3: Capacity alert ●
Review the event log for Event 2031. (See Procedure 2: Stop creating share alert.) Once the capacity alert is triggered, the disk has reached capacity. The alert should be set as 20-25 percent free space. Once a volume has triggered the capacity alert, submit a request for change (RFC) to move data to another volume or to extend the volume.
Dependencies An alert must be configured to perform an action when a certain disk capacity threshold is reached. Technology Required Performance Logs and Alerts in Windows Server 2003
File Service Product Operations Guide
Operating Quadrant
Storage Management SMF
33
Infrastructure Role Cluster
Weekly
Process: Storage resource management Description Storage resource management (SRM) is a key process for ensuring that important storage devices, such as disks, are formatted and installed with appropriate file systems. In addition, SRM includes using management technologies to monitor storage resources to ensure that they meet availability, capacity, and performance requirements.
Task: Review disk fragmentation Purpose Disk fragmentation occurs when files are written to non-adjacent clusters on a disk. During normal operations of a file server, the file system will become fragmented. Fragmentation has a performance effect on the read/write action. A disk that is highly fragmented requires several passes of the disk’s read and write heads to retrieve or store data to the disk. To analyze the extent of disk fragmentation on a volume and to remediate performance issues associated with fragmented files and free space, run the Disk Defragmenter utility. An effective use of the Disk Defragmenter utility should include removing unnecessary files from the volume. Prior to defragmenting a volume, run the Disk Cleanup utility to perform the following activities: ●
Remove temporary Internet files.
●
Remove any downloaded program files (for example, Microsoft ActiveX® controls and Java applets downloaded from the Internet).
●
Empty the Recycle Bin.
●
Remove Windows temporary files.
●
Remove Windows components that you are not using.
●
Remove installed programs that you no longer use.
34
Managing the Windows Server Platform
Procedure 1: Analyze the volume 1. Start Disk Defragmenter. 2. Select the volume that you want to analyze, and then click Analyze. 3. Click Save As to save the report. You can use Defrag.exe to schedule an analysis of the disk fragmentation on a volume. To output the report to a text file, the syntax for the command line is: defrag -a –v >filename.txt where filename is the name of the file that will contain the report. The Disk Defragmenter window displays the estimated disk usage before defragmentation. For more detail, use the command line above to perform this task. Based on the results of the report, either run disk cleanup and proceed to defragment the volume, or wait for the next scheduled defragmentation. If, after conducting several analyses of the volume for fragmentation, the results show there is no need to defragment the disk, then you may want to move the frequency of this task to once a month.
Procedure 2: Clean up the volume 1. Start Disk Cleanup. 2. Select the volume that was analyzed in Procedure 1. 3. Select the file types to delete and click OK. Cleanmgr.exe can be scheduled to run. Prior to scheduling the Cleanmgr.exe, you must specify which tasks you want performed during the disk cleanup. This can be accomplished by running the following command at the command line: cleanmgr /d driveletter: /sageset:n where driveletter is the volume that you want to clean up. 4. When you enter this command, the Disk Cleanup Settings dialog box appears. Select the file types you want removed and click OK. Now you can schedule the disk cleanup task you just created by running the following command from the command line or Task Scheduler: cleanmgr /sagerun:n
File Service Product Operations Guide
35
Procedure 3: Defragment the volume 1. Start Disk Defragmenter. 2. Click the volume that you want to defragment, and then click the Defragment button. You can use Defrag.exe to schedule defragmentation on a volume. It is best to defragment a volume during low usage periods in order to reduce the effect the process has on file server performance. The syntax for the command line is: defrag -v >filename.txt where volume is the drive you want to defragment, and filename is the name of the file that will contain the defragmentation report. For a list of switches for the Defrag command, at the command prompt, type defrag. Dependencies ●
Administrator privileges are required to run Disk Defragmenter.
●
Defragmentation requires 15 percent free disk space. If there is low disk space, consider using the –f switch. This switch forces defragmentation even if free disk space is low.
●
Confirm that there is a good backup of the volume prior to performing defragmentation.
●
For more information on running Disk Cleanup from the command line, see the Automating Disk Cleanup Tool in Windows white paper available at http://support.microsoft.com/default.aspx?scid=kb;EN-US;253597.
●
Disk Defragmenter cannot be run on a volume that has Volume Shadow Copies activated. For more information, see the Shadow Copies May Be Lost When You Defragment a Volume white paper available at http://support.microsoft.com/default.aspx?scid=kb;en-us;312067.
Technology Required ●
Disk Defragmenter
●
Disk Cleanup
36
Managing the Windows Server Platform
Operating Quadrant
Storage Management SMF
Operations Role Cluster
As Needed
Process: Data backup, restore, and recovery operations Description Storing, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that backup and recovery processes fulfill business requirements and service level objectives.
Task: Verify restore Purpose When restoring files and folders to the file system, it is important to verify the successful completion of the restoration task. Without verifying that data has been restored prior to directing users to the restore location, the integrity of the backup/restore process could be questioned by users.
Procedure: Verify restore configuration tasks 1. Start the Backup utility. 2. On the Tools menu, select Reports. 3. In the Backup Reports window, select the report that contains the Restore Job, and click View. 4. Search the log for the “Operation: Restore” string. 5. Verify that the restore location and restore files are in the location specified in the initial restore request. 6. Use Windows Explorer to navigate to the location of the restore and verify that the data exists. Dependencies Scheduled backups are being performed. Technology Required Backup
File Service Product Operations Guide
Optimizing Quadrant
Capacity Management SMF
37
Operations Role Cluster
Daily
Process: Managing resources and service performance Description Capacity management is concerned with optimizing the use of IT resources in order to achieve the level of service performance agreed upon with the client. These resources are supplied by support organizations to ensure that the requirements of the business are met. The capacity management process can be either reactive or proactive. Iterative activities, such as monitoring, analyzing, tuning, and reporting, are also important in the process of managing resources and service performance. Each process requires different types of data. For example, managing IT resources involves documenting the usage levels of individual components in the infrastructure, whereas managing service performance records transaction throughput rates and response times.
Task: Capture service performance statistics Purpose During the normal operation of a file server, it is important to monitor the overall health of the server. This information will be used to review general performance, adherence to service level agreements (SLAs), and capacity planning and to create a baseline for the file server.
Procedure: Create performance monitor logs 1. Start System Monitor. 2. Double-click Performance Logs and Alerts, right-click Counter Logs, and select New Settings. 3. Enter the name for this log—for example, "Service Performance Statistics"—and click OK.
38
Managing the Windows Server Platform
4. On the General tab, click Add Counters and select the following counters: Processor Performance
Notes
Processor\% Processor Time
The percentage of elapsed time the processor spent executing instructions for processes or services. It reports the sum of the time the processors spent executing code in privileged mode and executing code in user mode. This counter provides an overall view of the processors' activity.
Processor\% Privileged Time
The percentage of elapsed time that the process threads spent executing code in privileged mode. The operating system switches application threads to privileged mode to allow direct access to the system’s kernel.
System\Context Switches/sec
The combined rate at which all processors on the computer are switched from one thread to another. Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user mode and privileged mode to use an executive or subsystem service. High rates of context switching can result from inefficient hardware or poorly designed device drivers or applications.
Memory Performance
Notes
Memory\Pages/sec
Pages/sec is the rate at which pages are read from or written to the disk in order to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays.
Memory\Available megabytes (MB)
Available megabytes is the amount of physical memory, in megabytes, immediately available for allocation to a process or for system use.
Paging File\% Usage
The amount of the page file instance in use in percent.
File Service Product Operations Guide
Network Performance
39
Notes
Server\Error System
The number of times an internal server error was detected. Unexpected errors usually indicate a problem with the server.
Server\Work Item Shortages
This occurs when no work item is available or can be allocated to service the incoming request. A work item is the location where the server stores a server message block (SMB). Work item shortages might be caused by an overloaded server.
Server\Blocking Requests Rejected
The number of times the server has rejected blocking SMBs due to insufficient count of free work items. This counter indicates whether the MaxWorkItem or MinFreeWorkItems server parameters might need to be adjusted.
Server Work Queues\Queue Length
Queue length is the current length of the server work queue for this CPU. A sustained queue length greater than four might indicate processor congestion. This is an instantaneous count, not an average over time.
Disk Performance Physical Disk\Current Disk Queue Length
Notes Current disk queue length is the number of requests outstanding on the disk at the time the performance data is collected. It also includes requests in service at the time of the collection. This is an instantaneous snapshot, not an average over time interval. Multispindle disk devices can have multiple requests that are active at one time, but other concurrent requests are awaiting service. This counter might reflect a transitory high or low queue length, but if there is a sustained load on the disk drive, it is likely that this will be consistently high. This counter requests experience delays proportional to the length of this queue minus the number of spindles on the disks. For good performance, this difference should average less than two.
Physical Disk\Avg. Disk sec/read
Avg. Disk sec/read is the average time, in seconds, of a data read from the disk.
40
Managing the Windows Server Platform
Disk Performance
Notes
Physical Disk\Disk read bytes/sec
Disk read bytes/sec is the rate at which bytes are transferred from the disk during read operations.
Physical Disk\Disk write bytes/sec
Disk write bytes/sec is the rate at which bytes are transferred to the disk during write operations.
Physical Disk\Disk read/sec
Disk read/sec is the rate of read operations on the disk.
Physical Disk\Disk write/sec
Disk write/sec is the rate of write operations on the disk.
5. Fifteen is the default sampling interval. You can modify this number. Increasing the interval will reduce the size of the log file but at the risk of losing data. Decreasing the interval will increase the size of the log file and provide a more detailed look at the performance. 6. On the Log Files tab, click the Log File Type drop-down box and select the output format. Choose a CSV file type if you want to be able to manipulate the data in Excel. The data can also be written to an SQL database format. 7. Make sure the End File Names checkbox is checked. Use the year, month, and day format yyyymmdd. 8. On the Schedule tab, click the Start Log At checkbox, and enter the start time for logging. 9. Click the Stop Log At checkbox and enter the time at which logging should stop. 10. Click Apply, and then click OK. The log files will be created in <system drive>\Perflogs by default. The log is activated and will have a green status, indicating that it is logging information based on the configuration and schedule. Dependencies ●
You must be a member of the administrators group or the performance log users group on the local computer, or have been delegated the appropriate authority.
●
There must be adequate space on the disk where the log files are being created.
Technology Required System Monitor
File Service Product Operations Guide
41
Task: Capture service usage statistics Purpose During the normal operation of a file server, it is important to monitor service usage. Service usage differs from service performance by focusing on how users consume file server resources. This information will be used to review general performance, adherence to SLAs, and capacity planning and to create a baseline for the file server.
Procedure: Create performance monitor logs 1. Start System Monitor. 2. Double-click Performance Logs and Alerts, right-click Counter Logs, and select New Settings. 3. Enter the name for this log, such as "Service Performance Statistics," and click OK. 4. On the General tab, click Add Counters and select the following counters: Logical Disk Performance
Notes
Logical Disk\% Free Space
% Free Space is the percentage of total usable space that was free on the selected logical disk drive.
Logical Disk\Current Disk Queue Length
Current Disk Queue Length is the number of requests outstanding on the disk at the time the performance data is collected. It also includes requests in service at the time of the collection. This is an instantaneous snapshot, not an average over time interval. Multi-spindle disk devices can have multiple requests that are active at one time, but other concurrent requests are awaiting service. This counter might reflect a transitory high or low queue length, but if there is a sustained load on the disk drive, it is likely that this will be consistently high. This counter requests experience delays proportional to the length of this queue minus the number of spindles on the disks. For good performance, this difference should average less than two.
Logical Disk\Avg. Disk sec/read
Avg. Disk sec/read is the average time, in seconds, of a data read from the disk.
Logical Disk\Avg. Disk sec/write
Avg. Disk sec/write is the average time, in seconds, of a data write to the disk.
Logical Disk\Disk read bytes/sec
Disk read bytes/sec is the rate at which bytes are transferred from the disk during read operations.
Logical Disk\Disk write bytes/sec
Disk write bytes/sec is the rate at which bytes are transferred to the disk during write operations.
42
Managing the Windows Server Platform
Logical Disk Performance
Notes
Logical Disk\Disk read/sec
Disk read/sec is the rate of read operations on the disk.
Logical Disk\Disk write/sec
Disk write/sec is the rate of write operations on the disk.
Network Performance
Notes
Server\Server Sessions
The number of sessions currently active in the server. This value indicates current server activity.
Server\Bytes Total/sec
The number of bytes the server has sent to and received from the network. This value provides an overall indication of how busy the server is.
Server\Files Open
The number of files currently opened in the server. This value indicates current server activity.
Volume Shadow Copy Service Performance
Notes
Shadow Copies\% Disk Used by Diff Area File
Size of all diff area files on the input volume divided by volume.
Shadow Copies\Allocated Space(MB)
Space used in the shadow storage volume for all the shadow copies of the input volume.
Shadow Copies\Nb of Shadow Copies
Number of shadow copies of a volume.
Shadow Copies\Used Space
Space used in the shadow storage volume for all the shadow copies of the input volume.
Shadow Copies\Nb of Diff Area Files
Total number of diff area files on a volume. This value is the same as the total number of shadow copies on the system whose shadow storage is configured on the input volume.
Shadow Copies\Size of Diff Area Files
Size of all diff area files on the input volume.
File Service Product Operations Guide
43
5. Fifteen is the default sampling interval. You can modify this number. Increasing the interval will reduce the size of the log file but at the risk of losing data. Decreasing the interval will increase the size of the log file and provide a more detailed look at the performance. 6. On the Log Files tab, click the Log File Type drop-down box and select the output format. Choose a CSV file type if you want to be able to manipulate the data in Excel. The data can also be sent to a SQL database format. 7. Make sure the End File Names checkbox is checked. Use the year, month, and day format yyyymmdd. 8. On the Schedule tab, click the Start Log At checkbox, and enter the start time for logging. 9. Click the Stop Log At checkbox and enter the time at which logging should stop. 10. Click Apply, and then click OK. The log files will be created in <system drive>\Perflogs by default. The log is activated and will have a green status indicating that it is logging information based on the configuration and schedule. Dependencies ●
You must be a member of the administrators group or the performance log users group on the local computer, or have been delegated the appropriate authority.
●
Adequate space on the disk where the log files are being created.
●
Run Volperf.exe from the Windows Server 2003 Resource Kit to enable Volume Shadow Copy service performance counters.
Technology Required ●
System Monitor
●
Volperf.exe
44
Managing the Windows Server Platform
Operating Quadrant
Service Monitoring and Control SMF
Infrastructure and Operations Role Clusters
Daily
Process: Perform monitoring Description Monitoring is concerned with the real-time recording of critical data values on an ongoing basis. The aim of recording critical data values is to ensure that adequate management information is available in order to maintain a service or services at agreed-on levels of service performance or, or at a minimum, to be recovered quickly.
Task: Review quota levels Purpose Monitor quota levels on volumes and notify users when the volumes have exceeded assigned warning levels and quota limits.
Procedure 1: View quota events in event log 1. Start Event Viewer. 2. Right-click System, point to View, and click Filter. Use the following filter configuration: Event Source: NTFS From: Events On To: Events On Note Use a consistent 24-hour period for reporting quota information.
3. Sort the list by event. When a user exceeds his or her quota limit, Event 37 will be logged to the file. The user field will point to the user who has exceeded his or her quota threshold. The description field will point to the volume where the threshold was assigned. 4. Note the user and volume where the quota threshold was exceeded. You can record this information in a program such as Microsoft Excel.
File Service Product Operations Guide
45
Procedure 2: Viewing quotas The user interface (UI) can be used to view quota entries on a volume. 1. In Windows Explorer, click My Computer, right-click a volume, and then click Properties. 2. In the Properties dialog box, click the Quota tab. 3. On the Quota tab, click Quota Entries. 4. Click the Status column to sort by status. 5. For each user who has exceeded a quota threshold, record the following information in the spreadsheet created in Procedure 1, Step 4: Amount Used Quota Limit Warning Level Percent Used Server and Volume where quota has been assigned
Procedure 3: Notify users that quota thresholds have been exceeded For each user identified in Procedures 1 and 2, send an e-mail message notifying the user that he or she has exceeded the warning level or quota limit. Based on your operations environment, recommend steps to rectify the quota. Some options for resolving this situation are: ●
Delete non-business-essential data from the volume.
●
Request an increase in quota limit.
Dependencies ●
Quotas enabled on volume.
●
Logging events to event log has been selected for exceeding warning levels and quota limits.
Technology Suggested Microsoft Excel
46
Managing the Windows Server Platform
Changing Quadrant
Configuration Management SMF
Infrastructure Role Cluster
Monthly
Process: Reviewing configuration items Description Because the accuracy of the information stored in the configuration management database (CMDB) is crucial to the success of Change Management, Incident Management, and other SMFs, a review process should be established to ensure that the database accurately reflects the production IT environment.
Task: Compliance check—verify that shares are created in the proper location Purpose This task ensures that shares created on file servers are in compliance with organization standards for the location of file shares.
Procedure 1: Create server share report 1. Create a custom MMC and add the Shared Folder snap-in. 2. On the Actions menu, choose Export List to copy this information to a text file. 3. To automate the procedure, the following sample script can be used to create a report of the folder shared on a file server and the path: strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colShares = objWMIService.ExecQuery("Select * from Win32_Share") For each objShare in colShares cscript.Echo "AllowMaximum: " & vbTab & objShare.AllowMaximum cscript.Echo "Caption: " & vbTab & objShare.Caption cscript.Echo "MaximumAllowed: " & vbTab & objShare.MaximumAllowed cscript.Echo "Name: " & vbTab & objShare.Name cscript.Echo "Path: " & vbTab & objShare.Path cscript.Echo "Type: " & vbTab & objShare.Type Next
Procedure 2: Verify shared folders against shared folder location standard 1. Compare the path of the shared folder to the organization’s standard for shared folder creation in the CMDB. 2. If there are any discrepancies in the shared folders report and the CMDB, submit an emergency RFC CAB/EC. Dependencies CMDB Technology Required Windows Management Instrumentation (WMI)
File Service Product Operations Guide
Supporting Quadrant
Problem Management SMF
47
Operations Role Cluster
Daily
Process: Problem recording and classification Description This process deals with the recording and classification of a problem, which can originate from a variety of sources and media. Problems may be reported through the incident management process or as a result of analysis from the data collected by the problem management team. Additionally, other SMF teams, such as availability management and capacity management, might detect problems and pass this information to the problem management team. It is important that all problems be linked to existing incidents and that each problem be recorded in order to prioritize its resolution. Once a problem has been recorded, it is assessed against the business impact of the problem and the urgency of the required solution. This assessment determines the problem classification.
