Chapter Summary

• Event Viewer presents data in the form of logs. The Application, System, and Security logs are on every Windows Server 2003 server. Domain controllers have two additional logs relating to Active Directory, and other application servers (such as DNS) have their own set of log files.

• The Performance console (perfmon.msc) consists of two snap-ins: System Monitor and Performance Logs And Alerts. System Monitor shows real-time performance data based on Object counters, and can display the log data recorded by Performance Logs And Alerts either in the form of Counter (interval polling) logs, or Trace (event-driven) logs.

• Task Manager is used to view real-time performance data surrounding processes and applications. Processes can be initiated and ended using Task Manager. Processes can also be adjusted up or down in CPU priority, and can be assigned affinity to a particular processor on a multiprocessor computer.

• WMI is a management system that collects data from computer systems. The control interface of WMI Control snap-in allows for adjustment of permissions beyond the default of the local administrator to manage computers across the network. While WMI is capable of configuring many different types of system behavior including users, groups, and services, the focus of this chapter is on the ability to extract data from the WMI Repository using the command line interface to WMI, WMIC. WMIC is capable of reporting running services, installed applications, and publishing Event Viewer data to CSV or HTML files for ease of distribution and analysis.