Storage & The Disk Drive

Diagnosing problems on your servers’ disk drive or storage can be tricky.

Using performance monitor can ease the process. Other tools that you can use are “resource monitor” and “process monitor”

Keep reading to find out how to use these tools to locate hard disk/storage issues.

The following page contains keywords and counters that you can use in order to collect data about your storage with perfmon.exe

To start perfmon.exe, press windows key + R, write perfmon and hit Enter.


Using performance monitor to locate storage issues



Disk queue

Each disk (spindle) has a disk queue. disk queue lists the in-flight I/O request packets (IRPs) that have not been serviced yet.

The I/O requests in the disk queue might not be serviced in a FIFO order, this cause some I/O requests to wait longer.

The number of IRPs that can be serviced at the same time depends on the physical media.

Disk queue length – the number of in-flight I/O request packets  (IRPs)

Avg. disk queue length – the average number of both read and write requests that are queued for the selected disk, during the sampling period. For this counter, Look for increasing trends.

%idle time – reports the percentage of time that the disk queue is empty and has nothing in it. It is based on the number of I/O requests that are waiting for service from the disk driver. % idle time can tell you how often the disk queue is not busy.

A value of Less then 10 might warrant further checking. It means that 90% of the time the disk queue has work to do. Correlate this counter with related counters such as Avg disk sec/read and Avg. disk sec/write.

Disk transfer/sec – measures the read and write operation of the operation system.

Disk read/write – this counter help determine the read:write ratio of operations to the disk. This ratio can help us adjust the disk cache which can greatly affect performance. We need to compare the read/sec and write/sec counters to determine the read/write ratio.

Process (*)\IO Read operations/sec and Process (*)\IO Write operations/sec – these counters measure the rate that a process is using read/write operations. This can be the disk, network or other device I/O. you should check this counter as an supplement to disk transfer/sec.

Avg. disk sec/read and Avg. disk sec/write – this counter indicates the average response time for servicing I/O request packets. It measure the response times of every I/O request packet and calculate the response times between each collection. This counter should be the first indicator to use to know how the disk is performing. More than 15 ms (0.015) indicate that performance might be affected.

The response times will be fast or faster than the disk access times if the disks can keep up with the I/O request packet load.

If there are more I/O requests in the disk queue than can be serviced in a reasonable time, the average I/O request packet response times increase accordingly.

If the average response time is greater than its worst case response time and the I/O sizes are 64 KB or smaller, then the disk is performing poorly.


Resource Monitor

Microsoft introduced Resource Monitor in windows server 2008 and windows vista with. The windows 7 and server 2008 R2 version of Resource Monitor was improved with disk response times for process and files on the disk. These details cannot be obtained from performance monitor.

Resource Monitor uses (ETW) event tracing for windows as a source of data.

It is best to use Resource Monitor to analyze live disk performance issues.

Process Monitor

Process Monitor is a great tool from sysinternals suite of tools.

Process Monitor captures all access to the registry, file system, network,profilint events and process and thread activity. It captures detailed information on the disk I/O activity. You can use Process Monitor to aggregate and sort the data by process, file or other filters. To analyze poor performance caused by antivirus / anti-intrusion software and drivers, inspect aggregated call stacks of the I/O to see performance of the disk drivers.

Process Monitor uses (ETW) event tracing for windows and its own drivers as a source of data source.


Leave a Reply

A Place For IT System Administrators