Task: Review daily problem management report Purpose Ensure that the appropriate resources and priority levels have been assigned to current problems. The report should include the status of any problems from the previous day or any that occurred overnight.
Procedure 1: Check file server status The status of each file server should be included in this report. This information could include: ●
Whether the file server is online.
●
Whether there any approved RFCs pending.
●
Status of last backup.
●
Confirmation that the performance monitor log from the previous day exists for the server.
●
Current capacity for storage disk.
●
Status of DFS links.
Procedure 2: Review problems transferred from incident management Review each incident that has been transferred to the problem management team.
48
Managing the Windows Server Platform
Procedure 3: Prioritize and assign Based on the information received on the status of the file server and any problems transferred from incident management, set the priority of each problem and assign the appropriate team members. Dependencies File server monitoring Technology Required None
File Service Product Operations Guide
Supporting Quadrant
Incident Management Control SMF
49
Supporting Role Cluster
Weekly
Process: Investigation and diagnosis Description This process deals with investigating an incident and gathering diagnostic data. Its aim is to identify how the incident can be resolved as quickly as possible. The process allows for management escalation or functional escalation if either becomes necessary in order to meet SLA targets.
Task: Create weekly service activity report Purpose This task provides a high-level report on a service request from the perspective of when it was opened, when it was closed, and how long it took to resolve. The organization may have an SLA on the time it takes a customer to receive a response from the incident management team once an incident has been reported. Managers and leads can use such data to better balance the workload of the incident management team. Management can also use the service activity report to measure the effectiveness and efficiency of the incident management staff itself. This information is important to the members of the incident management team because it shows how long cases have been open. This helps to determine which cases must be addressed next. The following is an example of some of the information that can be included in the activity report: ●
Total number of cases opened.
●
Total number of cases closed.
●
Number of cases closed on first contact with the incident management team.
●
Number of days a case has been open.
50
Managing the Windows Server Platform
Procedure: Create report metrics The method used to collect the data is dependent on the features of an organization’s incident tracking solution. But however the organization collects the data, it should include the following information: ●
Total number of cases opened. This metric is collected for individual members of the team as well as for the whole team. It highlights the volume of incidents being opened regarding file services. When this metric is compared to metrics showing how many cases have been closed, how long it took to close them, and how many of them were closed on first contact, it helps the team to assess its overall effectiveness.
●
Total number of cases closed. This metric is collected for individual members of the team as well as for the whole team. It highlights the volume of incidents being closed regarding file services. This metric is critical when evaluating the progress of the incident management team. Open cases that must be carried over to another week require additional incident management from the case owner.
●
Number of cases closed on first contact with the incident management team. This metric is collected as the total for the team. It enables the incident management team to determine the effectiveness and efficiency of the incident management process and can directly impact customer satisfaction. When cases are closed on the first call, it reduces the number of cases incident management team members have to manage.
●
Number of days a case has been open. This metric is collected for individual members of the team as well as for the whole team. Cases that remain open for extended periods have a negative impact on customer satisfaction. The incident manager can use this metric to identify possible areas in which the incident management team may require training or education. In addition, cases that remain open for long periods may be better handled by the problem management team. It is important to identify these types of cases and to provide the incident owner with additional resources or to escalate the issue to the problem management team.
Dependencies ●
Incident ticketing system.
●
Incidents are responded to on a daily basis.
●
An SLA on how an incident is handled and when an incident is escalated to the problem management team.
Technology Required ●
Third-party tools are available that provide incident management ticketing functionality.
●
Reports can be built from an Access or SQL Server database.
File Service Product Operations Guide
Supporting Quadrant
Incident Management SMF
51
Operations Role Cluster
Monthly
Process: Incident closure Description This process ensures that the customer is satisfied that the incident has been resolved prior to closing the incident record. Incident closure also checks that the incident record is fully updated and assigns a closure category.
Task: Roll up activity report into monthly metric Purpose This task provides metrics to assist in planning staffing levels and checking the incident management function against other SMFs. These reports can be used by those involved with other SMFs (such as Service Level Management, Financial Management, and Workforce Management) as well as by members of the six MOF Team Model role clusters.
Procedure: Create monthly metric This task should produce a report showing the cost of incident management and indicating where resources should be allocated to optimize its performance. ●
Percent closed incidents. This metric is created by taking the total number of cases closed for a month and dividing it by the number of cases opened for the month.
●
Percent incidents closed on first contact. This metric is created by taking the total number of cases closed on first contact and dividing it by the number of cases opened for the month.
●
Mean time to resolution. This metric measures the effectiveness of the incident management process. It is calculated by taking the total time spent on incident resolution and dividing it by the total number of cases closed. SLAs can be compared to this metric
The numbers reported should then be used to evaluate the incident management process and to determine how effectiveness and efficiency can be improved. Dependencies ●
Respond to daily service request.
●
Weekly service request activity report.
Technology Required None
52
Managing the Windows Server Platform
Optimizing Quadrant
Capacity Management SMF
Infrastructure Role Cluster
Weekly
Process: Managing resources and service performance Description Capacity management is concerned with optimizing the use of IT resources in order to achieve the level of service performance agreed upon with the client. These resources are supplied by support organizations to ensure that the requirements of the business are met. The capacity management process can be either reactive or proactive. Iterative activities, such as monitoring, analyzing, tuning, and reporting, are also important in the process of managing resources and service performance. Each requires different types of data. For example, managing IT resources involves documenting the usage levels of individual components in the infrastructure, whereas managing service performance records transaction throughput rates and response times.
Task: Captures size of DFS namespace Purpose This task captures the size of the DFS namespace for an organization and reports to the problem management team those DFS roots that are approaching namespace size limits.
Procedure 1: Create DFS namespace report Windows Server 2003 Support Tools include the Dfsutil.exe which can be used to capture the size of the Windows Server 2003 DFS namespace and mixed mode domain DFS namespace. The following command will export the links: Dfsutil /Root:\\dfsname\root /Export: where drive path is the path to the folder where the report will be stored, and filename is the name of the file that will contain the report.
Procedure 2: Automate DFS namespace report This capture process can be automated using Windows shell scripting. The following is a simple command that can read as an input file. Each line of the input file lists a domain DFS root: for /f %%i in (input.txt) do dfsutil.exe /view:%%i > where filename is the name of the file that will contain the report.
File Service Product Operations Guide
53
Procedure 2: Review size of DFS namespace ●
Compare the DFS namespace size with the following limits on DFS namespace: ●
The maximum size of a single domain DFS namespace is 5 MB of metadata.
●
A stand-alone DFS can have as many as 50,000 links.
Dependencies Windows Server 2003 Resource Kit installed on server running Dfsutil. Technology Required ●
Dfsutil.exe
●
Windows Script Host
54
Managing the Windows Server Platform
Optimizing Quadrant
Capacity Management SMF
Operations and Infrastructure Role Clusters
Monthly
Process: Managing resources and service performance Description Capacity management is concerned with optimizing the use of IT resources in order to achieve the level of service performance agreed upon with the client. These resources are supplied by support organizations to ensure that the requirements of the business are met. The capacity management process can be either reactive or proactive. Iterative activities, such as monitoring, analyzing, tuning, and reporting, are also important in the process of managing resources and service performance. Each requires different types of data. For example, managing IT resources involves documenting the usage levels of individual components in the infrastructure, whereas managing service performance records transaction throughput rates and response times.
Task: Create quota report Purpose Managing disk space consumption is vital to providing file services to customers. The disk quota support feature in Windows Server 2003 provides a way to manage quotas on a volume. Once quotas have been set on a volume, monitoring and reporting quota usage should be part of the regular server maintenance schedule.
Procedure 1: Creating quota reports using Fsutil Windows Server 2003 comes with command line utilities that can be used to gather information on the file system. Fsutil.exe can be used to query a volume for quota entries. To obtain quota information for volumes on a server, Fsutil must be run for each volume on a file server. From a command prompt, type: fsutil quota query >filename.txt where volume path is the path to the volume you want to query and filename is the name of the file that will contain the report. The report will contain quota information regarding the volume path entered. From the report you can determine: ●
If quotas are being tracked on a volume.
●
If logging for quota events is enabled on a specific user's volume (SID Name).
●
How much of a quota was used.
●
Quota threshold.
File Service Product Operations Guide
●
55
Quota limit.
Procedure 2: Create a quota report using Windows Script Host The following sample script uses Windows Script Host to create a disk quota usage report. The Script is saved as a .vbs file and run from the command line. The output may be redirected to a CSV file for reporting. strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colQuotas = objWMIService.ExecQuery _ ("Select * from Win32_DiskQuota") For each objQuota in colQuotas cscript.Echo "Volume,User,Disk Space Used,aLimit,Status,Warning Limit" cscript.Echo objQuota.QuotaVolume & “,” & objQuota.User & “,” & objQuota.DiskSpaceUsed & “,“ & objQuota.Limit & “,” & objQuota.Status & “,” & objQuota.WarningLimit Next
When you view the quota status, there are three levels that can be reported: 0 (below quota warning level), 1 (above quota warning level), 2 (above quota limit). Dependencies ●
Quotas set on a volume.
●
Log event when a user exceeds his or her quota limit is checked.
●
Log event when a user exceeds his or her warning level is checked.
Technology Required ●
Fsutil.exe
●
Windows Script Host
Task: Create a service performance and usage report Purpose This task converts the performance service data into a report that can be used to support decision making.
Procedure 1: Calculate daily statistics 1. Import performance logs into Excel. 2. Calculate the daily average for each counter collected in the log. 3. In a new worksheet, record the daily average of the counters for each day of the month. 4. Use Excel’s graphing feature to create visuals that illustrate trends in performance. For clarity, it may be easier to calculate the daily statistics on a per-performance object basis. You should also consider that these reports will be used in evaluating SLAs, OLAs, and UCs.
56
Managing the Windows Server Platform
Procedure 2: Store data and reports 1. Store each month’s data in a single workbook for future reference. 2. Save the workbook to a file share on a file server that is under regular backup maintenance. Dependencies Performance logs documenting the service Technology Required Microsoft Excel or third-party spreadsheet application
Task: Create a system load and utility report Purpose Convert the file server resources usage data into a report that can be used to support decision making and resource allocation.
Procedure 1: Calculate daily statistics 1. Import service usage performance logs into Excel. 2. Calculate the daily average for each counter collected in the log. 3. In a new worksheet, record the daily average of the counters for each day of the month. 4. Use Excel’s graphing feature to create visuals that illustrate trends in performance. For clarity it may be easier to calculate the daily statistics on a per-performance object basis. You should create the following reports: ●
Logical disk usage report
●
Network usage report
●
Volume Shadow Copy service usage
Procedure 2: Store data and reports 1. Store each month’s data in a single workbook for future reference. 2. Save the workbook to a file share on a file server that is under regular backup maintenance. Dependencies Performance logs documented on file servers Technology Required Microsoft Excel or third-party spreadsheet application
File Service Product Operations Guide
Operating Quadrant
Directory Services Administration SMF
57
Operations Role Cluster
Daily
Process: Managing the directory Description Managing directory services involves the day-to-day process of providing for the safety, security, and functional operation of software and hardware components. Ensuring the safety and security of the hardware and software components is a critical issue and is covered in great detail in the MOF security document.
Task: Check status of DFS Purpose An implementation of Distributed File System (DFS) in an organization can contain multiple DFS roots, links, and target servers. It is important to understand the status of the DFS environment and report the status on a daily basis.
Procedure 1: View DFS status 1. Start DFS management console. 2. Check the status for each DFS root and link. DFS roots and links can have the following status: ●
A blue check mark on the root or link indicates that the root or link can be reached, as well as all of the targets.
●
A yellow exclamation point on the root or link indicates that the root or link can be reached but that not all of the targets may be reachable, either because DFS referral is disabled on the target or there is some other problem preventing access to the target.
●
A red cross on the root or link indicates that the root or link cannot be reached.
When you check the status of the target server, it will be either online or offline. Offline indicates that the target cannot be reached. 3. Right-click the target, and click Status. When you check the status of the target server, it will be either online or offline. Offline indicates that the target cannot be reached.
58
Managing the Windows Server Platform
Procedure 2: Check status of server These steps should be followed when the status of a DFS root server or a target server is reported as offline. 1. Run the PING utility from the command line or attempt connection using Terminal Service, or mounting an administrative share such as C$, to verify that the offline server can receive network communication. If this test fails, escalate the issue to the problem management team to get the server online. 2. Run Srvinfo.exe using the following command to make sure all the proper services are running srvinfo\\<servername>, where servername is the server reported as offline. 3. Log on to the server locally or over the network. Verify that you can log on to the server.
Procedure 3: Check DFS replication status for DFS roots having multiple targets (domain DFS) If you have configured domain DFS roots and have configured links with replicas, follow these steps to ensure that replication is enabled on the target replicas, since File Replication Services (FRS) handles replication of domain DFS. FRS causes high replication traffic and must be carefully scheduled to occur only during times of low network utilization. 1. Start the DFS management console. 2. Highlight the links that have been enabled for replication. A blue circular icon will be over links that have been enabled for replication. 3. Click Action and choose Show Replication Information. This will add a column in the right pane called File Replication. This will inform you if replication is enabled for this link. 4. To check the replication schedule, highlight the link, and click Properties. Dependencies ●
Domain DFS roots configured in the enterprise.
●
Links with multiple targets have been configured to replicate.
Technology Required ●
DFS MMC
●
Srvinfo.exe
File Service Product Operations Guide
Supporting Quadrant
Incident Management SMF
59
Support Role Cluster
Daily
Process: Investigation and diagnosis Description This process deals with investigating incidents and gathering diagnostic data. Its aim is to identify how an incident can be resolved as quickly as possible. The process allows for management escalation or functional escalation if either becomes necessary in order to meet SLA targets.
Task: Respond to daily service request Purpose Make sure all incidents are answered and there is an incident owner responsible for the incident life cycle. This serves the organization in two ways: ●
Customers understand that when an incident is reported, they will receive confirmation that someone from the incident management team has reviewed the request. This ensures that customers will continue to use the incident support channel set up in the organization.
●
Each incident has an owner responsible for collecting background information and doing preliminary troubleshooting. The owner is responsible for contacting other technical specialists to assist the customer in resolving the incident, documenting the incident, and making sure contributing technicians add their comments to the incident request. This ensures that there is a single point of contact for the incident from both the customer's and the organization's perspective.
Procedure 1: Acknowledge receipt of service request 1. Send the customer e-mail confirming receipt of an incident request. 2. Give the customer an incident case number prior to collecting data and troubleshooting the incident.
60
Managing the Windows Server Platform
Procedure 2: Document incident ●
Document the problem, the system affected, actions taken to troubleshoot the problem, and the plan to resolve the incident. The following are systems that can be affected in a file server environment: ●
File server
●
Share
●
Permissions
●
DFS
●
File Replication Services (FRS)
●
Volume Shadow Copy service
●
Disk capacity
Procedure 3: Update customer on status of incident ●
Send the customer e-mail, confirming the problem, system affected, actions taken to troubleshoot the problem, and the current plan to resolve the incident. If another technician is involved in troubleshooting, make sure the technician's notes are included as part of the case documentation.
Procedure 4: Close incident ●
If the incident is not resolved following the customer’s initial request for incident management, follow up with the customer and other technicians until the incident is resolved.
Dependencies ●
Incident ticketing system.
●
An SLA on the means that customers can use to request incident management— for example, through e-mail or a service phone number.
Technology Required ●
There are third-party tools that provide incident management ticketing functionality.
●
A Microsoft Access or SQL Server™ database can also be used to create incident tickets.
File Service Product Operations Guide
Changing Quadrant
Change Management SMF
61
Infrastructure Role Cluster
Daily
Process: Change classification and authorization Description After an RFC has passed the initial screening, the change manager must classify and authorize the RFC. The category assigned to the RFC is a reflection of the impact the change is likely to have on the IT environment. The priority level set for an RFC is a reflection of its urgency, and it determines how quickly the change advisory board (CAB) will review it. There are four change categories: minor, standard, significant, and major. There are also four categories of priority: low, medium, high, and emergency. Once an RFC has been classified, it must be authorized. The process of authorizing a change request depends on the category and priority of the change: ●
Emergency priority changes are escalated to the CAB/EC for fast-track approval.
●
Standard changes are approved automatically and progress directly to the change development and release phases.
●
Minor changes can be approved by the change manager without reference to the CAB.
●
All other changes must be approved by the CAB.
The two tasks that follow—attending a CAB meeting and reviewing an emergency change request—are among several tasks that would be associated with classification and authorization. Attending a CAB meeting is singled out because it is common to much of the change process. Reviewing an emergency change request is singled out because emergency changes typically involve high risk and require a great outlay of time and resources. More information about the other tasks, and about the change management process in general, is available at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/ms m/smf/smfchgmg.asp.
Task: Attend CAB meeting Purpose The CAB meets to review significant and major changes to the operations environment. From a file service perspective, change requests involving disk capacity, replication, and registry modifications, as well as updating antivirus software or adding a new file server to the environment, can be evaluated at this weekly meeting.
62
Managing the Windows Server Platform
It's important for a representative of the Infrastructure Role Cluster to attend the meeting in order to participate in the change management process. Participating in the process could include providing additional data regarding a particular file service RFC that members of the CAB may not have available to them. Additionally, it is important to be informed about other RFCs that may have an indirect effect on the delivery of file services and to consider these effects when approving an RFC for change development.
