11 Microsoft Internet Security and Acceleration Metrics

This chapter provides descriptions for all Microsoft Internet Security and Acceleration (ISA) metric categories, and tables list and describe associated metrics for each category. The tables also provide user actions if any of the metrics for a particular category support user actions.

Firewall Packet Engine Metrics

The metrics in this category provide performance information for the firewall engine.

Table 11-1 Firewall Packet Engine Metrics

Metric	Description and User Action
Active Connections	Total number of active connections currently passing data.
Allowed Packets Per Sec	Number of packets per second that the ISA server allows to pass.
Bytes Per Sec	Number of bytes passed through the ISA server per second.
Connections Per Sec	Number of new connections created per second.
Dropped Packets Per Sec	Number of packets the ISA server dropped per second. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Packets Per Sec	Number of packets the ISA server inspected per second. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
TCP Established Connections Per Sec	Number of Transmission Control Protocol (TCP) connections newly established per second. A TCP connection is counted as established after the 3-way SYN handshake was completed successfully.

Firewall Service Metrics

The metrics in the this category provide performance information about the firewall service.

Table 11-2 Firewall Service Metrics

Metric	Description and User Action
Accepting TCP Connections	Number of connection objects that wait for a Transmission Control Protocol (TCP) connection from firewall clients.
Active Sessions	Number of active sessions for the firewall service.
Active TCP Connections	Total number of active TCP connections currently passing data. Connections pending or not yet established are counted elsewhere.
Active UDP Connections	Total number of active User Datagram Protocol (UDP) connections.
Available UDP Mappings	Number of available UDP mappings.
Available Worker Threads	Number of firewall worker threads that are available or waiting in the completion port queue. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Bytes Read Per Sec	Number of bytes read by the data pump per second.
Bytes Written Per Sec	Number of bytes written by the data pump per second.
DNS Cache Entries	Current number of DNS domain name entries cached as result of firewall service activity. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
DNS Cache Flushes	Number of times the firewall service has flushed or cleared the DNS domain name cache. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
DNS Cache Hits	Total number of times the firewall service found a DNS domain name within the DNS cache. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
DNS Cache Hits %	Percentage of DNS domain names serviced by the DNS cache from the total of all DNS entries that the firewall service has retrieved. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
DNS Retrievals	Total number of DNS domain names that the firewall service has retrieved. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Failed DNS Resolutions	Number of gethostbyname and gethostbyaddr API calls that have failed. These calls resolved host DNS domain names and IP addresses for firewall service connections. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Kernel Mode Data Pumps	Number of kernel mode data pumps the firewall service created.
Listening TCP Connections	Number of connection objects that waited for TCP connections from remote Internet computers.
Pending DNS Resolutions	Number of pending DNS resolutions.
Pending TCP Connections	Number of pending top connections.
Secure NAT Mappings	Number of mappings created by SecureNAT.
Successful DNS Resolutions	Number of successful DNS name resolutions.
TCP Bytes Transferred Per Sec By Kernel Mode Data Pump	Number of bytes transferred by TCP per second via the kernel mode data pump.
TCP Connections Awaiting Inbound Connect Call To Finish	Number of TCP connections awaiting an inbound connection call to finish. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
UDP Bytes Transferred Per Sec By Kernel Mode Data Pump	Number of bytes transferred by TCP per second via the kernel mode data pump.
Worker Threads	Number of currently active firewall worker threads.

H.323 Filter Metrics

The metrics in this category provide information about the active and total calls to the H.323 filter.

Table 11-3 H.323 Filter Metrics

Metric	Description and User Action
Active H.323 Calls	Displays currently active H.323 calls. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Total H.323 Calls	Displays all H.323 calls handled by the H.323 filter since the ISA server computer was started.

ISA Server Error Events Metrics

The metrics in this category provide information about the error events the ISA server generates.

Table 11-4 ISA Server Error Events Metrics

Metric	Description
Date-Time	Date and time when the error was generated.
Description	Description text of the error that is mentioned in the event log file.
Event ID	Every error generated has an event ID or record number. Using this event ID, you can search for more information on the web and MSN technet.
Log Name	Name of the log file where the error was generated.
Source	Component that generated the error (that is, NTDS intersite messaging).
Windows Event Security	Severity of the error.

