3.2 Interrogating Current Server Activity
When checking whether a remote computer is responsive, a good first place to investigate is the ping response. Using the win32_pingstatus
WMI class, this is relatively straightforward. The data returned from
this class is structured and can then be used within other parts of the
investigation or recorded back to disk in a file, e-mailed to a
recipient, or stored within a database. The following example checks
the status code (0 if successful) of a ping test on as server called
SQL2012 (replace SQL2012 with a machine name on your network):
Get-WmiObject win32_pingstatus -Filter "Address='SQL2012'" '
| Select-Object statuscode
Assuming a status code of 0 is returned
from the server, you can now turn your attention to services running on
the computer. To find out which services are running, execute the
following:
Get-Service | Where-Object { $_.Status -eq 'Running' }
The Get-Service
cmdlet is very handy for simple service queries. Unfortunately, it
doesn’t provide access to every property on the service. I often find
it useful to see the Service State and the Start Mode. Fortunately,
this information is available on the Win23_Service
WMI class; and the following script shows an example of querying this
class to find services that start automatically with Windows but are
currently stopped. This may be useful if a server is not behaving as
expected and you suspect that a service that is usually started at boot
time is currently not running.
Get-WmiObject -Class Win32_Service -Property Name,State,StartMode -Filter
"StartMode='Auto' AND State='Stopped'" '
| Select-Object -Property Name,StartMode,State
Finding out which processes are active is useful
during troubleshooting. Often, a process has run away with CPU or
memory and is therefore putting pressure on the system, causing other
vital services to be starved of resources. Once again PowerShell jumps
to the rescue with Get-Process,
which returns process information. A busy system will have many
processes running, so I like to run two queries — the first finds the
top 10 processes by CPU utilization, and the second finds the top 10
processes by memory utilization. The following example queries the top
10 processes by CPU utilization and displays the results from my
SQL2012 Virtual Machine:
PS C:\> get-process | Sort-Object CPU -Descending | Select-Object -First 10
Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName
------- ------ ----- ----- ----- ------ -- -----------
388 50 41052 56776 222 48.50 3660 iexplore
783 53 41408 58104 287 28.92 2452 explorer
889 78 101688 144016 548 27.94 2208 Ssms
914 47 196188 216300 639 27.03 2252 powershell
57 7 1352 5072 70 12.00 3580 notepad
637 55 58648 73928 621 7.56 3028 SQLPS
564 43 16048 29524 177 5.97 3396 iexplore
39 6 2028 5036 57 2.97 3008 conhost
223 17 7816 17984 111 1.02 3968 notepad
79 9 1392 4480 71 0.19 2632 VBoxTray
This isn’t a busy system, so the usual
suspects such as Internet Explorer (iexplore) and Windows Explorer
(explorer) are high in the list. The following example shows a similar
query, this time querying by memory utilization:
PS C:\> get-process | Sort-Object WS -Descending | Select-Object -First 10
Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName
------- ------ ----- ----- ----- ------ -- -----------
639 88 444404 308232 -502 1268 sqlservr
816 47 200100 220736 640 28.13 2252 powershell
818 77 99328 143800 547 28.22 2208 Ssms
618 52 101812 74352 1906 1452 ReportingServicesService
637 55 58648 73928 621 7.56 3028 SQLPS
784 54 41748 58472 288 29.61 2452 explorer
388 50 40948 56748 221 48.52 3660 iexplore
1690 54 75844 54556 674 1312 msmdsrv
1061 52 28388 35400 432 848 svchost
311 26 31896 33084 534 1336 SMSvcHost
In this case, the processes consuming
the largest working set of memory are different from the processes
consuming the most CPU. Finding processes that are using excessive CPU
or memory gives you a scope for further investigation.
3.3 Interrogating for Warnings and Errors
When a server is not behaving as
expected, an error has often occurred. Inspecting the Windows Event Log
is a good place to start an investigation into what may have gone
wrong. PowerShell has full support for the Windows Event Log. The Get-EventLog
cmdlet lists all the items within an Event Log. The following example
shows the list of items within the application Event Log filtered to
those whose source is “MSSQLSERVER” and are an error:
Get-Eventlog application '
| Where-Object {$_.Source -eq "MSSQLSERVER" -and $_.EntryType -eq "Error"}
SQL Server also has an Error Log that
often contains more detailed information pertaining to SQL
Server–specific issues. The following example shows how to query the
SQL Server Error Log filtering the results to just the errors (code
file: PS_ReadSQLErrorLog01.PS1):
[reflection.assembly]::LoadWithPartialName("Microsoft.SqlServer.Smo") | out-null
$server = New-Object "Microsoft.SqlServer.Management.Smo.Server" "(local)"
$server.ReadErrorLog() | Where-Object {$_.Text -like "Error:*"}
My machine has a single default SQL
Server instance. If you are using a named instance, replace “(local)”
with the name of your SQL Server instance.
Using the SQL Server Management Objects it is
also possible to quickly filter the available jobs, identifying those
that failed the last time they ran and are currently enabled. This is a
useful script to run on a regular basis because SQL jobs often contain
important management and administration tasks that are automated, and
quickly identifying a failed job will save significant time diagnosing
issues later. The following script example shows how to query the SMO
objects for SQL Server jobs whose last run outcome failed and are still
enabled (code file: PS_ReadFailedJobs01.PS1):
[reflection.assembly]::LoadWithPartialName("Microsoft.SqlServer.Smo") | out-null
$server = New-Object "Microsoft.SqlServer.Management.Smo.Server" "(local)"
$server.jobserver.jobs | where-object {$_.lastrunoutcome -eq "Failed" -and
$_.isenabled -eq $TRUE}
3.4 Interrogating Server Performance
PowerShell 2.0 introduced integration
with Windows performance counters. This means that you can quickly view
all the performance counters on your machine:
Get-Counter -listSet * | Select-Object -ExpandProperty Paths
You could then find all of the SQL Server–specific counters:
Get-Counter -listSet * | Select-Object -ExpandProperty Paths | where-object {$_ -
like "*SQL*"}
It is also possible to get a sample of a performance counter:
Get-Counter '\Processor(*)\% Processor Time'
You can even leave PowerShell listening for the counter and collecting samples until you press Ctrl+C:
Get-Counter '\Processor(*)\% Processor Time' -continuous
The advantage of configuring
your performance counters through PowerShell is that you can create a
gold set of performance counters that you are interested in monitoring
on every computer in your environment and then save the script to run
on each computer, ensuring that all the computers capture the same
statistics.