Procedure: Attend change review board meeting 1. Regularly attend the CAB meeting. 2. Consider the effect that any RFC may have on file service configuration items: ●
File server hardware
●
Domain controller hardware
●
Hardware vendor
●
Server role (file server or domain controller?)
●
Windows Server 2003 software
●
Service packs
●
Hotfixes
●
Antivirus software
●
Monitoring software
●
Backup software
●
Processes and procedures
●
Documentation
Dependencies ●
A process must be established to initiate a change request in the operations environment.
●
An identified CAB.
Technology Required Operations team educated about MOF/ITIL.
Task: Review emergency change request Purpose Provide guidance to the change advisory board emergency committee (CAB/EC) on processing an emergency RFC. The number of emergency change requests should be kept to a minimum because they typically involve high risk and require a great outlay of time and resources.
File Service Product Operations Guide
63
Emergency changes to file services can have a great impact on a large number of users and they can affect business processes that depend on file services. For this reason it is very import to create a change request process that emphasizes prioritizing and attending to urgent problems associated with file services. The Infrastructure Role Cluster is responsible for this task, but the request for emergency change can be initiated by any of the six Team Model role clusters. An emergency change request could involve the release of updates to the operating system, thirdparty applications, or configuration changes.
Procedure: Contact CAB/EC 1. Confirm that the server has a successful server backup before contacting the CAB/EC members. 2. Select CAB/EC members. This should include standing members of the CAB as well as those members who can give the greatest guidance to file services. 3. Notify the CAB/EC of the emergency change request. Each member of the CAB/EC identified in Step 2 must be notified of the emergency change request. It is important that every attempt be made to contact each member of the CAB/EC either by e-mail, mobile device, or other communication methods. The member should be given an expected time in which to respond to the emergency change request and general information about the change request. 4. Review the RFC. Collect all information pertaining to changes to file services including asking for additional information from the change initiator. The CAB/EC should consider the impact that the change has on file services and weigh the risk associated with making an emergency change to the file system versus making a standard change. The type of change that could be made include: ●
Applying service packs.
●
Adding a new file server.
●
Adding a new DFS root.
●
Adding new partitions.
●
Adding new disks.
●
Adjusting quota setting above policy.
●
Modifying Volume Shadow Copy service schedule.
●
Changing backup and restore procedures.
●
Modifying and applying policies.
●
Changing other existing settings.
●
Changing a process or script used to administer servers.
64
Managing the Windows Server Platform
Along with change type, collect the configuration item that will be affected by the change. Configuration items are objects that are subject to change. Any item that has the possibility of changing falls under change management. For file servers, these items include: ●
File server hardware
●
Domain controller hardware
●
Hardware vendor
●
Server role (file server or domain controller?)
●
Windows Server 2003 software
●
Service packs
●
Hotfixes
●
Antivirus software
●
Monitoring software
●
Backup software
●
Processes and procedures
●
Documentation
●
RFCs
Dependencies ●
A process must be established to initiate a change request in the operational environment.
●
An identified CAB/EC roster and individuals who are contacted for emergency changes as they relate to file services.
Technology Required Operations team educated about MOF/ITIL.
File Service Product Operations Guide
Changing Quadrant
Configuration Management SMF
65
Infrastructure Role Cluster
Weekly
Process: Reviewing configuration items Description Because the accuracy of the information stored in the configuration management database (CMDB) is crucial to the success of Change Management, Incident Management, and other SMFs, a review process should be set up to ensure that the database accurately reflects the production IT environment.
Task: Capture configuration snapshot Purpose This task configures the file server to provide a point-in-time view of the file server.
Procedure 1: Run Srvinfo for all file servers To get system information, shared folders, disk capacity, services currently running, network protocols, and system uptime use Srvinfo.exe. At the command line run: srvinfo –s \\<servername .>:\servername-date.txt Srvinfo is scriptable and can be easily automated to facilitate batch processing for large environments.
Procedure 2: Export local security polices 1. Start Local Security Policies MMC and expand the Local Policies node. 2. Highlight Audit Policy, then right-click and select Export List. Save the export to a secure file share. 3. Highlight User Right Assignment, then right-click and select Export List. Save the export to a secure file share. 4. Highlight Security Options, then right-click and select Export List. Save the export to a secure file share.
66
Managing the Windows Server Platform
Procedure 3: Create report of installed software The following sample script can be used to create a report of the software installed on the file server using Windows Installer. SMS is a good alternative to enumerate installed applications, window components, and patches. This is especially useful for large in environments.
Set objFSO = CreateObject("Scripting.FileSystemObject") Set objTextFile = objFSO.CreateTextFile("filename", True) strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colSoftware = objWMIService.ExecQuery _ ("Select * from Win32_Product") objTextFile.WriteLine "Caption" & vbtab & _ "Description" & vbtab & "Identifying Number" & vbtab & _ "Install Date" & vbtab & "Install Location" & vbtab & _ "Install State" & vbtab & "Name" & vbtab & _ "Package Cache" & vbtab & "SKU Number" & vbtab & "Vendor" & vbtab _ & "Version" For Each objSoftware in colSoftware objTextFile.WriteLine objSoftware.Caption & vbtab & _ objSoftware.Description & vbtab & _ objSoftware.IdentifyingNumber & vbtab & _ objSoftware.InstallDate2 & vbtab & _ objSoftware.InstallLocation & vbtab & _ objSoftware.InstallState & vbtab & _ objSoftware.Name & vbtab & _ objSoftware.PackageCache & vbtab & _ objSoftware.SKUNumber & vbtab & _ objSoftware.Vendor & vbtab & _ objSoftware.Version Next objTextFile.Close
This sample script may produce an error if there are no MSI installed applications.
Procedure 4: Create report of installed hotfixes The following sample script can be used to create a report of the software installed on the file server using the Windows Installer: strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colQuickFixes = objWMIService.ExecQuery _ ("Select * from Win32_QuickFixEngineering") For Each objQuickFix in colQuickFixes cscript.Echo "Computer: " & objQuickFix.CSName cscript.Echo "Description: " & objQuickFix.Description cscript.Echo "Hot Fix ID: " & objQuickFix.HotFixID cscript.Echo "Installation Date: " & objQuickFix.InstallDate cscript.Echo "Installed By: " & objQuickFix.InstalledBy Next
Dependencies MSI installed software
File Service Product Operations Guide
Technology Required ●
Srvinfo.exe
●
Local security policies
●
Windows Management Instrumentation (WMI)
67
4 Processes by MOF Role Clusters This chapter is designed for those who want to see all processes for a single role cluster in one place. The information is the same as that in the previous two chapters. The only difference is that the processes are ordered by MOF role cluster.
Operations Role Cluster Daily Processes Process 1: Problem recording and classification Task: Review daily problem management report Process 2: Managing resources and service performance Task 1: Capture service performance statistics Task 2: Capture service usage statistics Weekly Processes Process 1: Incident closure Task: Roll up activity report into monthly metric Process 2: Design for recovery Task: Update automated system recovery (ASR) backup Monthly Processes Process: Managing resources and service performance Task 1: Create quota report Task 2: Create a quota report using WMI Task 3: Create system performance and usage report Quarterly Processes Process: Data backup, restore, and recovery operations
File Service Product Operations Guide
69
Task: Verify restore As-Needed Processes Process: Data backup, restore, and recovery operations Task: Verify restore
Support Role Cluster Daily Processes Process 1: Data backup, restore, and recovery operations Task: Run daily incremental backup Process 2: Investigation and diagnosis Task: Respond to daily service request Weekly Processes Process 1: Investigation and diagnosis Task: Create weekly service activity report Process 2: Data backup, restore, and recovery operations Task: Run weekly normal backup Monthly Processes There are no monthly processes for this role cluster. As-Needed Processes There are no as-needed processes for this role cluster.
Release Role Cluster Daily Processes There are no daily processes for this role cluster. Weekly Processes There are no weekly processes for this role cluster. Monthly Processes There are no monthly processes for this role cluster. As-Needed Processes There are no as-needed processes for this role cluster.
70
Managing the Windows Server Platform
Infrastructure Role Cluster Daily Processes Process 1: Maintaining the directory Task: Back up DFS namespace configuration Process 2: Storage resource management Task: Monitor available disk space Process 3: Maintaining the directory Task: Back up DFS namespace configuration Process 3: Perform monitoring Task 1: Review quota levels Task 2: Verify previous day's backup job Process 4: Change classification Task: Review emergency change request Weekly Processes Process 1: Storage resource management Task: Review disk fragmentation Process 2: Managing resources and service performance Task: Capture size of DFS namespace Process 3: Change classification and authorization Task: Attend change management review board meeting Process 4: Reviewing configuration items Task: Capture configuration snapshot Monthly Processes Process: Managing resources and service performance Task 1: Create a quota report Task 2: Create a service performance and usage report Task 3: Create a system load and utility report As-Needed Processes There are no as-needed processes for this role cluster.
File Service Product Operations Guide
71
Security Role Cluster Daily Processes There are no daily processes for this role cluster. Weekly Processes There are no weekly processes for this role cluster. Monthly Processes There are no monthly processes for this role cluster. As-Needed Processes There are no as-needed processes for this role cluster.
Partner Role Cluster Daily Processes There are no daily processes for this role cluster. Weekly Processes There are no weekly processes for this role cluster. Monthly Processes There are no monthly processes for this role cluster. As-Needed Processes There are no as-needed processes for this role cluster.
5 Troubleshooting Overview The following table contains troubleshooting tips that should be useful in maintaining this product. The tips are based on known issues and follow the best practices for troubleshooting and problem management outlined by the Incident Management and Problem Management SMFs, both of which are found in the MOF Supporting Quadrant.
Problem #1: “Path not found” or empty folder Description of Problem When you work with a DFS shared folder, you may receive a “Path Not found” error message or you may see an empty folder. This may happen when you try to do the following: ●
Try to open a file in a DFS shared folder.
●
Try to find a file in a DFS shared folder. Cause of Problem
This problem occurs when the DFS link portion of the path contains more than one long path element, and at least one long path element is referred to by the short pathname equivalent. Resolution of Problem There are two ways to resolve this problem: ●
Always use long path names when you work with shared folders that are under DFS links containing long path elements.
●
Use short path elements only when you create DFS links.
File Service Product Operations Guide
73
Problem #2: Slow connection time Description of Problem When you use DFS, your clients might take a long time to be connected to one of the DFS servers. This can occur under the following conditions: ●
The site the client is in does not have a DFS server for the volume in question.
●
Your network is not fully routed.
●
The client is not site-aware. Cause of Problem
This problem is caused when the DFS referral server provides a list of servers to the client. If there is no DFS server with this volume in the site of the client, the list is sorted randomly. The client walks this list until it finds the first accessible server. If the percentage of unreachable servers is high and there are many servers, finding the first working server can take several minutes. Resolution of Problem Several methods can be used to resolve this problem: ●
Use a user account from the local domain to log on. A local DFS server should be found for the policy access.
●
Install DFS servers in the location where the logon is made.
●
Extend the network to be fully routed. Note: this may be very expensive.
●
If no access to local data is required, the users can log on to terminal servers in locations where a DFS server with the desired volume is located.
74
Managing the Windows Server Platform
Problem #3: How to troubleshoot FRS-enabled DFS directories Description of Problem These are generic steps that can be used to troubleshoot File Replication Services (FRS)-enabled DFS directories. Resolution of Problem 1.
Verify Microsoft Active Directory® directory service replication. Active Directory replication must be fully functional between hub and spoke data centers by running repadmin/showreps against all computers in the hub and branch sites. Pipe the output so you can identify the tool and computer being targeted. Do not proceed until Active Directory is functional.
2.
Verify FRS dependencies
3.
Run Ntfrsutl ds against all hub and branch data centers. In this step, you are looking for missing FRS objects or attributes—including FRS member, FRS subscriber, and ServerRef. Compare Ntfrsutl output to a working computer until you are sure what to look for.
4.
Verify replication topology and schedule
5.
Verify that all computers are included in the replication topology (compare against a reference list to see that computers deployed in the field are known in the data center This information should be contained in the configuration management database (CMDB).
6.
Examine the environment for any known configurations that generate excessive replication of FRS replicated files (DFS + SYSVOL). General symptoms of this problem are: ●
The revision number for policy is constantly incrementing. In extreme cases, the number of revisions shows hundreds or even thousands of changes.
●
FRS replicated content is replicated excessively with no apparent change to the Group Policy or the files being replicated. In the case of SYSVOL, an excessive number of full syncs of policy take place for no apparent reason.
●
The number of files in the staging directory constantly grows, then empties when the replication schedule opens and replication can take place.
●
The number of files in the staging directory constantly grows but never empties if changes to downstream partners cannot be replicated either because of network connectivity or some other error condition.
●
Network traffic between replication partners is consuming excessive network bandwidth and FRS is identified as the source.
●
Excessive disk I/O until FRS service is stopped.
File Service Product Operations Guide
75
Problem #4: Using Defrag.exe on a disk that hosts FRSreplicated content Description of Problem When using the Disk Defragmenter tool (Defrag.exe) on a disk that hosts FRSreplicated content, the following symptoms may occur: ●
Files in SYSVOL and DFS shares are replicated excessively and there is no apparent change to the files.
●
File may replicate during off-peak hours, but at regularly occurring times if you schedule disk defragmentation to run during specific time or periods of low server usage.
●
The number of files in the staging folder constantly grows, and then empties after the disk defragmentation utility is completed, or the FRS schedule opens to allow replication.
●
The number of files in the staging folder constantly grows but never empties if changes to downstream partners cannot be replicated either because of network connectivity or some other error conditions.
●
Network traffic between replication partners is consuming excessive network bandwidth as a result of FRS. Resolution of Problem
1.
Search the NTFRS outbound log by using the Ntfrsutl and the iologsum.cmd (included in the Windows 2003 Support Tools).
2.
Identify the computer that is originating the excessive updates, and then use Ntfrsutl to empty the FRS outbound log. From a command prompt type: Ntfrsutl outlog>outlog.txt
3.
Use the iologsum.cmd FRS troubleshooting utility to structure the outlog file that was just created. At the command prompt, type: iologsum –sort=eventtime outlog.txt
Note Use iologsum.cmd /? to get a list of the switches to use to summarize the pending change orders.
76
Managing the Windows Server Platform
Problem #5: DFS links not visible Description of Problem When you view the DFS root in the DFS snap-in, all the DFS links are listed. However, when you connect to the DFS root share, none of the DFS links may be visible. When you browse the DFS root folder on the server, the local file system placeholders that represent the DFS links may be missing. Cause of Problem This issue can occur if the 8.3 file name creation functionality is disabled in NTFS. Resolution of Problem 1.
Start Registry Editor (Regedt32.exe).
2.
Locate the NtfsDisable8dot3NameCreation value under the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
3.
On the Edit menu, click DWORD, press 0 and then click OK.
4.
Quit Registry Editor and restart the server.
File Service Product Operations Guide
77
Problem #6: DFS root does not appear in MMC Description of Problem When you start DFS MMC, the DFS root does not appear. If you try to locate the DFS root in DFS MMC, you receive the following error message: ●
The specified domain either does not exist or could not be contacted.
●
You receive this error message if you enter the name either as a NetBIOS host name or as a fully qualified domain name (FQDN).
●
If you use the Dfscmd tool to add a DFS link, you receive the following error message: dfscmd /map \\dfsname\dfsshare\path \\server\share\path returns "System error 2662 has occurred". Cause of Problem
This problem may occur if the following registry key is set on one or all of the servers that are hosting the DFS namespace after the namespace has already been defined: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DFS Value name: DfsDnsConfig Type: REG_DWORD Value: 1 Resolution of Problem 1.
Start Registry Editor (Regedt32.exe)
2.
Locate and then click the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DFS
3.
Double-click the DfsDnsConfig value, press 0 in the Value data box, and then click OK.
4.
Quit Registry Editor.
78
Managing the Windows Server Platform
Problem #7: NTFS file system log file size bottlenecks Description of Problem These are steps to identify and troubleshoot NTFS file system log file size bottlenecks. Cause of Problem When a Windows Server 2003 file server is under a heavy load or stress, the NTFS file system log file may not flush the disk in time and, as a result, becomes full. NTFS file system operations do not continue until the log file is completely flushed to disk. Resolution of Problem 1.
Check the performance logs and alerts to view the activity of the “Current Disk Queue Length” for the appropriate PhysicalDisk object. If the performance data shows constant high disk queue length values that intermittently drop to a value of exactly one for a while and then increase again, this is an indication that the NTFS file system log file is full and must be flushed.
2.
3.
Increase the performance of the disk subsystem. ●
Install additional disks, or upgrade the existing hard disks. Update the bus and disk controllers.
●
Use striped volumes on several physical disks to increase throughput.
Increase the NTFS log file size. To do so, type the following at a command prompt: chkdsk /l:<size>
If stress on the disk subsystem continues to be high, the log file may eventually become full again. Use this method if stress on the disk system is temporary.
File Service Product Operations Guide
79
Problem #8: Excessive CPU use by Clussvc.exe or Rsrcmon.exe Description of Problem If you define hundreds of file share resources within a cluster, one or more nodes in the cluster may begin to provide reduced performance. When this occurs, Task Manager may report excessive CPU use by either the Clussvc.exe or Rsrcmon.exe processes. On some clusters, several hundred resources may consume enough overhead to impact performance. The number of total resources that a cluster may process without significant overhead varies based on the abilities of the hardware. Cause of Problem On some clusters, several hundred resources may consume enough overhead to impact performance. The number of total resources that a cluster may process without significant overhead varies based on the abilities of the hardware. Resolution of Problem The most efficient way to create many file shares on a cluster is to create sub-folder shares because this option can significantly reduce the number of resources and overhead. This option also simplifies administration and disaster recovery. If you must use individual file share resources for several hundred shares, it may be necessary to add more CPUs or memory to the server.