ISA Server Warning Events Metrics

The metrics in this category provide information about the warning events the ISA server generates.

Table 11-5 ISA Server Warning Events Metrics

Metric	Description
Date-Time	Date and time when the warning was generated.
Description	Description text of the warning that is mentioned in the event log file.
Event ID	Every warning generated has an event ID or record number. Using this event ID, you can search for more information on the web and MSN technet.
Log Name	Name of the log file where the warning was generated.
Source	Component that generated the warning (that is, NTDS intersite messaging).
Windows Event Severity	Severity of the warning.

ISASTGCTRL Server Error Events Metrics

The metrics in this category show the error events generated by the ISASTGCTRL service in the event log file. The Windows ISASTGCTRL service manages read and write access to the Configuration Storage server information.

Table 11-6 ISASTGCTRL Server Error Events Metrics

Metric	Description
Date-Time	Date and time when the error was generated.
Description	Description text of the error that is mentioned in the event log file.
Event ID	Every error generated has an event ID or record number. Using this event ID, you can search for more information on the web and MSN technet.
Log Name	Name of the log file where the error was generated.
Source	Component that generated the error (that is, NTDS intersite messaging).
Windows Event Severity	Severity of the error.

ISASTGCTRL Server Warning Events Metrics

The metrics in this category show the warning events generated by the ISASTGCTRL service in the event log file. The Windows ISASTGCTRL service manages read and write access to the Configuration Storage server information.

Table 11-7 ISA Server Warning Events Metrics

Metric	Description
Date-Time	Date and time when the warning was generated.
Description	Description text of the warning that is mentioned in the event log file.
Event ID	Every warning generated has an event ID or record number. Using this event ID, you can search for more information on the web and MSN technet.
Log Name	Name of the log file where the warning was generated.
Source	Component that generated the warning (that is, NTDS intersite messaging).
Windows Event Severity	Severity of the warning.

Process Metrics

The metrics in this category provide information about the important ISA server processes.

Table 11-8 Process Metrics

Metric	Description and User Action
Creating Process ID	Process ID of the process that created the process.
Elapsed Time	Total elapsed time, in seconds, that this process has been running.
Handle Count	Total number of handles currently open by this process. This number is equal to the sum of the handles currently open by each thread in the process. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
ID Process	Unique identifier of this process. ID process numbers are reused, so they only identify a process for the lifetime of that process.
IO Data Bytes Per Sec	Rate at which the process is reading and writing bytes in I/O operations. This counter counts all I/O activity generated by the process to include file, network, and device I/Os.
IO Data Operations Per Sec	Rate at which the process is issuing read and write I/O operations. This counter counts all I/O activity generated by the process to include file, network, and device I/Os.
IO Other Bytes Per Sec	Rate at which the process is issuing bytes to I/O operations that do not involve data such as control operations. This counter counts all I/O activity generated by the process to include file, network, and device I/Os.
IO Other Operations Per Sec	Rate at which the process is issuing I/O operations that are neither read nor write operations (for example, a control function). This counter counts all I/O activity generated by the process to include file, network, and device I/Os.
IO Read Bytes Per Sec	Rate at which the process is reading bytes from I/O operations. This counter counts all I/O activity generated by the process to include file, network, and device I/Os.
IO Read Operations Per Sec	Rate at which the process is issuing read I/O operations. This counter counts all I/O activity generated by the process to include file, network, and device I/Os.
IO Write Bytes Per Sec	Rate at which the process is writing bytes to I/O operations. This counter counts all I/O activity generated by the process to include file, network, and device I/Os.
IO Write Operations Per Sec	Rate at which the process is issuing write I/O operations. This counter counts all I/O activity generated by the process to include file, network, and device I/Os.
Page Faults Per Sec	Rate at which page faults are occurring from the threads executing in this process. A page fault occurs when a thread refers to a virtual memory page that is not in its working set in main memory. This may not cause the page to be fetched from disk if it is on the standby list and therefore already in main memory, or if it is in use by another process with which the page is shared.
Page File Bytes	Current amount of virtual memory, in bytes, that this process has reserved for use in the paging file(s). Paging files store pages of memory used by the process that are not contained in other files. All processes share paging files, and the lack of space in paging files can prevent other processes from allocating memory. If there is no paging file, this counter reflects the current amount of virtual memory that the process has reserved for use in physical memory.
Page File Bytes Peak	Maximum amount of virtual memory, in bytes, that this process has reserved for use in the paging file(s). Paging files store pages of memory used by the process that are not contained in other files. Paging files are shared by all processes, and the lack of space in paging files can prevent other processes from allocating memory. If there is no paging file, this counter reflects the maximum amount of virtual memory that the process has reserved for use in physical memory.
Percent Privileged Time	Percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service is called, the service often runs in privileged mode to gain access to system-private data. This data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process.
Percent Processor Time	Percentage of elapsed time that all of process threads used the processor to execute instructions. An instruction is the basic unit of execution in a computer, a thread is the object that executes instructions, and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Percent User Time	Percentage of elapsed time that the process threads spent executing code in user mode. Applications, environment subsystems, and integral subsystems execute in user mode. Code executing in user mode cannot damage the integrity of the Windows executive, kernel, and device drivers. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process.
Private Bytes	Current size, in bytes, of memory that this process has allocated that cannot be shared with other processes. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Thread Count	Number of threads currently active in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread.
Virtual Bytes	Current size, in bytes, of the virtual address space the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and the process can limit its ability to load libraries. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Virtual Bytes Peak	Maximum size, in bytes, of virtual address space the process has used at any one time. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. However, virtual space is finite, and the process might limit its ability to load libraries.
Working Set	Current size, in bytes, of the Working Set of this process. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed, they will then be soft-faulted back into the Working Set before leaving main memory.
Working Set Peak	Maximum size, in bytes, of the Working Set of this process at any point in time. The Working Set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a threshold, pages are left in the Working Set of a process even if they are not in use. When free memory falls below a threshold, pages are trimmed from Working Sets. If they are needed, they will then be soft-faulted back into the Working Set before they leave main memory.