80
Managing the Windows Server Platform
Problem #9: "A DFS root already exists in this cluster node" Description of Problem After you use the Cluster Administrator tool to configure a file share resource as a DFS root, you may receive the following error message: Cluster Administrator Standard Extension: An error occurred attempting to set properties: A DFS root already exists in this cluster node. Error ID: 5088 (000013e0). Cause of Problem This issue can occur if a DFS root is already configured on either of the nodes and has not been deleted. DFS permits only one root per server cluster. Resolution of Problem ●
If the DFS root is not a cluster resource, in DFS Manager, right-click the root configured, and then click Delete Root.
●
If the DFS root is a cluster resource, take the resource offline, configure it to be a normal share, and then bring the resource online or delete the resource if the share is not needed.
Note To update the DFS root settings on the other nodes, move the group that contains the old DFS root to the other node.
File Service Product Operations Guide
81
Problem #10: DNS name problems Description of Problem After you log on to a Windows 2000-based computer with cached credentials and then connect to a network (either by using remote access or by re-attaching the network cable) while you attempt to connect to a domain-based DFS root, you experience the following symptoms: ●
You receive the following error messages: A duplicate name exists on the network. The network name could not be found.
●
The domain DNS name for your server and the NetBIOS name for your server may not match. For example, the DNS name may be..com, and the NetBIOS name may be .
This problem is caused by the following two conditions: ●
The domain DNS name and NetBIOS name are not the same. For example, the DNS name is..com and the NetBIOS name is ).
●
The client does not have any cached DFS information because the network was connected and initialized. The client will attempt to fill this cache every 15 minutes. To view this cache, use the DFS utility, DFSutil.exe, from the Windows Server 2003 Resource Kit. Cause of Problem
This problem is caused by the following two conditions: ●
The domain DNS name and NetBIOS name are not the same. For example, the DNS name is..com and the NetBIOS name is ).
●
The client does not have any cached DFS information because the network was connected and initialized. The client will attempt to fill this cache every 15 minutes. To view this cache, use the DFS utility, DFSutil.exe, from the Windows Server 2003 Resource Kit. Resolution of Problem
●
Make the NetBIOS and DNS name of the server the same. For example, if the DNS name is..com, then make the NetBIOS name as well.
File Service Product Operations Guide
The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.
This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), but only for the purposes provided in the express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred.
2003 Microsoft Corporation. All rights reserved. Microsoft, Active Directory, ActiveX, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
File Service Product Operations Guide
iii
Contents Introduction to Product Operations Guide........................................................................... ............1 Document Purpose................................................................................................................. .....1 Intended Audience.................................................................................................................. .....1 How to Use This Guide............................................................................................................. ...1 Background.............................................................................................................. ...................2 High-Level Processes for Maintaining Windows Server 2003 File Service.....................................5 Overview............................................................................................................. ........................5 Required Technology............................................................................................................ .......6 Maintenance Processes Checklist........................................................................................... ....7 Operating Quadrant................................................................................................ .................7 Supporting Quadrant...................................................................................................... ........11 Optimizing Quadrant.................................................................................................. ............13 Changing Quadrant............................................................................................................... .15 Detailed Maintenance Processes.............................................................................................. ....17 Overview.......................................................................................................... .........................17 Process: Data backup, restore, and recovery operations............................................. .............18 Task: Run daily incremental backup...................................................................................... .18 Process: Data backup, restore, and recovery operations............................................. .............20 Task: Run weekly normal backup.............................................................. ............................20 Process: Design for service recovery....................................................................... .................22 Task: Update automated system recovery (ASR) backup.............................................. ........22 Process: Design for service recovery....................................................................... .................24 Task: Validate ASR recovery....................................................................................... ...........24 Process: Maintaining the directory................................................................. ...........................26 Task: Back up DFS namespace configuration............................................. ..........................26 Process: Data backup, restore, and recovery operations............................................. .............27 Task: Verify previous day’s backup job........................................................ ..........................27 Process: Storage resource management................................................................ ..................30 Task: Monitor available disk space......................................................................................... 30 Process: Storage resource management................................................................ ..................33 Task: Review disk fragmentation............................................................... ............................33 Process: Data backup, restore, and recovery operations............................................. .............36 Task: Verify restore......................................................................................... .......................36 Process: Managing resources and service performance.................................................... .......37 Task: Capture service performance statistics..................................................................... ....37 Task: Capture service usage statistics...................................................................... .............41 Process: Perform monitoring....................................................................................... ..............44 Task: Review quota levels................................................................................................... ...44 Process: Reviewing configuration items....................................................................... .............46 Task: Compliance check—verify that shares are created in the proper location....................46 Process: Problem recording and classification............................................................ ..............47 Task: Review daily problem management report............................................. ......................47 Process: Investigation and diagnosis................................................................. .......................49 Task: Create weekly service activity report........................................................ ....................49 Process: Incident closure.................................................................................. ........................51 Task: Roll up activity report into monthly metric..................................................... ................51 Process: Managing resources and service performance.................................................... .......52 Task: Captures size of DFS namespace................................................................... .............52 Process: Managing resources and service performance.................................................... .......54 Task: Create quota report............................................................................. .........................54 Task: Create a service performance and usage report.................................. ........................55 Task: Create a system load and utility report..................................................... ....................56 Process: Managing the directory............................................................................... ................57
iv
Managing the Windows Server Platform
Task: Check status of DFS.................................................................................................. ...57 Process: Investigation and diagnosis................................................................. .......................59 Task: Respond to daily service request................................................................................ ..59 Process: Change classification and authorization................................................ .....................61 Task: Attend CAB meeting................................................................................. ....................61 Task: Review emergency change request.................................................... .........................62 Process: Reviewing configuration items....................................................................... .............65 Task: Capture configuration snapshot............................................................................. .......65 Processes by MOF Role Clusters.................................................................................. ...............68 Operations Role Cluster....................................................................................................... ..68 Support Role Cluster............................................................................................................. .69 Release Role Cluster................................................................................................. ............69 Infrastructure Role Cluster....................................................................................... ..............70 Security Role Cluster........................................................................................... ..................71 Partner Role Cluster....................................................................................... .......................71 Troubleshooting.................................................................................................... ........................72 Overview.......................................................................................................... .........................72 Problem #1: “Path not found” or empty folder......................................................... ...............72 Problem #2: Slow connection time................................................................................... ......73 Problem #3: How to troubleshoot FRS-enabled DFS directories...........................................74 Problem #4: Using Defrag.exe on a disk that hosts FRS-replicated content..........................75 Problem #5: DFS links not visible.................................................................... ......................76 Problem #6: DFS root does not appear in MMC.................................................... ................77 Problem #7: NTFS file system log file size bottlenecks......................................................... .78 Problem #8: Excessive CPU use by Clussvc.exe or Rsrcmon.exe .......................................79 Problem #9: "A DFS root already exists in this cluster node"....................................... ..........80 Problem #10: DNS name problems................................................................ .......................81
File Service Product Operations Guide
Contributors Program Manager Jeff Yuhas, Microsoft, USA
Lead Writers Michael Sarabosing, Covestic, USA Akil Washington, Covestic, USA
Other Contributors Steve Barnard, Microsoft Consulting Services Shiloh Cleofe, Microsoft Corporation
Test Manager Greg Gicewicz, Microsoft Corporation
QA Manager Jim Ptaszynski, Microsoft Corporation
Lead Technical Writer Jerry Dyer, Microsoft Corporation
Lead Technical Editor Laurie Dunham, Microsoft Corporation
Technical Editors Bill Karn, Volt Technical Services Patricia Rytkonen, Volt Technical Services
Production Editor Kevin Klein, Volt Technical Services
v
1 Introduction to Product Operations Guide Document Purpose This guide describes processes and procedures for improving the management of Microsoft® Windows Server™ 2003 File Service in an information technology (IT) infrastructure.
Intended Audience This material should be useful for anyone planning to deploy this product into an existing IT infrastructure, especially one based on the IT Infrastructure Library (ITIL) —a comprehensive set of best practices for IT service management—and Microsoft Operations Framework (MOF). It is aimed primarily at two main groups: IT managers and IT support staff (including analysts and service-desk specialists).
How to Use This Guide This guide is divided into five main chapters. The first chapter provides basic background information. The second chapter provides a high-level checklist of the tasks required for maintaining this product. The third chapter takes a more detailed look at the tasks described in the maintenance section. The fourth chapter organizes tasks by the MOF role cluster responsible for each task. The fifth chapter provides information about common troubleshooting techniques for Windows Server 2003 File Service. The guide may be read as a single volume, including the detailed maintenance and troubleshooting sections. Reading the document this way will provide the necessary context so that later material can be understood more readily. However, some people will prefer to use the document as a reference, looking up information only as they need it.
2
Managing the Windows Server Platform
Background This guide is based on Microsoft Solutions for Management (MSM). MSM provides a combination of best practices, best-practice implementation services, and bestpractice automation, all of which help customers achieve operational excellence as demonstrated by high quality of service, industry reliability, availability, and security, and low total cost of ownership (TCO). These MSM best practices are based on MOF, a structured, yet flexible approach centered around ITIL. MOF includes guidelines on how to plan, deploy, and maintain IT operational processes in support of mission-critical service solutions. Central to MOF—and to understanding the structure of this guide—are the MOF Process and Team Models. The Process Model and its underlying service management functions (SMFs) are the foundation for the process-based approach that this guide recommends for maintaining a product. The Team Model and its role clusters offer guidance for ensuring the proper people are assigned to operational roles. Figure 1 shows the MOF Process Model combined with the SMFs that make up each quadrant of the Process Model.
Figure 1 MOF Process Model and SMFs
File Service Product Operations Guide
3
Figure 2 shows the MOF Team Model, along with some of the many functional roles or function teams that might exist in service management organizations. These roles and function teams are shown mapped to the MOF role cluster to which they would likely belong.
Change management Release/systems engineering Configuration control/asset management Software distribution/licensing Intellectual property protection Quality assurance Network and system security Intrusion detection Virus protection Release Audit and compliance admin Contingency planning
Enterprise architecture Infrastructure engineering Capacity management Cost/IT budget management Resource and long-range planning
Security
Infrastructure
Partner
Support
Maintenance vendors Environment support Managed services, outsourcers, trading partners Software/hardware suppliers
Operations
Messaging operations Database operations Network administration Monitoring/metrics Availability management
Figure 2 MOF Team Model and examples of functional roles or teams
Service desk/help desk Production/production support Problem management Service level management
4
Managing the Windows Server Platform
The MOF Team Model is built on six quality goals, which are described and matched with the applicable team role cluster in Table 1. Table 1. MOF Team Model Quality Goals and Role Clusters Quality goal
Team role cluster
Effective release and change management. Accurate inventory tracking of all IT services and systems.
Release
Management of physical environments and infrastructure tools.
Infrastructure
Quality customer support and a service culture.
Support
Predictable, repeatable, and automated system management.
Operations
Mutually beneficial relationships with service and supply partners.
Partner
Protected corporate assets, controlled authorization, and proactive security planning.
Security
Further information about MSM and MOF is available at http://www.microsoft.com/solutions/msm/techinfo/default.asp, or search for the topic on TechNet at http://www.microsoft.com/technet/default.asp. You can also contact your local Microsoft or partner representative.
2 High-Level Processes for Maintaining Windows Server 2003 File Service Overview Every company consists of employees (people), activities that these employees perform (processes), and tools that help them perform these activities (technology). Regardless of what the business is, it most likely consists of people, processes, and technology working together to achieve a common goal. Table 2 illustrates this point. Table 2. Examples of People, Process, and Technology Working Together Area
People
Process
Technology
Auto repair industry
Mechanic
Repair manual
Socket set
Software development industry
Programmer
Project plan
Compiler, debugger
IT operations
IT technician
Microsoft Operations Framework
Windows Server 2003 File Service
At the heart of any IT organization is the ability to efficiently manage file resources while keeping them available and secure for users. As the network expands with more users located on-site, in remote locations, or even at partner companies, IT administrators face an increasingly heavy burden. This product operations guide combines people and process with technology to offer best-practice advice for the maintenance of Windows Server 2003 file services.
6
Managing the Windows Server Platform
Required Technology Table 3 lists the tools or technologies used in the procedures described in this guide. All tools should be accessed from a Windows Server 2003 server console, except in those cases where a link is provided. All tools should be accessed from a Windows Server 2003 server console, except in those cases where a link is provided. Table 3. File Service Tools or Technologies Required Technology
Description
Location
Disk Defragmenter
Tool used to analyze volumes for fragmentation. Also used to defragment volumes.
Start > All Programs > Accessories > System Tools > Disk Defragmenter
System Monitor (formerly known as Performance Monitor)
Tool used to collect data on server health and performance
Start > All Programs > Administrative Tools > System Monitor
Event Viewer
Tool used to monitor and gather information on system, security, and application events
Start > All Programs > Administrative Tools > Event Viewer
Quota Entries window
To be used to view and configure quotas on a volume
On the properties page of a NTFS volume
Microsoft Distributed File System (DFS) Microsoft Management Console (MMC)
Tool used to monitor DFS namespace, including roots, links, and targets
Start > All Programs > Administrative Tools > Distributed File System
Disk Cleanup
Tool used to remove temporary files, Internet cache files, and unnecessary program files
Start > All Programs > Accessories > System Tools > Disk Cleanup
Backup
Tool used to perform backup and restore operations
Start > All Programs > Accessories > System Tools > Backup
Ntfrsutl.exe
Tool used for troubleshooting FRS on DFS
Windows Server 2003 Support Tools
Dfsutil.exe
Tool used to configure and troubleshoot DFS
Windows Server 2003 Support Tools
File Service Product Operations Guide
Recommended Technology
7
Description
Location
Srvinfo.exe
Tool used to gather system information from servers
Windows Server 2003 Resource Kit
Volperf.exe
Tool used to install performance objects and counters for volume shadow service
Windows Server 2003 Resource Kit
Fsutil.exe
Tool used to manage Windows® file system
\Winnt\System32
Iologsum.cmd
Tool used for troubleshooting FRS on DFS
Windows Server 2003 Support Tools
Windows Management Instrumentation (WMI)
Tool used to configure WMI settings such as permissions for authorized users and groups and turning error logging on or off
Start > Run > type wmimgmt.msc
Maintenance Processes Checklist The following checklists provide a quick reference for those product maintenance processes that must be performed on a regular basis. These process lists are a summary of the processes described in subsequent sections of this guide. They are limited to those processes required for maintaining the product.
Operating Quadrant The processes for this section are based on the service management function guides that make up the MOF Operating Quadrant. For more information on the MOF Process Model and the SMFs, see http://www.microsoft.com/solutions/msm and http://www.microsoft.com/mof.
8
Managing the Windows Server Platform
Storage Management SMF Daily Processes Process Name
Related SMFs
MOF Role Cluster
Storage resource management
Infrastructure
Data backup, restore, and recovery operations
Support Weekly Processes
Process Name
Related SMFs
MOF Role Cluster
Storage resource management
Infrastructure
Data backup, restore, and recovery operations
Support Monthly Processes
Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name Data backup, restore, and recovery operations
Related SMFs
MOF Role Cluster Operations
File Service Product Operations Guide
9
Service Monitoring and Control SMF Daily Processes Process Name
Related SMFs
Perform monitoring
MOF Role Cluster Infrastructure
Weekly Processes Process Name
Related SMFs
MOF Role Cluster
There are no weekly processes for this SMF. Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
10
Managing the Windows Server Platform
Directory Services Administration SMF Daily Processes Process Name
Related SMFs
Maintaining the directory
MOF Role Cluster Infrastructure
Weekly Processes Process Name
Related SMFs
MOF Role Cluster
There are no weekly processes for this SMF. Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
File Service Product Operations Guide
11
Supporting Quadrant The processes for this section are based on the SMF guides that make up the MOF Supporting Quadrant.
Incident Management SMF Daily Processes Process Name
Related SMFs
Investigation and diagnosis
MOF Role Cluster Support
Weekly Processes Process Name
Related SMFs
Investigation and diagnosis
MOF Role Cluster Support
Monthly Processes Process Name
Related SMFs
Incident closure
MOF Role Cluster Operations
As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
12
Managing the Windows Server Platform
Problem Management SMF Daily Processes Process Name
Related SMFs
Problem recording and classification
MOF Role Cluster Operations
Weekly Processes Process Name
Related SMFs
MOF Role Cluster
There are no weekly processes for this SMF. Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
File Service Product Operations Guide
13
Optimizing Quadrant The tasks for this section are based on the SMF guides that make up the MOF Optimizing Quadrant.
Availability Management SMF Daily Processes Process Name
Related SMFs
MOF Role Cluster
There are no daily processes for this SMF. Weekly Processes Process Name
Related SMFs
Design for recovery
MOF Role Cluster Operations
Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. Quarterly Processes Process Name
Related SMFs
Design for recovery
MOF Role Cluster Operations
As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster Operations
14
Managing the Windows Server Platform
Capacity Management SMF Daily Processes Process Name
Related SMFs
MOF Role Cluster
Managing resources and service performance
Operations
Managing resources and service performance
Operations Weekly Processes
Process Name
Related SMFs
Managing resources and service performance
MOF Role Cluster Infrastructure
Monthly Processes Process Name
Related SMFs
Managing resources and service performance
MOF Role Cluster Infrastructure
As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
File Service Product Operations Guide
15
Changing Quadrant The processes for this section are based on the SMF guides that make up the MOF Changing Quadrant.
Change Management SMF Daily Processes Process Name
Related SMFs
Change classification
MOF Role Cluster Infrastructure
Weekly Processes Process Name
Related SMFs
Change authorization
MOF Role Cluster Infrastructure
Monthly Processes Process Name
Related SMFs
MOF Role Cluster
There are no monthly processes for this SMF. As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
16
Managing the Windows Server Platform
Configuration Management SMF Daily Processes Process Name
Related SMFs
MOF Role Cluster
There are no daily processes for this SMF. Weekly Processes Process Name
Related SMFs
MOF Role Cluster
There are no weekly processes for this SMF. Monthly Processes Process Name
Related SMFs
Reviewing configuration items
MOF Role Cluster Infrastructure
As-Needed Processes Process Name There are no as-needed processes for this SMF.
Related SMFs
MOF Role Cluster
3 Detailed Maintenance Processes Overview This chapter provides detailed information about the processes that must be performed in order to maintain Windows Server 2003 File Service. The chapter is first arranged according to the MOF quadrant to which each process belongs. The quadrants are: ●
Operating Quadrant
●
Supporting Quadrant
●
Optimizing Quadrant
●
Changing Quadrant
Within each quadrant, the processes are further arranged according to the MOF SMF guides that make up that quadrant, the particular Team Model role cluster to which the process belongs, and the time (daily, weekly, monthly, or as-needed) when the process occurs. For more information about the MOF Process Model and the MOF SMF guides that make up each quadrant of the model, see http://www.microsoft.com/solutions/msm. For more information about the MOF Team Model and team role clusters, see http://www.microsoft.com/mof.
18
Managing the Windows Server Platform
Operating Quadrant
Storage Management SMF
Support Role Cluster
Daily
Process: Data backup, restore, and recovery operations Description Backing up, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that those processes fulfill business requirements and service level objectives.
Task: Run daily incremental backup Purpose Performing regularly scheduled backups is an integral part of any file service operations environment. A good backup strategy should include daily incremental or differential backups as well as weekly backups. Numerous strategies exist regarding the frequency and types of backup jobs that an operations team can implement.
File Service Product Operations Guide
19
Procedure: Configure incremental backup job 1. Start Backup utility and select the Backup tab. 2. Select the drives, folders, and files that will be included in the backup. It is a good idea to include the system state information as part of the backup operation. 3. On the Tools menu, click Options. In the Options window, on the Backup Log tab, select Detailed, and click OK. Backup logs can be vital to troubleshooting and recording status of the backup operation. The default setting in Windows Server 2003 is for backup logs to contain such summary information as loading a tape, starting the backup, backing up files, backing up bytes, or failing to open a file. Some operations environments require more detail information—specifically, what files are being backed up for a particular backup job. 4. On the Tools menu, click Options. In the Options window, click the Backup Type tab. In the Default Backup Type drop-down list, select Incremental, and click OK. 5. In Backup Destination, select one of the following: ●
Choose file to back up files and folders to a file. This is the default setting.
●
Choose a tape device if you want to back up files and folders to a tape.
6. In Backup media or file name, select one of the following: ●
If you are backing up files and folders to a file, enter the path and file name of the backup (.bkf) file.
●
If you are backing up files and folders to tape, choose the tape you want to use.
7. Click Start Backup, then click Advanced, select Data Verification, and click OK. 8. Click Schedule and enter the logon name and password that the backup will run as, and then click OK. In the Schedule Job Options window, enter the name for the backup job—for example, "ServerName-IncBackup-Date," and click OK. 9. In the Schedule Job window, confirm that the Schedule tab is selected. Under Schedule Task, select Weekly and click the days of the week you want the incremental job to run. In Start time, enter the time you want the backup to start and click OK. 10. Enter the logon name and password that the backup job will run as and then click OK. Click OK again to exit the window. The daily incremental job is now scheduled to run. Dependencies None Technology Required Backup.exe
20
Managing the Windows Server Platform
Operating Quadrant
Storage Management SMF
Support Role Cluster
Weekly
Process: Data backup, restore, and recovery operations Description Storing, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that backup and recovery processes fulfill business requirements and service level objectives.
Task: Run weekly normal backup Purpose Performing regularly scheduled backups is an integral part of any file service operations environment. A good backup strategy should include daily incremental or differential backups as well as weekly backups. Numerous strategies exist regarding the frequency and types of backup jobs that an operations team can implement.
Procedure: Configure normal backup job 1. Start the Backup utility. 2. On the Backup tab, select the drives, folders, and files that will be included in the backup job. It is a good idea to include the system state information as part of the backup operation. 3. On the Tools menu, click Options. In the Options window, click the Backup Log tab, select Detailed, and click OK. Backup logs can be vital for troubleshooting and recording status of the backup operation. The default setting in Windows Server 2003 is for backup logs to contain summary information such as loading a tape, starting the backup, backing up files, backing up bytes, or failing to open a file. Some operations environments require more detailed information—specifically, what files are being backed up for a particular backup job. 4. On the Tools menu, click Options. In the Options window, click the Backup Type tab. In the Default Backup Type drop-down list, select Normal and click OK. 5. In Backup Destination, select one of the following: ●
Choose a file to back up files and folders to a file. This is the default setting.
●
Choose a tape device if you want to backup files and folders to a tape.
File Service Product Operations Guide
21
6. In Backup media or file name, select one of the following: ●
If you are backing up files and folders to a file, enter the path and file name of the backup (.bkf) file.
●
If you are backing up files and folders to tape, choose the tape you want to use.
7. Click Start Backup, click Advanced, select Data Verification, and click OK. 8. Click the Schedule, enter the logon name and password that the backup job will run as, and then click OK. 9. In the Schedule Job Options window, enter the name for the backup job, such as "Increment Backup," and click OK. 10. In the Schedule Job window, confirm the Schedule tab is selected. Under Schedule Task, select Weekly and click the days of the week you want the incremental job to run. In Start Time, enter the time you want the backup job to start, and click OK. 11. Enter the logon name and password that the backup job will run as and then click OK. 12. Click OK. The weekly normal job is now scheduled to run. Dependencies None Technology Required Backup.exe
22
Managing the Windows Server Platform
Optimizing Quadrant
Availability Management SMF
Operations Role Cluster
Weekly
Process: Design for service recovery Description Regardless of how well designed and managed an IT service is, problems with its delivery can still occur—whether as the result of an unexpected event or even the failure of a countermeasure deployed to protect the service. A major design consideration for high availability is a reactive one, charged with recovering service as quickly and efficiently as possible. Rapid recovery may also be the appropriate design choice for a particular availability risk if an effective countermeasure proves to be too expensive for the customer to justify.
Task: Update automated system recovery (ASR) backup Purpose There is a potential for a system failure during the lifetime of a file server. Several startup options, such as safe mode and last known good configuration, are available to use to recover from system failure. However, automated system recovery (ASR) backups should be included in the regular maintenance of your file server to act as a last resort in system recovery. ASR will back up the system files necessary for starting the file server. Other data should be included as part of the daily and weekly backup jobs for the server. ASR backups are performed using Backup in interactive mode. They cannot be scheduled.
Procedure 1: Get media for ASR backup ASR backup requires a blank 1.44-MB disk to save system settings, and media such as tapes or compact discs that will contain the backup files. 1. A separate media set is recommended for ASR backups. The media set should be stored in a secure location, separate from data backup files. 2. Store the 1.44-MB disk with the ASR backup set it was created with. You must have the disk that was created with the ASR backup set in order to perform ASR recovery.
Procedure 2: Create ASR backup 1. Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup. 2. On the Jobs menu, click New. 3. On the Tools menu, click ASR Wizard. 4. Follow the instructions that appear on the screen.
File Service Product Operations Guide
23
Procedure 3: File server does not have a floppy disk drive 1. Perform an ASR backup on the computer without the floppy disk drive. ASR backup will log an error. 2. Copy the Asr.sif and Asrpnp.sif files located in the %systemroot%\Repair directory to another computer with a floppy disk drive, and then copy those files onto a disk. Dependencies ●
File server should have a floppy disk drive. Procedure 3 provides a workaround to copy system files to a disk, but a floppy disk drive is required for ASR recovery.
●
You must be a member of an administrators or backup operators group to perform ASR.
Technology Required Backup.exe
24
Managing the Windows Server Platform
Optimizing Quadrant
Availability Management SMF
Operations Role Cluster
Quarterly
Process: Design for service recovery Description Regardless of how well designed and managed an IT service is, problems with its delivery can still occur—whether as the result of an unexpected event or even the failure of a countermeasure deployed to protect the service. A major design consideration for high availability is a reactive one, charged with recovering service as quickly and efficiently as possible. Rapid recovery may also be the appropriate design choice for a particular availability risk if an effective countermeasure proves to be too expensive for the customer to justify.
Task: Validate ASR recovery Purpose The ASR backup must be validated in order to confirm the integrity of the backup process. The operations team must also be familiar with the hardware and software involved in the ASR recovery process.
Procedure 1: Prepare for ASR recovery 1. Retrieve the latest ASR backup media set and disk from the secure location. Verify that the media and disks are from the same backup. 2. Retrieve the media set for the most recent normal backup of the server. 3. Retrieve the original Windows Server 2003 installation CD. 4. Retrieve any mass storage device driver files supplied by the manufacturer. Verify that you have this file before beginning the recovery operation. 5. Configure the recovery server hardware.
Procedure 2: Perform ASR recovery 1. Insert the original Windows Server 2003 installation CD. 2. Restart the server. If prompted to press a key to start the computer from the CD, press the requested key. 3. If you have a separate driver file as described in Procedure 1, Step 4, use the driver as part of the Setup by pressing F6 when prompted. 4. Press F2 when prompted at the beginning of the text-only mode section of Setup. You will be prompted to insert the ASR disk you have previously created. 5. Follow the directions on the screen. 6. If you have a separate driver file as described in Procedure 1, Step 4, press F6 (a second time) when prompted after the system restarts. 7. Follow the directions on the screen.
File Service Product Operations Guide
25
Procedure 3: Restore data files to the recovery server 1. Start the Backup utility. 2. On the Welcome tab, click Restore Wizard (Advanced). 3. Click Next. 4. Select the items to be restored from the latest normal backup set and click Next. 5. At this point, you can click Finish to start the restore or click the Advanced button for more options. If you decide to configure Advanced options, the following is a list of items that should be selected. ●
Restore files to original location
●
Leave existing files
●
Restore security settings
●
Restore junction points but not the folders and file data they reference
●
Preserve existing volume mount points
Dependencies ●
ASR recovery requires that the recovery server have the same hardware and disk configuration as the server where the ASR backup was performed.
●
Perform regular ASR backup.
●
Manufacturer-supplied device drivers for mass storage devices.
Technology Required Backup.exe
26
Managing the Windows Server Platform
Operating Quadrant
Directory Services Administration SMF
Infrastructure Role Cluster
Daily
Process: Maintaining the directory Purpose The data contained in the directory is, or very soon will be, critical to the base operation and productivity of the organization. If the directory becomes unavailable for any reason—for example, through equipment failure or data corruption—the business will suffer from lost productivity and financial loss. Developing sound backup and restore procedures for the directory and supporting system components ensures that no critical directory data and configuration information will be lost.
Task: Back up DFS namespace configuration Purpose This task creates a backup of the DFS namespace and a restoration script to resolve issues with DFS objects.
Procedure 1: Export DFS namespace Windows Server 2003 Support Tools include the Dfsutil.exe in the can be used to export the DFS namespace configuration into a script that can be used later for restoration. The following command will export the links: Dfsutil /Root :\\dfsname\root /Export:
Procedure 2: Automate DFS configuration export This process can be automated using Microsoft Windows Shell Scripting. The following is a simple command that can read an input file. Each line of the input file lists a DFS root: echo off for /f %%i in (input.txt) do dfsutil.exe /view:%%i /export:
Dfsutil.exe
●
Windows Host Script
File Service Product Operations Guide
Operating Quadrant
Storage Management SMF
27
Support Role Cluster
Weekly
Process: Data backup, restore, and recovery operations Description Storing, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that operations fulfill business requirements and service level objectives.
Task: Verify previous day’s backup job Purpose This task provides guidance on verifying the integrity of the daily scheduled backup. Regardless of the utility used to provide backup service to the file server, the operations team should verify each backup job after its completion. This verification allows the operations team to resolve issues concerning backups that may put the organization at risk of data loss.
Procedure 1: Verify completion of backup You can use Event Viewer to verify whether a backup started and completed, and if any errors were encountered during the backup operation. 1. Start Event Viewer. 2. Right-click Application Log, and click Properties, highlight View, and select Filter. 3. In Event Source, click the drop-down menu, select Backup, and click OK. 4. Search for the following events: ●
Event 8000. This event signals the start of a backup on a volume. You should receive this event for each volume in the backup job.
●
Event 8001. This event signals the end of a backup on a volume. You should receive n-1 of this event for a backup job, where n is equal to the number of volumes in the backup job. When a volume has been backed up successfully, Event 8001 will be logged as an informational event. When errors are encountered backing up a volume, Event 8001 will be logged as an error event.
●
Event 8019. This event signals the end of the backup operation. You should receive one 8019 event per backup job.
28
Managing the Windows Server Platform
Procedure 2: Review the backup log Backup logs can be vital for troubleshooting and recording status of the backup operation. The default setting in Windows Server 2003 is for backup logs to contain summary information such as loading a tape, starting the backup, backing up files, backing up bytes, or failing to open a file. Some operations environments require more detailed information—specifically, what files are being backed up for a particular backup job. To get more detailed logging in the backup logs 1. Start the Backup utility. 2. On the Tools menu, click Options. 3. In the Options window, click the Backup Log tab, select Detailed, and click OK. Backup logs will now contain detailed information regarding the backup operations. To review the backup log 1. Start Backup utility. 2. On the Tools menu, click Reports. 3. In the Backup Report dialog box, select the previous night’s backup report, and click View.
File Service Product Operations Guide
29
Procedure 3: Report backup problems to incident management Use your organization's incident management process to record the following conditions in your environment. This procedure describes some of the steps that should be followed when filling out the incident management report. 1. Event 8000 is not logged in the application log. When this occurs, the file server is at risk of data loss. Verify that the backup job has not been deleted. Review the start time for the job to verify that it has not been modified. 2. Event 8000 is not logged for all volumes on the server. When this occurs, a volume is at risk of data loss. Review the backup configuration for the backup job to see if the volume has been removed from the backup job. Check the configuration management database (CMDB) to see if the volume has been removed from the backup job. 3. Event 8001 is logged as a warning event in the application log. Review the backup log by searching for the "Warning:" string in the body of the log. Record what the warning is and the reason for the warning. 4. Event 8019 is not logged in the application log. This means the backup job is still running. Review the application log and record the last volume to trigger a successful 8001 informational event. Record the last volume to trigger an 8000 event. Dependencies ●
Backup jobs are logged to disk
●
Incident management process
Technology Recommended ●
Backup
●
Third-party backup software
30
Managing the Windows Server Platform
Operating Quadrant
Storage Management SMF
Infrastructure Role Cluster
Daily
Process: Storage resource management Description Storage resource management (SRM) is a key storage management activity that ensures that important storage devices, such as disks, are formatted and installed with appropriate file systems. In addition, SRM includes using management technologies to monitor storage resources in order to ensure that they meet availability, capacity, and performance requirements.
Task: Monitor available disk space Purpose This task proactively monitors disk space on a volume to control the allocation of disk space and to provide reporting for capacity planning. It mitigates any problems that may result in rapid file growth on a volume. In an IT environment, it is important to set alerts on a logical volume at differing capacity levels. Some alerts are informational so that the status of the disk volume can be reported. Other alerts are used to warn the operations team of a real problem with capacity on a volume. The following are suggested thresholds on a volume: ●
Sixty-five percent capacity. It is important to note that a particular volume is at 65 percent or more full. This means that volume has only 35 percent or less capacity for growth.
●
Seventy-five percent capacity. When a volume is 75 percent full, consider creating new shares on another volume.
●
Ninety percent capacity. Volumes that are at 90 percent capacity should not have file shares created on them. Volumes that are at 90 percent should be included in the problem management report. Once the ninety percent–capacity threshold is reached and an alert is generated, an administrator should initiate appropriate changes such as increasing available capacity, or begin to migrate the shares to higher-capacity subsystems. Additional administrative actions might include performing disk defragmentation and disk cleanup. (See Task: Review Disk Fragmentation.)
File Service Product Operations Guide
31
Procedure 1: Configure alert 1. Start System Monitor. 2. Expand the Performance Logs and Alerts node, right-click Alerts, and click New Alert Settings. 3. Type Jobs Spooling and click OK. 4. On the General tab, click Add, and select the following object, instance, and counter: Object Logical Disk Space
Instance Each Logical Volume Instance.
Counter % Free Space
5. In the Alert when the value is drop-down box, select Over and enter the limit for your environment. 6. On the Action tab, the default selection is Log an entry in the application event log. 7. Select the Schedule tab, click Start Log At, and enter the start time for the alert. 8. Click Apply, and then click OK. The alert is activated and will have a green status indicating that it is logging information based on the configuration and schedule.
Procedure 2: Stop creating share alert ●
Review the event log for Event 2031: Event Type: Information Event Source: SysmonLog Event Category: None Event ID: 2031 Description: Counter: \\Servername\LogicalDisk(driveletter)\% Free Space has tripped its alert threshold. The counter value of n is under the limit value of n.
When you begin to receive Event 2031, the capacity of the volume must be included in the daily problem management report. This alert can indicate when to stop creating new shares on a volume. The remaining space on the volume is used to accommodate data growth on existing shares. This alert will continue be written to the application log until the alert is stopped. It is okay to stop the alert, but once a volume has triggered the Stop Creating Share alert, the capacity should always be included in the daily problem management report.
32
Managing the Windows Server Platform
Procedure 3: Capacity alert ●
Review the event log for Event 2031. (See Procedure 2: Stop creating share alert.) Once the capacity alert is triggered, the disk has reached capacity. The alert should be set as 20-25 percent free space. Once a volume has triggered the capacity alert, submit a request for change (RFC) to move data to another volume or to extend the volume.
Dependencies An alert must be configured to perform an action when a certain disk capacity threshold is reached. Technology Required Performance Logs and Alerts in Windows Server 2003
File Service Product Operations Guide
Operating Quadrant
Storage Management SMF
33
Infrastructure Role Cluster
Weekly
Process: Storage resource management Description Storage resource management (SRM) is a key process for ensuring that important storage devices, such as disks, are formatted and installed with appropriate file systems. In addition, SRM includes using management technologies to monitor storage resources to ensure that they meet availability, capacity, and performance requirements.