Web Proxy Service Metrics

The Web Proxy Service enables any Worldwide Web client to access internet resources using the HTTP, HTTPS, Gopher, and FTP protocols on behalf of the client.

Table 11-9 Web Proxy Service Metrics

Metric	Description and User Action
Array Bytes Received Per Sec	Tracks the rate at which data bytes are received from other ISA Server computers within the same array.
Array Bytes Sent Per Sec	Tracks the rate at which data bytes are sent from other ISA Server computers within the same array.
Average Current Array Fetches Time Per Request (Millisec)	Represents the sum of Array Bytes Sent/Sec and Array Bytes Received/Sec. This is the total rate for all data bytes transferred between the ISA Server computer and other members of the same array.
Cache Hit Percent Ratio	Determines how many Web Proxy client requests have been served using cached data (Total Cache Fetches) as a percentage of the total number of successful Web Proxy client requests to the ISA Server computer (Total Successful Requests). Its value provides a good indication of cache effectiveness. A high metric indicates that a high level of requests are being serviced from the cache, meaning faster response times. A zero metric indicates that caching is not enabled. A low metric may indicate a configuration problem. The cache size may be too small, or requests may not be cacheable. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Cache Running Hit Ratio	Measures the amount of requests served from the cache as a percentage of total successful requests serviced. This ratio is the same as that measured by Cache Hit Ratio(%). The difference between these two metrics is that Cache Running Hit Ratio measures this ratio for the last 10,000 requests serviced, and Cache Hit Ratio measures this ratio since the last time that the Web Proxy service started. This means that Cache Running Hit Ratio provides a more dynamic evaluation of cache effectiveness.
Client Bytes Received Per Sec	Rate at which data bytes are received from Web Proxy clients. The value changes according to the volume of Web Proxy client requests, but a consistently slow rate may indicate a delay in servicing requests.
Client Bytes Sent Per Sec	Rate at which data bytes are sent to Web Proxy clients. The value changes according to the volume of Web Proxy client requests, but a consistently slow rate may indicate a delay in servicing requests.
Current Array Fetches Average Time Per Request (Millisec)	Provides the mean number of milliseconds required to service a Web Proxy client request that is fetched through another array member. This does not include requests for services by the Secure Sockets Layer (SSL) tunnel.
Current Average Time Per Request (Millisec)	Represents the mean number of milliseconds required to service a Web Proxy client request, not including requests serviced by the SSL tunnel. This counter can be monitored at peak and off-peak times for a comprehensive picture of how fast client requests are being serviced. A counter that is too high might indicate that the ISA Server is having difficulty handling all requests and that requests are being delayed.
Current Cache Fetches Average Time Per Request (Millisec)	Mean number of milliseconds required to service a Web Proxy client request from cache. This does not include requests for services by the Secure Sockets Layer (SSL) tunnel. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Current Direct Fetches Average Time Per Request (Millisec)	Mean number of milliseconds required to service a Web Proxy client request directly to the Web server or upstream proxy. This does not include requests for services by the Secure Sockets Layer (SSL) tunnel. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
DNS Cache Entries	Details the current number of DNS domain name entries cached by the Web Proxy service. A high metric suggests a beneficial impact on performance, since a DNS cache entry eliminates the need for a DNS lookup, saving system resources.
DNS Cache Flushes	Details the total number of times that the DNS domain name cache has been flushed or cleared by the Web Proxy service. When there is no room left for more data in the DNS cache, the DNS cache is flushed to allow new entries to be made.