Task: Review disk fragmentation Purpose Disk fragmentation occurs when files are written to non-adjacent clusters on a disk. During normal operations of a file server, the file system will become fragmented. Fragmentation has a performance effect on the read/write action. A disk that is highly fragmented requires several passes of the disk’s read and write heads to retrieve or store data to the disk. To analyze the extent of disk fragmentation on a volume and to remediate performance issues associated with fragmented files and free space, run the Disk Defragmenter utility. An effective use of the Disk Defragmenter utility should include removing unnecessary files from the volume. Prior to defragmenting a volume, run the Disk Cleanup utility to perform the following activities: ●
Remove temporary Internet files.
●
Remove any downloaded program files (for example, Microsoft ActiveX® controls and Java applets downloaded from the Internet).
●
Empty the Recycle Bin.
●
Remove Windows temporary files.
●
Remove Windows components that you are not using.
●
Remove installed programs that you no longer use.
34
Managing the Windows Server Platform
Procedure 1: Analyze the volume 1. Start Disk Defragmenter. 2. Select the volume that you want to analyze, and then click Analyze. 3. Click Save As to save the report. You can use Defrag.exe to schedule an analysis of the disk fragmentation on a volume. To output the report to a text file, the syntax for the command line is: defrag
Procedure 2: Clean up the volume 1. Start Disk Cleanup. 2. Select the volume that was analyzed in Procedure 1. 3. Select the file types to delete and click OK. Cleanmgr.exe can be scheduled to run. Prior to scheduling the Cleanmgr.exe, you must specify which tasks you want performed during the disk cleanup. This can be accomplished by running the following command at the command line: cleanmgr /d driveletter: /sageset:n where driveletter is the volume that you want to clean up. 4. When you enter this command, the Disk Cleanup Settings dialog box appears. Select the file types you want removed and click OK. Now you can schedule the disk cleanup task you just created by running the following command from the command line or Task Scheduler: cleanmgr /sagerun:n
File Service Product Operations Guide
35
Procedure 3: Defragment the volume 1. Start Disk Defragmenter. 2. Click the volume that you want to defragment, and then click the Defragment button. You can use Defrag.exe to schedule defragmentation on a volume. It is best to defragment a volume during low usage periods in order to reduce the effect the process has on file server performance. The syntax for the command line is: defrag
Administrator privileges are required to run Disk Defragmenter.
●
Defragmentation requires 15 percent free disk space. If there is low disk space, consider using the –f switch. This switch forces defragmentation even if free disk space is low.
●
Confirm that there is a good backup of the volume prior to performing defragmentation.
●
For more information on running Disk Cleanup from the command line, see the Automating Disk Cleanup Tool in Windows white paper available at http://support.microsoft.com/default.aspx?scid=kb;EN-US;253597.
●
Disk Defragmenter cannot be run on a volume that has Volume Shadow Copies activated. For more information, see the Shadow Copies May Be Lost When You Defragment a Volume white paper available at http://support.microsoft.com/default.aspx?scid=kb;en-us;312067.
Technology Required ●
Disk Defragmenter
●
Disk Cleanup
36
Managing the Windows Server Platform
Operating Quadrant
Storage Management SMF
Operations Role Cluster
As Needed
Process: Data backup, restore, and recovery operations Description Storing, restoring, and recovering data are key storage management activities for maintaining company data. Data should be classified by type, and a strategy should be developed to ensure that backup and recovery processes fulfill business requirements and service level objectives.
Task: Verify restore Purpose When restoring files and folders to the file system, it is important to verify the successful completion of the restoration task. Without verifying that data has been restored prior to directing users to the restore location, the integrity of the backup/restore process could be questioned by users.
Procedure: Verify restore configuration tasks 1. Start the Backup utility. 2. On the Tools menu, select Reports. 3. In the Backup Reports window, select the report that contains the Restore Job, and click View. 4. Search the log for the “Operation: Restore” string. 5. Verify that the restore location and restore files are in the location specified in the initial restore request. 6. Use Windows Explorer to navigate to the location of the restore and verify that the data exists. Dependencies Scheduled backups are being performed. Technology Required Backup
File Service Product Operations Guide
Optimizing Quadrant
Capacity Management SMF
37
Operations Role Cluster
Daily
Process: Managing resources and service performance Description Capacity management is concerned with optimizing the use of IT resources in order to achieve the level of service performance agreed upon with the client. These resources are supplied by support organizations to ensure that the requirements of the business are met. The capacity management process can be either reactive or proactive. Iterative activities, such as monitoring, analyzing, tuning, and reporting, are also important in the process of managing resources and service performance. Each process requires different types of data. For example, managing IT resources involves documenting the usage levels of individual components in the infrastructure, whereas managing service performance records transaction throughput rates and response times.
Task: Capture service performance statistics Purpose During the normal operation of a file server, it is important to monitor the overall health of the server. This information will be used to review general performance, adherence to service level agreements (SLAs), and capacity planning and to create a baseline for the file server.
Procedure: Create performance monitor logs 1. Start System Monitor. 2. Double-click Performance Logs and Alerts, right-click Counter Logs, and select New Settings. 3. Enter the name for this log—for example, "Service Performance Statistics"—and click OK.
38
Managing the Windows Server Platform
4. On the General tab, click Add Counters and select the following counters: Processor Performance
Notes
Processor\% Processor Time
The percentage of elapsed time the processor spent executing instructions for processes or services. It reports the sum of the time the processors spent executing code in privileged mode and executing code in user mode. This counter provides an overall view of the processors' activity.
Processor\% Privileged Time
The percentage of elapsed time that the process threads spent executing code in privileged mode. The operating system switches application threads to privileged mode to allow direct access to the system’s kernel.
System\Context Switches/sec
The combined rate at which all processors on the computer are switched from one thread to another. Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user mode and privileged mode to use an executive or subsystem service. High rates of context switching can result from inefficient hardware or poorly designed device drivers or applications.
Memory Performance
Notes
Memory\Pages/sec
Pages/sec is the rate at which pages are read from or written to the disk in order to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays.
Memory\Available megabytes (MB)
Available megabytes is the amount of physical memory, in megabytes, immediately available for allocation to a process or for system use.
Paging File\% Usage
The amount of the page file instance in use in percent.
File Service Product Operations Guide
Network Performance
39
Notes
Server\Error System
The number of times an internal server error was detected. Unexpected errors usually indicate a problem with the server.
Server\Work Item Shortages
This occurs when no work item is available or can be allocated to service the incoming request. A work item is the location where the server stores a server message block (SMB). Work item shortages might be caused by an overloaded server.
Server\Blocking Requests Rejected
The number of times the server has rejected blocking SMBs due to insufficient count of free work items. This counter indicates whether the MaxWorkItem or MinFreeWorkItems server parameters might need to be adjusted.
Server Work Queues\Queue Length
Queue length is the current length of the server work queue for this CPU. A sustained queue length greater than four might indicate processor congestion. This is an instantaneous count, not an average over time.
Disk Performance Physical Disk\Current Disk Queue Length
Notes Current disk queue length is the number of requests outstanding on the disk at the time the performance data is collected. It also includes requests in service at the time of the collection. This is an instantaneous snapshot, not an average over time interval. Multispindle disk devices can have multiple requests that are active at one time, but other concurrent requests are awaiting service. This counter might reflect a transitory high or low queue length, but if there is a sustained load on the disk drive, it is likely that this will be consistently high. This counter requests experience delays proportional to the length of this queue minus the number of spindles on the disks. For good performance, this difference should average less than two.
Physical Disk\Avg. Disk sec/read
Avg. Disk sec/read is the average time, in seconds, of a data read from the disk.
40
Managing the Windows Server Platform
Disk Performance
Notes
Physical Disk\Disk read bytes/sec
Disk read bytes/sec is the rate at which bytes are transferred from the disk during read operations.
Physical Disk\Disk write bytes/sec
Disk write bytes/sec is the rate at which bytes are transferred to the disk during write operations.
Physical Disk\Disk read/sec
Disk read/sec is the rate of read operations on the disk.
Physical Disk\Disk write/sec
Disk write/sec is the rate of write operations on the disk.
5. Fifteen is the default sampling interval. You can modify this number. Increasing the interval will reduce the size of the log file but at the risk of losing data. Decreasing the interval will increase the size of the log file and provide a more detailed look at the performance. 6. On the Log Files tab, click the Log File Type drop-down box and select the output format. Choose a CSV file type if you want to be able to manipulate the data in Excel. The data can also be written to an SQL database format. 7. Make sure the End File Names checkbox is checked. Use the year, month, and day format yyyymmdd. 8. On the Schedule tab, click the Start Log At checkbox, and enter the start time for logging. 9. Click the Stop Log At checkbox and enter the time at which logging should stop. 10. Click Apply, and then click OK. The log files will be created in <system drive>\Perflogs by default. The log is activated and will have a green status, indicating that it is logging information based on the configuration and schedule. Dependencies ●
You must be a member of the administrators group or the performance log users group on the local computer, or have been delegated the appropriate authority.
●
There must be adequate space on the disk where the log files are being created.
Technology Required System Monitor
File Service Product Operations Guide
41
Task: Capture service usage statistics Purpose During the normal operation of a file server, it is important to monitor service usage. Service usage differs from service performance by focusing on how users consume file server resources. This information will be used to review general performance, adherence to SLAs, and capacity planning and to create a baseline for the file server.
Procedure: Create performance monitor logs 1. Start System Monitor. 2. Double-click Performance Logs and Alerts, right-click Counter Logs, and select New Settings. 3. Enter the name for this log, such as "Service Performance Statistics," and click OK. 4. On the General tab, click Add Counters and select the following counters: Logical Disk Performance
Notes
Logical Disk\% Free Space
% Free Space is the percentage of total usable space that was free on the selected logical disk drive.
Logical Disk\Current Disk Queue Length
Current Disk Queue Length is the number of requests outstanding on the disk at the time the performance data is collected. It also includes requests in service at the time of the collection. This is an instantaneous snapshot, not an average over time interval. Multi-spindle disk devices can have multiple requests that are active at one time, but other concurrent requests are awaiting service. This counter might reflect a transitory high or low queue length, but if there is a sustained load on the disk drive, it is likely that this will be consistently high. This counter requests experience delays proportional to the length of this queue minus the number of spindles on the disks. For good performance, this difference should average less than two.
Logical Disk\Avg. Disk sec/read
Avg. Disk sec/read is the average time, in seconds, of a data read from the disk.
Logical Disk\Avg. Disk sec/write
Avg. Disk sec/write is the average time, in seconds, of a data write to the disk.
Logical Disk\Disk read bytes/sec
Disk read bytes/sec is the rate at which bytes are transferred from the disk during read operations.
Logical Disk\Disk write bytes/sec
Disk write bytes/sec is the rate at which bytes are transferred to the disk during write operations.
42
Managing the Windows Server Platform
Logical Disk Performance
Notes
Logical Disk\Disk read/sec
Disk read/sec is the rate of read operations on the disk.
Logical Disk\Disk write/sec
Disk write/sec is the rate of write operations on the disk.
Network Performance
Notes
Server\Server Sessions
The number of sessions currently active in the server. This value indicates current server activity.
Server\Bytes Total/sec
The number of bytes the server has sent to and received from the network. This value provides an overall indication of how busy the server is.
Server\Files Open
The number of files currently opened in the server. This value indicates current server activity.
Volume Shadow Copy Service Performance
Notes
Shadow Copies\% Disk Used by Diff Area File
Size of all diff area files on the input volume divided by volume.
Shadow Copies\Allocated Space(MB)
Space used in the shadow storage volume for all the shadow copies of the input volume.
Shadow Copies\Nb of Shadow Copies
Number of shadow copies of a volume.
Shadow Copies\Used Space
Space used in the shadow storage volume for all the shadow copies of the input volume.
Shadow Copies\Nb of Diff Area Files
Total number of diff area files on a volume. This value is the same as the total number of shadow copies on the system whose shadow storage is configured on the input volume.
Shadow Copies\Size of Diff Area Files
Size of all diff area files on the input volume.
File Service Product Operations Guide
43
5. Fifteen is the default sampling interval. You can modify this number. Increasing the interval will reduce the size of the log file but at the risk of losing data. Decreasing the interval will increase the size of the log file and provide a more detailed look at the performance. 6. On the Log Files tab, click the Log File Type drop-down box and select the output format. Choose a CSV file type if you want to be able to manipulate the data in Excel. The data can also be sent to a SQL database format. 7. Make sure the End File Names checkbox is checked. Use the year, month, and day format yyyymmdd. 8. On the Schedule tab, click the Start Log At checkbox, and enter the start time for logging. 9. Click the Stop Log At checkbox and enter the time at which logging should stop. 10. Click Apply, and then click OK. The log files will be created in <system drive>\Perflogs by default. The log is activated and will have a green status indicating that it is logging information based on the configuration and schedule. Dependencies ●
You must be a member of the administrators group or the performance log users group on the local computer, or have been delegated the appropriate authority.
●
Adequate space on the disk where the log files are being created.
●
Run Volperf.exe from the Windows Server 2003 Resource Kit to enable Volume Shadow Copy service performance counters.
Technology Required ●
System Monitor
●
Volperf.exe
44
Managing the Windows Server Platform
Operating Quadrant
Service Monitoring and Control SMF
Infrastructure and Operations Role Clusters
Daily
Process: Perform monitoring Description Monitoring is concerned with the real-time recording of critical data values on an ongoing basis. The aim of recording critical data values is to ensure that adequate management information is available in order to maintain a service or services at agreed-on levels of service performance or, or at a minimum, to be recovered quickly.
Task: Review quota levels Purpose Monitor quota levels on volumes and notify users when the volumes have exceeded assigned warning levels and quota limits.
Procedure 1: View quota events in event log 1. Start Event Viewer. 2. Right-click System, point to View, and click Filter. Use the following filter configuration: Event Source: NTFS From: Events On To: Events On Note Use a consistent 24-hour period for reporting quota information.
3. Sort the list by event. When a user exceeds his or her quota limit, Event 37 will be logged to the file. The user field will point to the user who has exceeded his or her quota threshold. The description field will point to the volume where the threshold was assigned. 4. Note the user and volume where the quota threshold was exceeded. You can record this information in a program such as Microsoft Excel.
File Service Product Operations Guide
45
Procedure 2: Viewing quotas The user interface (UI) can be used to view quota entries on a volume. 1. In Windows Explorer, click My Computer, right-click a volume, and then click Properties. 2. In the Properties dialog box, click the Quota tab. 3. On the Quota tab, click Quota Entries. 4. Click the Status column to sort by status. 5. For each user who has exceeded a quota threshold, record the following information in the spreadsheet created in Procedure 1, Step 4: Amount Used Quota Limit Warning Level Percent Used Server and Volume where quota has been assigned
Procedure 3: Notify users that quota thresholds have been exceeded For each user identified in Procedures 1 and 2, send an e-mail message notifying the user that he or she has exceeded the warning level or quota limit. Based on your operations environment, recommend steps to rectify the quota. Some options for resolving this situation are: ●
Delete non-business-essential data from the volume.
●
Request an increase in quota limit.
Dependencies ●
Quotas enabled on volume.
●
Logging events to event log has been selected for exceeding warning levels and quota limits.
Technology Suggested Microsoft Excel
46
Managing the Windows Server Platform
Changing Quadrant
Configuration Management SMF
Infrastructure Role Cluster
Monthly
Process: Reviewing configuration items Description Because the accuracy of the information stored in the configuration management database (CMDB) is crucial to the success of Change Management, Incident Management, and other SMFs, a review process should be established to ensure that the database accurately reflects the production IT environment.
Task: Compliance check—verify that shares are created in the proper location Purpose This task ensures that shares created on file servers are in compliance with organization standards for the location of file shares.
Procedure 1: Create server share report 1. Create a custom MMC and add the Shared Folder snap-in. 2. On the Actions menu, choose Export List to copy this information to a text file. 3. To automate the procedure, the following sample script can be used to create a report of the folder shared on a file server and the path: strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colShares = objWMIService.ExecQuery("Select * from Win32_Share") For each objShare in colShares cscript.Echo "AllowMaximum: " & vbTab & objShare.AllowMaximum cscript.Echo "Caption: " & vbTab & objShare.Caption cscript.Echo "MaximumAllowed: " & vbTab & objShare.MaximumAllowed cscript.Echo "Name: " & vbTab & objShare.Name cscript.Echo "Path: " & vbTab & objShare.Path cscript.Echo "Type: " & vbTab & objShare.Type Next
Procedure 2: Verify shared folders against shared folder location standard 1. Compare the path of the shared folder to the organization’s standard for shared folder creation in the CMDB. 2. If there are any discrepancies in the shared folders report and the CMDB, submit an emergency RFC CAB/EC. Dependencies CMDB Technology Required Windows Management Instrumentation (WMI)
File Service Product Operations Guide
Supporting Quadrant
Problem Management SMF
47
Operations Role Cluster
Daily
Process: Problem recording and classification Description This process deals with the recording and classification of a problem, which can originate from a variety of sources and media. Problems may be reported through the incident management process or as a result of analysis from the data collected by the problem management team. Additionally, other SMF teams, such as availability management and capacity management, might detect problems and pass this information to the problem management team. It is important that all problems be linked to existing incidents and that each problem be recorded in order to prioritize its resolution. Once a problem has been recorded, it is assessed against the business impact of the problem and the urgency of the required solution. This assessment determines the problem classification.
Task: Review daily problem management report Purpose Ensure that the appropriate resources and priority levels have been assigned to current problems. The report should include the status of any problems from the previous day or any that occurred overnight.
Procedure 1: Check file server status The status of each file server should be included in this report. This information could include: ●
Whether the file server is online.
●
Whether there any approved RFCs pending.
●
Status of last backup.
●
Confirmation that the performance monitor log from the previous day exists for the server.
●
Current capacity for storage disk.
●
Status of DFS links.
Procedure 2: Review problems transferred from incident management Review each incident that has been transferred to the problem management team.
48
Managing the Windows Server Platform
Procedure 3: Prioritize and assign Based on the information received on the status of the file server and any problems transferred from incident management, set the priority of each problem and assign the appropriate team members. Dependencies File server monitoring Technology Required None
File Service Product Operations Guide
Supporting Quadrant
Incident Management Control SMF
49
Supporting Role Cluster
Weekly
Process: Investigation and diagnosis Description This process deals with investigating an incident and gathering diagnostic data. Its aim is to identify how the incident can be resolved as quickly as possible. The process allows for management escalation or functional escalation if either becomes necessary in order to meet SLA targets.
Task: Create weekly service activity report Purpose This task provides a high-level report on a service request from the perspective of when it was opened, when it was closed, and how long it took to resolve. The organization may have an SLA on the time it takes a customer to receive a response from the incident management team once an incident has been reported. Managers and leads can use such data to better balance the workload of the incident management team. Management can also use the service activity report to measure the effectiveness and efficiency of the incident management staff itself. This information is important to the members of the incident management team because it shows how long cases have been open. This helps to determine which cases must be addressed next. The following is an example of some of the information that can be included in the activity report: ●
Total number of cases opened.
●
Total number of cases closed.
●
Number of cases closed on first contact with the incident management team.
●
Number of days a case has been open.
50
Managing the Windows Server Platform
Procedure: Create report metrics The method used to collect the data is dependent on the features of an organization’s incident tracking solution. But however the organization collects the data, it should include the following information: ●
Total number of cases opened. This metric is collected for individual members of the team as well as for the whole team. It highlights the volume of incidents being opened regarding file services. When this metric is compared to metrics showing how many cases have been closed, how long it took to close them, and how many of them were closed on first contact, it helps the team to assess its overall effectiveness.
●
Total number of cases closed. This metric is collected for individual members of the team as well as for the whole team. It highlights the volume of incidents being closed regarding file services. This metric is critical when evaluating the progress of the incident management team. Open cases that must be carried over to another week require additional incident management from the case owner.
●
Number of cases closed on first contact with the incident management team. This metric is collected as the total for the team. It enables the incident management team to determine the effectiveness and efficiency of the incident management process and can directly impact customer satisfaction. When cases are closed on the first call, it reduces the number of cases incident management team members have to manage.
●
Number of days a case has been open. This metric is collected for individual members of the team as well as for the whole team. Cases that remain open for extended periods have a negative impact on customer satisfaction. The incident manager can use this metric to identify possible areas in which the incident management team may require training or education. In addition, cases that remain open for long periods may be better handled by the problem management team. It is important to identify these types of cases and to provide the incident owner with additional resources or to escalate the issue to the problem management team.
Dependencies ●
Incident ticketing system.
●
Incidents are responded to on a daily basis.
●
An SLA on how an incident is handled and when an incident is escalated to the problem management team.
Technology Required ●
Third-party tools are available that provide incident management ticketing functionality.
●
Reports can be built from an Access or SQL Server database.
File Service Product Operations Guide
Supporting Quadrant
Incident Management SMF
51
Operations Role Cluster
Monthly
Process: Incident closure Description This process ensures that the customer is satisfied that the incident has been resolved prior to closing the incident record. Incident closure also checks that the incident record is fully updated and assigns a closure category.
Task: Roll up activity report into monthly metric Purpose This task provides metrics to assist in planning staffing levels and checking the incident management function against other SMFs. These reports can be used by those involved with other SMFs (such as Service Level Management, Financial Management, and Workforce Management) as well as by members of the six MOF Team Model role clusters.
Procedure: Create monthly metric This task should produce a report showing the cost of incident management and indicating where resources should be allocated to optimize its performance. ●
Percent closed incidents. This metric is created by taking the total number of cases closed for a month and dividing it by the number of cases opened for the month.
●
Percent incidents closed on first contact. This metric is created by taking the total number of cases closed on first contact and dividing it by the number of cases opened for the month.
●
Mean time to resolution. This metric measures the effectiveness of the incident management process. It is calculated by taking the total time spent on incident resolution and dividing it by the total number of cases closed. SLAs can be compared to this metric
The numbers reported should then be used to evaluate the incident management process and to determine how effectiveness and efficiency can be improved. Dependencies ●
Respond to daily service request.
●
Weekly service request activity report.
Technology Required None
52
Managing the Windows Server Platform
Optimizing Quadrant
Capacity Management SMF
Infrastructure Role Cluster
Weekly
Process: Managing resources and service performance Description Capacity management is concerned with optimizing the use of IT resources in order to achieve the level of service performance agreed upon with the client. These resources are supplied by support organizations to ensure that the requirements of the business are met. The capacity management process can be either reactive or proactive. Iterative activities, such as monitoring, analyzing, tuning, and reporting, are also important in the process of managing resources and service performance. Each requires different types of data. For example, managing IT resources involves documenting the usage levels of individual components in the infrastructure, whereas managing service performance records transaction throughput rates and response times.
Task: Captures size of DFS namespace Purpose This task captures the size of the DFS namespace for an organization and reports to the problem management team those DFS roots that are approaching namespace size limits.
Procedure 1: Create DFS namespace report Windows Server 2003 Support Tools include the Dfsutil.exe which can be used to capture the size of the Windows Server 2003 DFS namespace and mixed mode domain DFS namespace. The following command will export the links: Dfsutil /Root:\\dfsname\root /Export:
Procedure 2: Automate DFS namespace report This capture process can be automated using Windows shell scripting. The following is a simple command that can read as an input file. Each line of the input file lists a domain DFS root: for /f %%i in (input.txt) do dfsutil.exe /view:%%i >
File Service Product Operations Guide
53
Procedure 2: Review size of DFS namespace ●
Compare the DFS namespace size with the following limits on DFS namespace: ●
The maximum size of a single domain DFS namespace is 5 MB of metadata.
●
A stand-alone DFS can have as many as 50,000 links.
Dependencies Windows Server 2003 Resource Kit installed on server running Dfsutil. Technology Required ●
Dfsutil.exe
●
Windows Script Host
54
Managing the Windows Server Platform
Optimizing Quadrant
Capacity Management SMF
Operations and Infrastructure Role Clusters
Monthly
Process: Managing resources and service performance Description Capacity management is concerned with optimizing the use of IT resources in order to achieve the level of service performance agreed upon with the client. These resources are supplied by support organizations to ensure that the requirements of the business are met. The capacity management process can be either reactive or proactive. Iterative activities, such as monitoring, analyzing, tuning, and reporting, are also important in the process of managing resources and service performance. Each requires different types of data. For example, managing IT resources involves documenting the usage levels of individual components in the infrastructure, whereas managing service performance records transaction throughput rates and response times.
Task: Create quota report Purpose Managing disk space consumption is vital to providing file services to customers. The disk quota support feature in Windows Server 2003 provides a way to manage quotas on a volume. Once quotas have been set on a volume, monitoring and reporting quota usage should be part of the regular server maintenance schedule.
Procedure 1: Creating quota reports using Fsutil Windows Server 2003 comes with command line utilities that can be used to gather information on the file system. Fsutil.exe can be used to query a volume for quota entries. To obtain quota information for volumes on a server, Fsutil must be run for each volume on a file server. From a command prompt, type: fsutil quota query
If quotas are being tracked on a volume.
●
If logging for quota events is enabled on a specific user's volume (SID Name).
●
How much of a quota was used.
●
Quota threshold.
File Service Product Operations Guide
●
55
Quota limit.
Procedure 2: Create a quota report using Windows Script Host The following sample script uses Windows Script Host to create a disk quota usage report. The Script is saved as a .vbs file and run from the command line. The output may be redirected to a CSV file for reporting. strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colQuotas = objWMIService.ExecQuery _ ("Select * from Win32_DiskQuota") For each objQuota in colQuotas cscript.Echo "Volume,User,Disk Space Used,aLimit,Status,Warning Limit" cscript.Echo objQuota.QuotaVolume & “,” & objQuota.User & “,” & objQuota.DiskSpaceUsed & “,“ & objQuota.Limit & “,” & objQuota.Status & “,” & objQuota.WarningLimit Next
When you view the quota status, there are three levels that can be reported: 0 (below quota warning level), 1 (above quota warning level), 2 (above quota limit). Dependencies ●
Quotas set on a volume.
●
Log event when a user exceeds his or her quota limit is checked.
●
Log event when a user exceeds his or her warning level is checked.
Technology Required ●
Fsutil.exe
●
Windows Script Host
Task: Create a service performance and usage report Purpose This task converts the performance service data into a report that can be used to support decision making.
Procedure 1: Calculate daily statistics 1. Import performance logs into Excel. 2. Calculate the daily average for each counter collected in the log. 3. In a new worksheet, record the daily average of the counters for each day of the month. 4. Use Excel’s graphing feature to create visuals that illustrate trends in performance. For clarity, it may be easier to calculate the daily statistics on a per-performance object basis. You should also consider that these reports will be used in evaluating SLAs, OLAs, and UCs.
56
Managing the Windows Server Platform
Procedure 2: Store data and reports 1. Store each month’s data in a single workbook for future reference. 2. Save the workbook to a file share on a file server that is under regular backup maintenance. Dependencies Performance logs documenting the service Technology Required Microsoft Excel or third-party spreadsheet application
Task: Create a system load and utility report Purpose Convert the file server resources usage data into a report that can be used to support decision making and resource allocation.
Procedure 1: Calculate daily statistics 1. Import service usage performance logs into Excel. 2. Calculate the daily average for each counter collected in the log. 3. In a new worksheet, record the daily average of the counters for each day of the month. 4. Use Excel’s graphing feature to create visuals that illustrate trends in performance. For clarity it may be easier to calculate the daily statistics on a per-performance object basis. You should create the following reports: ●
Logical disk usage report
●
Network usage report
●
Volume Shadow Copy service usage
Procedure 2: Store data and reports 1. Store each month’s data in a single workbook for future reference. 2. Save the workbook to a file share on a file server that is under regular backup maintenance. Dependencies Performance logs documented on file servers Technology Required Microsoft Excel or third-party spreadsheet application
File Service Product Operations Guide
Operating Quadrant
Directory Services Administration SMF
57
Operations Role Cluster
Daily
Process: Managing the directory Description Managing directory services involves the day-to-day process of providing for the safety, security, and functional operation of software and hardware components. Ensuring the safety and security of the hardware and software components is a critical issue and is covered in great detail in the MOF security document.
Task: Check status of DFS Purpose An implementation of Distributed File System (DFS) in an organization can contain multiple DFS roots, links, and target servers. It is important to understand the status of the DFS environment and report the status on a daily basis.
Procedure 1: View DFS status 1. Start DFS management console. 2. Check the status for each DFS root and link. DFS roots and links can have the following status: ●
A blue check mark on the root or link indicates that the root or link can be reached, as well as all of the targets.
●
A yellow exclamation point on the root or link indicates that the root or link can be reached but that not all of the targets may be reachable, either because DFS referral is disabled on the target or there is some other problem preventing access to the target.
●
A red cross on the root or link indicates that the root or link cannot be reached.
When you check the status of the target server, it will be either online or offline. Offline indicates that the target cannot be reached. 3. Right-click the target, and click Status. When you check the status of the target server, it will be either online or offline. Offline indicates that the target cannot be reached.
58
Managing the Windows Server Platform
Procedure 2: Check status of server These steps should be followed when the status of a DFS root server or a target server is reported as offline. 1. Run the PING utility from the command line or attempt connection using Terminal Service, or mounting an administrative share such as C$, to verify that the offline server can receive network communication. If this test fails, escalate the issue to the problem management team to get the server online. 2. Run Srvinfo.exe using the following command to make sure all the proper services are running srvinfo\\<servername>, where servername is the server reported as offline. 3. Log on to the server locally or over the network. Verify that you can log on to the server.
Procedure 3: Check DFS replication status for DFS roots having multiple targets (domain DFS) If you have configured domain DFS roots and have configured links with replicas, follow these steps to ensure that replication is enabled on the target replicas, since File Replication Services (FRS) handles replication of domain DFS. FRS causes high replication traffic and must be carefully scheduled to occur only during times of low network utilization. 1. Start the DFS management console. 2. Highlight the links that have been enabled for replication. A blue circular icon will be over links that have been enabled for replication. 3. Click Action and choose Show Replication Information. This will add a column in the right pane called File Replication. This will inform you if replication is enabled for this link. 4. To check the replication schedule, highlight the link, and click Properties. Dependencies ●
Domain DFS roots configured in the enterprise.
●
Links with multiple targets have been configured to replicate.
Technology Required ●
DFS MMC
●
Srvinfo.exe
File Service Product Operations Guide
Supporting Quadrant
Incident Management SMF
59
Support Role Cluster
Daily
Process: Investigation and diagnosis Description This process deals with investigating incidents and gathering diagnostic data. Its aim is to identify how an incident can be resolved as quickly as possible. The process allows for management escalation or functional escalation if either becomes necessary in order to meet SLA targets.
Task: Respond to daily service request Purpose Make sure all incidents are answered and there is an incident owner responsible for the incident life cycle. This serves the organization in two ways: ●
Customers understand that when an incident is reported, they will receive confirmation that someone from the incident management team has reviewed the request. This ensures that customers will continue to use the incident support channel set up in the organization.
●
Each incident has an owner responsible for collecting background information and doing preliminary troubleshooting. The owner is responsible for contacting other technical specialists to assist the customer in resolving the incident, documenting the incident, and making sure contributing technicians add their comments to the incident request. This ensures that there is a single point of contact for the incident from both the customer's and the organization's perspective.
Procedure 1: Acknowledge receipt of service request 1. Send the customer e-mail confirming receipt of an incident request. 2. Give the customer an incident case number prior to collecting data and troubleshooting the incident.
60
Managing the Windows Server Platform
Procedure 2: Document incident ●
Document the problem, the system affected, actions taken to troubleshoot the problem, and the plan to resolve the incident. The following are systems that can be affected in a file server environment: ●
File server
●
Share
●
Permissions
●
DFS
●
File Replication Services (FRS)
●
Volume Shadow Copy service
●
Disk capacity
Procedure 3: Update customer on status of incident ●
Send the customer e-mail, confirming the problem, system affected, actions taken to troubleshoot the problem, and the current plan to resolve the incident. If another technician is involved in troubleshooting, make sure the technician's notes are included as part of the case documentation.
Procedure 4: Close incident ●
If the incident is not resolved following the customer’s initial request for incident management, follow up with the customer and other technicians until the incident is resolved.
Dependencies ●
Incident ticketing system.
●
An SLA on the means that customers can use to request incident management— for example, through e-mail or a service phone number.
Technology Required ●
There are third-party tools that provide incident management ticketing functionality.
●
A Microsoft Access or SQL Server™ database can also be used to create incident tickets.
File Service Product Operations Guide
Changing Quadrant
Change Management SMF
61
Infrastructure Role Cluster
Daily
Process: Change classification and authorization Description After an RFC has passed the initial screening, the change manager must classify and authorize the RFC. The category assigned to the RFC is a reflection of the impact the change is likely to have on the IT environment. The priority level set for an RFC is a reflection of its urgency, and it determines how quickly the change advisory board (CAB) will review it. There are four change categories: minor, standard, significant, and major. There are also four categories of priority: low, medium, high, and emergency. Once an RFC has been classified, it must be authorized. The process of authorizing a change request depends on the category and priority of the change: ●
Emergency priority changes are escalated to the CAB/EC for fast-track approval.
●
Standard changes are approved automatically and progress directly to the change development and release phases.
●
Minor changes can be approved by the change manager without reference to the CAB.
●
All other changes must be approved by the CAB.
The two tasks that follow—attending a CAB meeting and reviewing an emergency change request—are among several tasks that would be associated with classification and authorization. Attending a CAB meeting is singled out because it is common to much of the change process. Reviewing an emergency change request is singled out because emergency changes typically involve high risk and require a great outlay of time and resources. More information about the other tasks, and about the change management process in general, is available at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/ms m/smf/smfchgmg.asp.
Task: Attend CAB meeting Purpose The CAB meets to review significant and major changes to the operations environment. From a file service perspective, change requests involving disk capacity, replication, and registry modifications, as well as updating antivirus software or adding a new file server to the environment, can be evaluated at this weekly meeting.
62
Managing the Windows Server Platform
It's important for a representative of the Infrastructure Role Cluster to attend the meeting in order to participate in the change management process. Participating in the process could include providing additional data regarding a particular file service RFC that members of the CAB may not have available to them. Additionally, it is important to be informed about other RFCs that may have an indirect effect on the delivery of file services and to consider these effects when approving an RFC for change development.
Procedure: Attend change review board meeting 1. Regularly attend the CAB meeting. 2. Consider the effect that any RFC may have on file service configuration items: ●
File server hardware
●
Domain controller hardware
●
Hardware vendor
●
Server role (file server or domain controller?)
●
Windows Server 2003 software
●
Service packs
●
Hotfixes
●
Antivirus software
●
Monitoring software
●
Backup software
●
Processes and procedures
●
Documentation
Dependencies ●
A process must be established to initiate a change request in the operations environment.
●
An identified CAB.
Technology Required Operations team educated about MOF/ITIL.
Task: Review emergency change request Purpose Provide guidance to the change advisory board emergency committee (CAB/EC) on processing an emergency RFC. The number of emergency change requests should be kept to a minimum because they typically involve high risk and require a great outlay of time and resources.
File Service Product Operations Guide
63
Emergency changes to file services can have a great impact on a large number of users and they can affect business processes that depend on file services. For this reason it is very import to create a change request process that emphasizes prioritizing and attending to urgent problems associated with file services. The Infrastructure Role Cluster is responsible for this task, but the request for emergency change can be initiated by any of the six Team Model role clusters. An emergency change request could involve the release of updates to the operating system, thirdparty applications, or configuration changes.
Procedure: Contact CAB/EC 1. Confirm that the server has a successful server backup before contacting the CAB/EC members. 2. Select CAB/EC members. This should include standing members of the CAB as well as those members who can give the greatest guidance to file services. 3. Notify the CAB/EC of the emergency change request. Each member of the CAB/EC identified in Step 2 must be notified of the emergency change request. It is important that every attempt be made to contact each member of the CAB/EC either by e-mail, mobile device, or other communication methods. The member should be given an expected time in which to respond to the emergency change request and general information about the change request. 4. Review the RFC. Collect all information pertaining to changes to file services including asking for additional information from the change initiator. The CAB/EC should consider the impact that the change has on file services and weigh the risk associated with making an emergency change to the file system versus making a standard change. The type of change that could be made include: ●
Applying service packs.