DNS Cache Hits	Tracks the total number of times the Web Proxy service found a DNS domain name within the DNS cache. This metric can be compared with previous DNS counters to find out if DNS caching is working efficiently. A low number of DNS cache hits impact performance, as every DNS lookup slows performance, particularly if a problem arises in the lookup process.
DNS Cache Hits Percent	Determines how many DNS entries have been resolved using cached data (DNS cache hits) as a percentage of the total number of DNS domain names retrieved by the Web Proxy service (DNS retrievals). A high metric means better performance because the DNS data is served from the cache, rather than incurring the overhead of resolving DNS lookups. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
DNS Retrievals	Represents the total number of DNS domain names that the Web Proxy service has retrieved.
Failing Requests Per Sec	Monitors the rate per second that Web Proxy client requests have completed with some type of error. This counter can be compared with Requests/Sec to indicate how well the ISA Server is servicing incoming Web requests. A high failure rate, in comparison to the rate of incoming requests, suggests that the ISA Server is having difficulty coping with all incoming requests. Connection settings for incoming Web requests may be incorrectly configured, or connection bandwidth may be insufficient.
FTP Requests	Tracks the number of File Transfer Protocol (FTP) requests made to the Web Proxy service. A consistently low counter may influence the caching policy for FTP objects.
Gopher Requests	Tracks the number of Gopher requests that have been made to the Web Proxy service.
HTTP Requests	Tracks the number of Hypertext Transfer Protocol (HTTP) requests that have been made to the Web Proxy service.
HTTPS Sessions	Represents the total number of Secure Hypertext Transfer Protocol (HTTPS) secured sessions serviced by the SSL tunnel.
Maximum Users	Tracks the maximum number of users that have connected to the Web Proxy service simultaneously. This counter can be useful for determining load usage and license requirements.
Requests Per Sec	Monitors the rate or incoming requests made to the Web Proxy service. A higher value means that more ISA Server resources will be required to service incoming requests.
Reverse Bytes Received Per Sec	Monitors the rate at which data bytes are received by the Web Proxy service from Web publishing servers in response to incoming requests. This rate can be monitored at peak and off-peak times as an indication of how the ISA Server is performing in servicing incoming Web requests.
Reverse Bytes Sent Per Sec	Monitors the rate at which data bytes are sent by the Web Proxy service to Web publishing servers in response to incoming requests. This rate can be monitored at peak and off-peak times as an indication of how the ISA Server is performing in servicing incoming Web requests.
Site Access Denied	Tracks the total number of Internet sites to which the Web Proxy service has denied access. An excessively high number might indicate an access policy that is too restrictive. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Site Access Granted	Tracks the total number of Internet sites to which the Web Proxy service has granted access. This can be compared with Site Access Denied to provide a numeric summary of the results of access policy configuration.
SNEWS Sessions	Represents the total number of SNEWS sessions serviced by the SSL tunnel.
SSL Client Bytes Received Per Sec	Measures the rate at which SSL data bytes are received by the Web Proxy service from secured Web Proxy clients. This is similar to Client Bytes Received/Sec, but counts only SSL requests.
SSL Client Bytes Sent Per Sec	Measures the rate at which SSL data bytes are sent by the Web Proxy service to secured Web Proxy clients. This is similar to Client Bytes Sent/Sec, but counts only SSL requests.
SSL Client Bytes Total Per Sec	Represents the sum of SSL Client Bytes Sent/Sec and SSL Client Bytes Received/Sec. This is the total rate for all bytes transferred between the Web Proxy service and SSL clients.
Thread Pool Active Sessions	Represents the number of sessions that thread pool threads are actively servicing.