●
Adding a new file server.
●
Adding a new DFS root.
●
Adding new partitions.
●
Adding new disks.
●
Adjusting quota setting above policy.
●
Modifying Volume Shadow Copy service schedule.
●
Changing backup and restore procedures.
●
Modifying and applying policies.
●
Changing other existing settings.
●
Changing a process or script used to administer servers.
64
Managing the Windows Server Platform
Along with change type, collect the configuration item that will be affected by the change. Configuration items are objects that are subject to change. Any item that has the possibility of changing falls under change management. For file servers, these items include: ●
File server hardware
●
Domain controller hardware
●
Hardware vendor
●
Server role (file server or domain controller?)
●
Windows Server 2003 software
●
Service packs
●
Hotfixes
●
Antivirus software
●
Monitoring software
●
Backup software
●
Processes and procedures
●
Documentation
●
RFCs
Dependencies ●
A process must be established to initiate a change request in the operational environment.
●
An identified CAB/EC roster and individuals who are contacted for emergency changes as they relate to file services.
Technology Required Operations team educated about MOF/ITIL.
File Service Product Operations Guide
Changing Quadrant
Configuration Management SMF
65
Infrastructure Role Cluster
Weekly
Process: Reviewing configuration items Description Because the accuracy of the information stored in the configuration management database (CMDB) is crucial to the success of Change Management, Incident Management, and other SMFs, a review process should be set up to ensure that the database accurately reflects the production IT environment.
Task: Capture configuration snapshot Purpose This task configures the file server to provide a point-in-time view of the file server.
Procedure 1: Run Srvinfo for all file servers To get system information, shared folders, disk capacity, services currently running, network protocols, and system uptime use Srvinfo.exe. At the command line run: srvinfo –s \\<servername .>
Procedure 2: Export local security polices 1. Start Local Security Policies MMC and expand the Local Policies node. 2. Highlight Audit Policy, then right-click and select Export List. Save the export to a secure file share. 3. Highlight User Right Assignment, then right-click and select Export List. Save the export to a secure file share. 4. Highlight Security Options, then right-click and select Export List. Save the export to a secure file share.
66
Managing the Windows Server Platform
Procedure 3: Create report of installed software The following sample script can be used to create a report of the software installed on the file server using Windows Installer. SMS is a good alternative to enumerate installed applications, window components, and patches. This is especially useful for large in environments.
Set objFSO = CreateObject("Scripting.FileSystemObject") Set objTextFile = objFSO.CreateTextFile("filename", True) strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colSoftware = objWMIService.ExecQuery _ ("Select * from Win32_Product") objTextFile.WriteLine "Caption" & vbtab & _ "Description" & vbtab & "Identifying Number" & vbtab & _ "Install Date" & vbtab & "Install Location" & vbtab & _ "Install State" & vbtab & "Name" & vbtab & _ "Package Cache" & vbtab & "SKU Number" & vbtab & "Vendor" & vbtab _ & "Version" For Each objSoftware in colSoftware objTextFile.WriteLine objSoftware.Caption & vbtab & _ objSoftware.Description & vbtab & _ objSoftware.IdentifyingNumber & vbtab & _ objSoftware.InstallDate2 & vbtab & _ objSoftware.InstallLocation & vbtab & _ objSoftware.InstallState & vbtab & _ objSoftware.Name & vbtab & _ objSoftware.PackageCache & vbtab & _ objSoftware.SKUNumber & vbtab & _ objSoftware.Vendor & vbtab & _ objSoftware.Version Next objTextFile.Close
This sample script may produce an error if there are no MSI installed applications.
Procedure 4: Create report of installed hotfixes The following sample script can be used to create a report of the software installed on the file server using the Windows Installer: strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colQuickFixes = objWMIService.ExecQuery _ ("Select * from Win32_QuickFixEngineering") For Each objQuickFix in colQuickFixes cscript.Echo "Computer: " & objQuickFix.CSName cscript.Echo "Description: " & objQuickFix.Description cscript.Echo "Hot Fix ID: " & objQuickFix.HotFixID cscript.Echo "Installation Date: " & objQuickFix.InstallDate cscript.Echo "Installed By: " & objQuickFix.InstalledBy Next
Dependencies MSI installed software
File Service Product Operations Guide
Technology Required ●
Srvinfo.exe
●
Local security policies
●
Windows Management Instrumentation (WMI)
67
4 Processes by MOF Role Clusters This chapter is designed for those who want to see all processes for a single role cluster in one place. The information is the same as that in the previous two chapters. The only difference is that the processes are ordered by MOF role cluster.
Operations Role Cluster Daily Processes Process 1: Problem recording and classification Task: Review daily problem management report Process 2: Managing resources and service performance Task 1: Capture service performance statistics Task 2: Capture service usage statistics Weekly Processes Process 1: Incident closure Task: Roll up activity report into monthly metric Process 2: Design for recovery Task: Update automated system recovery (ASR) backup Monthly Processes Process: Managing resources and service performance Task 1: Create quota report Task 2: Create a quota report using WMI Task 3: Create system performance and usage report Quarterly Processes Process: Data backup, restore, and recovery operations
File Service Product Operations Guide
69
Task: Verify restore As-Needed Processes Process: Data backup, restore, and recovery operations Task: Verify restore
Support Role Cluster Daily Processes Process 1: Data backup, restore, and recovery operations Task: Run daily incremental backup Process 2: Investigation and diagnosis Task: Respond to daily service request Weekly Processes Process 1: Investigation and diagnosis Task: Create weekly service activity report Process 2: Data backup, restore, and recovery operations Task: Run weekly normal backup Monthly Processes There are no monthly processes for this role cluster. As-Needed Processes There are no as-needed processes for this role cluster.
Release Role Cluster Daily Processes There are no daily processes for this role cluster. Weekly Processes There are no weekly processes for this role cluster. Monthly Processes There are no monthly processes for this role cluster. As-Needed Processes There are no as-needed processes for this role cluster.
70
Managing the Windows Server Platform
Infrastructure Role Cluster Daily Processes Process 1: Maintaining the directory Task: Back up DFS namespace configuration Process 2: Storage resource management Task: Monitor available disk space Process 3: Maintaining the directory Task: Back up DFS namespace configuration Process 3: Perform monitoring Task 1: Review quota levels Task 2: Verify previous day's backup job Process 4: Change classification Task: Review emergency change request Weekly Processes Process 1: Storage resource management Task: Review disk fragmentation Process 2: Managing resources and service performance Task: Capture size of DFS namespace Process 3: Change classification and authorization Task: Attend change management review board meeting Process 4: Reviewing configuration items Task: Capture configuration snapshot Monthly Processes Process: Managing resources and service performance Task 1: Create a quota report Task 2: Create a service performance and usage report Task 3: Create a system load and utility report As-Needed Processes There are no as-needed processes for this role cluster.
File Service Product Operations Guide
71
Security Role Cluster Daily Processes There are no daily processes for this role cluster. Weekly Processes There are no weekly processes for this role cluster. Monthly Processes There are no monthly processes for this role cluster. As-Needed Processes There are no as-needed processes for this role cluster.
Partner Role Cluster Daily Processes There are no daily processes for this role cluster. Weekly Processes There are no weekly processes for this role cluster. Monthly Processes There are no monthly processes for this role cluster. As-Needed Processes There are no as-needed processes for this role cluster.
5 Troubleshooting Overview The following table contains troubleshooting tips that should be useful in maintaining this product. The tips are based on known issues and follow the best practices for troubleshooting and problem management outlined by the Incident Management and Problem Management SMFs, both of which are found in the MOF Supporting Quadrant.
Problem #1: “Path not found” or empty folder Description of Problem When you work with a DFS shared folder, you may receive a “Path Not found” error message or you may see an empty folder. This may happen when you try to do the following: ●
Try to open a file in a DFS shared folder.
●
Try to find a file in a DFS shared folder. Cause of Problem
This problem occurs when the DFS link portion of the path contains more than one long path element, and at least one long path element is referred to by the short pathname equivalent. Resolution of Problem There are two ways to resolve this problem: ●
Always use long path names when you work with shared folders that are under DFS links containing long path elements.
●
Use short path elements only when you create DFS links.
File Service Product Operations Guide
73
Problem #2: Slow connection time Description of Problem When you use DFS, your clients might take a long time to be connected to one of the DFS servers. This can occur under the following conditions: ●
The site the client is in does not have a DFS server for the volume in question.
●
Your network is not fully routed.
●
The client is not site-aware. Cause of Problem
This problem is caused when the DFS referral server provides a list of servers to the client. If there is no DFS server with this volume in the site of the client, the list is sorted randomly. The client walks this list until it finds the first accessible server. If the percentage of unreachable servers is high and there are many servers, finding the first working server can take several minutes. Resolution of Problem Several methods can be used to resolve this problem: ●
Use a user account from the local domain to log on. A local DFS server should be found for the policy access.
●
Install DFS servers in the location where the logon is made.
●
Extend the network to be fully routed. Note: this may be very expensive.
●
If no access to local data is required, the users can log on to terminal servers in locations where a DFS server with the desired volume is located.
74
Managing the Windows Server Platform
Problem #3: How to troubleshoot FRS-enabled DFS directories Description of Problem These are generic steps that can be used to troubleshoot File Replication Services (FRS)-enabled DFS directories. Resolution of Problem 1.
Verify Microsoft Active Directory® directory service replication. Active Directory replication must be fully functional between hub and spoke data centers by running repadmin/showreps against all computers in the hub and branch sites. Pipe the output so you can identify the tool and computer being targeted. Do not proceed until Active Directory is functional.
2.
Verify FRS dependencies
3.
Run Ntfrsutl ds against all hub and branch data centers. In this step, you are looking for missing FRS objects or attributes—including FRS member, FRS subscriber, and ServerRef. Compare Ntfrsutl output to a working computer until you are sure what to look for.
4.
Verify replication topology and schedule
5.
Verify that all computers are included in the replication topology (compare against a reference list to see that computers deployed in the field are known in the data center This information should be contained in the configuration management database (CMDB).
6.
Examine the environment for any known configurations that generate excessive replication of FRS replicated files (DFS + SYSVOL). General symptoms of this problem are: ●
The revision number for policy is constantly incrementing. In extreme cases, the number of revisions shows hundreds or even thousands of changes.
●
FRS replicated content is replicated excessively with no apparent change to the Group Policy or the files being replicated. In the case of SYSVOL, an excessive number of full syncs of policy take place for no apparent reason.
●
The number of files in the staging directory constantly grows, then empties when the replication schedule opens and replication can take place.
●
The number of files in the staging directory constantly grows but never empties if changes to downstream partners cannot be replicated either because of network connectivity or some other error condition.
●
Network traffic between replication partners is consuming excessive network bandwidth and FRS is identified as the source.
●
Excessive disk I/O until FRS service is stopped.
File Service Product Operations Guide
75
Problem #4: Using Defrag.exe on a disk that hosts FRSreplicated content Description of Problem When using the Disk Defragmenter tool (Defrag.exe) on a disk that hosts FRSreplicated content, the following symptoms may occur: ●
Files in SYSVOL and DFS shares are replicated excessively and there is no apparent change to the files.
●
File may replicate during off-peak hours, but at regularly occurring times if you schedule disk defragmentation to run during specific time or periods of low server usage.
●
The number of files in the staging folder constantly grows, and then empties after the disk defragmentation utility is completed, or the FRS schedule opens to allow replication.
●
The number of files in the staging folder constantly grows but never empties if changes to downstream partners cannot be replicated either because of network connectivity or some other error conditions.
●
Network traffic between replication partners is consuming excessive network bandwidth as a result of FRS. Resolution of Problem
1.
Search the NTFRS outbound log by using the Ntfrsutl and the iologsum.cmd (included in the Windows 2003 Support Tools).
2.
Identify the computer that is originating the excessive updates, and then use Ntfrsutl to empty the FRS outbound log. From a command prompt type: Ntfrsutl outlog>outlog.txt
3.
Use the iologsum.cmd FRS troubleshooting utility to structure the outlog file that was just created. At the command prompt, type: iologsum –sort=eventtime outlog.txt
Note Use iologsum.cmd /? to get a list of the switches to use to summarize the pending change orders.
76
Managing the Windows Server Platform
Problem #5: DFS links not visible Description of Problem When you view the DFS root in the DFS snap-in, all the DFS links are listed. However, when you connect to the DFS root share, none of the DFS links may be visible. When you browse the DFS root folder on the server, the local file system placeholders that represent the DFS links may be missing. Cause of Problem This issue can occur if the 8.3 file name creation functionality is disabled in NTFS. Resolution of Problem 1.
Start Registry Editor (Regedt32.exe).
2.
Locate the NtfsDisable8dot3NameCreation value under the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
3.
On the Edit menu, click DWORD, press 0 and then click OK.
4.
Quit Registry Editor and restart the server.
File Service Product Operations Guide
77
Problem #6: DFS root does not appear in MMC Description of Problem When you start DFS MMC, the DFS root does not appear. If you try to locate the DFS root in DFS MMC, you receive the following error message: ●
The specified domain either does not exist or could not be contacted.
●
You receive this error message if you enter the name either as a NetBIOS host name or as a fully qualified domain name (FQDN).
●
If you use the Dfscmd tool to add a DFS link, you receive the following error message: dfscmd /map \\dfsname\dfsshare\path \\server\share\path returns "System error 2662 has occurred". Cause of Problem
This problem may occur if the following registry key is set on one or all of the servers that are hosting the DFS namespace after the namespace has already been defined: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DFS Value name: DfsDnsConfig Type: REG_DWORD Value: 1 Resolution of Problem 1.
Start Registry Editor (Regedt32.exe)
2.
Locate and then click the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DFS
3.
Double-click the DfsDnsConfig value, press 0 in the Value data box, and then click OK.
4.
Quit Registry Editor.
78
Managing the Windows Server Platform
Problem #7: NTFS file system log file size bottlenecks Description of Problem These are steps to identify and troubleshoot NTFS file system log file size bottlenecks. Cause of Problem When a Windows Server 2003 file server is under a heavy load or stress, the NTFS file system log file may not flush the disk in time and, as a result, becomes full. NTFS file system operations do not continue until the log file is completely flushed to disk. Resolution of Problem 1.
Check the performance logs and alerts to view the activity of the “Current Disk Queue Length” for the appropriate PhysicalDisk object. If the performance data shows constant high disk queue length values that intermittently drop to a value of exactly one for a while and then increase again, this is an indication that the NTFS file system log file is full and must be flushed.
2.
3.
Increase the performance of the disk subsystem. ●
Install additional disks, or upgrade the existing hard disks. Update the bus and disk controllers.
●
Use striped volumes on several physical disks to increase throughput.
Increase the NTFS log file size. To do so, type the following at a command prompt: chkdsk /l:<size>
If stress on the disk subsystem continues to be high, the log file may eventually become full again. Use this method if stress on the disk system is temporary.
File Service Product Operations Guide
79
Problem #8: Excessive CPU use by Clussvc.exe or Rsrcmon.exe Description of Problem If you define hundreds of file share resources within a cluster, one or more nodes in the cluster may begin to provide reduced performance. When this occurs, Task Manager may report excessive CPU use by either the Clussvc.exe or Rsrcmon.exe processes. On some clusters, several hundred resources may consume enough overhead to impact performance. The number of total resources that a cluster may process without significant overhead varies based on the abilities of the hardware. Cause of Problem On some clusters, several hundred resources may consume enough overhead to impact performance. The number of total resources that a cluster may process without significant overhead varies based on the abilities of the hardware. Resolution of Problem The most efficient way to create many file shares on a cluster is to create sub-folder shares because this option can significantly reduce the number of resources and overhead. This option also simplifies administration and disaster recovery. If you must use individual file share resources for several hundred shares, it may be necessary to add more CPUs or memory to the server.
80
Managing the Windows Server Platform
Problem #9: "A DFS root already exists in this cluster node" Description of Problem After you use the Cluster Administrator tool to configure a file share resource as a DFS root, you may receive the following error message: Cluster Administrator Standard Extension: An error occurred attempting to set properties: A DFS root already exists in this cluster node. Error ID: 5088 (000013e0). Cause of Problem This issue can occur if a DFS root is already configured on either of the nodes and has not been deleted. DFS permits only one root per server cluster. Resolution of Problem ●
If the DFS root is not a cluster resource, in DFS Manager, right-click the root configured, and then click Delete Root.
●
If the DFS root is a cluster resource, take the resource offline, configure it to be a normal share, and then bring the resource online or delete the resource if the share is not needed.
Note To update the DFS root settings on the other nodes, move the group that contains the old DFS root to the other node.
File Service Product Operations Guide
81
Problem #10: DNS name problems Description of Problem After you log on to a Windows 2000-based computer with cached credentials and then connect to a network (either by using remote access or by re-attaching the network cable) while you attempt to connect to a domain-based DFS root, you experience the following symptoms: ●
You receive the following error messages: A duplicate name exists on the network. The network name could not be found.
●
The domain DNS name for your server and the NetBIOS name for your server may not match. For example, the DNS name may be
This problem is caused by the following two conditions: ●
The domain DNS name and NetBIOS name are not the same. For example, the DNS name is
●
The client does not have any cached DFS information because the network was connected and initialized. The client will attempt to fill this cache every 15 minutes. To view this cache, use the DFS utility, DFSutil.exe, from the Windows Server 2003 Resource Kit. Cause of Problem
This problem is caused by the following two conditions: ●
The domain DNS name and NetBIOS name are not the same. For example, the DNS name is
●
The client does not have any cached DFS information because the network was connected and initialized. The client will attempt to fill this cache every 15 minutes. To view this cache, use the DFS utility, DFSutil.exe, from the Windows Server 2003 Resource Kit. Resolution of Problem
●
Make the NetBIOS and DNS name of the server the same. For example, if the DNS name is
Related Documents
File Server Operational Guide
November 2019 16
Print Server Operational Guide
November 2019 13
Wins Server Operational Guide
November 2019 9
File Server
May 2020 10
Server Guide
May 2020 15