Thread Pool Failures	Represents the number of requests rejected because the thread pool was full. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Thread Pool Size	Represents the number of threads in the thread pool. This thread pool represents the resources available to service client requests.
Total Array Fetches	Totals the number of Web Proxy client requests served by requesting the data from another ISA Server within this array. These requests are the result of the Cache Array Routing Protocol (CARP) algorithm, which randomly stores objects in any of the member servers cache. This metric is influenced by the cache size for each ISA Server in the array, since a server with a larger cache holds more cache items. The load factor for each server can also be configured to determine how workload is divided among array members.
Total Cache Fetches	Monitors the total number of Web Proxy client requests served by using cached data. A high number indicates a cache being fully exploited.
Total Failed Requests	Represents the total number of requests that the Web Proxy service has failed to process due to errors. Errors can result from the Web Proxy service failing to locate a requested server URL on the Internet, or because the client did not have authorized access to the requested URL. This metric should be far lower than Total Successful Requests. If it is not, this indicates that the ISA Server is failing to service requests effectively. This could be a configuration problem, indicate a connection that is too slow, or indicate an access policy that is too restrictive. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Total Pending Connects	Total number of pending connections to the Web Proxy service. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Total Requests	Represents the total number of requests made to the Web Proxy service. It is the total of two other counters: Total Successful Requests and Total Failed Requests.
Total Reverse Fetches	Represents the total number of incoming requests that have been served by requesting the data from Web publishing servers.
Total SSL Sessions	Represents the total number of SSL sessions serviced by the SSL tunnel.
Total Successful Requests	Represents the total number of requests that the Web Proxy service has successfully processed. This metric can be compared with Total Requests and Total Failed Requests to indicate the effectiveness of the ISA Server in servicing requests.
Total Upstream Fetches	Tracks the total number of requests that have been served by using data from the Internet or from a chained proxy computer. This metric can be compared to Total Cache Fetches to see what proportion of requests are being serviced from remote servers on the Internet or upstream proxies compared with those being serviced from the cache.
Total Users	Represents the total number of users that have ever connected to the Web Proxy service. It represents a history of past server usage. The default warning and critical threshold values for this metric are set to an UnDefined value. You can provide a value for the warning and critical thresholds based on your current environment and requirements.
Unknown SSL Sessions	Represents the total number of unknown SSL sessions serviced by the SSL tunnel.
Upstream Bytes Received Per Sec	Indicates the rate at which the Web Proxy service receives data bytes from remote servers on the Internet or from a chained proxy computer in response to requests from the Web Proxy service. The value of this counter partially depends on the connection bandwidth. If the metric value is consistently low, this may indicate a bottleneck caused by a slow connection. Changing the bandwidth priority configuration may help in this situation, or a faster connection may be required.
Upstream Bytes Sent Per Sec	Indicates the rate at which the Web Proxy service sends data bytes to remote servers on the Internet or to a chained proxy computer. The value of this counter partially depends on the connection bandwidth. If the metric value is consistently low, this may indicate a bottleneck caused by a slow connection. Changing the bandwidth priority configuration may help in this situation, or a faster connection may be required.
Upstream Bytes Total Per Sec	Sum of Upstream Bytes Sent/Sec and Upstream Bytes Received/Sec. It represents the total rate for all bytes transferred between the Web Proxy service and remote servers on the Internet or a chained proxy server.