eG Monitoring
 

Measures reported by ADAccessDetTest

This test measures the load on the AD server in terms of the level of read-write activity on the server and the count of search operations performed by the server. In the process, the test reveals the following:

  • Which AD services initiated the read-write operations? Which of these services generated the maximum I/O load on the server - is it the LSA? the NSPI? the NTDS? SAM? or the replication service? - this information is useful when administrators are faced with an AD overload, as it accurately points them to the probable sources of the load;
  • Which AD service performed the maximum searches on the server? - in the event of an overload, this metric will help you identify that service which could be contributing to the overload;
  • Is the server sized with adequate threads to handle the I/O load?

This test applies only to Active Directory Servers installed on Windows 2008.

The measures made by this test are as follows:

Measurement Description Measurement Unit Interpretation
DS_nam_cach_hit_rate Indicates the percentage of object name lookups serviced by the Schema Cache. Percent All changes made to Active Directory are validated first against the schema. For performance reasons, this validation takes place against a version of the schema that is held in memory on the domain controllers. This “in-memory version”, called the schema cache, is updated automatically after the on-disk version has been updated. The schema cache provides mapping between attribute identifiers such as a database column identifier or a MAPI identifier and the in-memory structures that describe those attributes. The schema cache also provides lookups for class identifiers to get in-memory structures describing those classes.

A low value of this measure indicates that the Directory Service needs high disk read/write activity to perform its job. This results in poor response time of the components available in the Active Directory.
DS_not_que_size Indicates the number of pending update notification requests that have been queued and not transmitted. Number When any change in the Active Directory occurs, the originating domain controller sends an update notification requests to the other domain controllers.

A high value of this measure indicates that the Active Directory is changing frequently but the update notification requests have not been transmitted to the other domain controllers. This results in a loss of data integrity in the directory store. This problem can be corrected by forcing the replication.

DS_thrd_in_use Indicates the current number of threads in use by the directory service (which is different from the number of threads in the directory service process). Number This is the number of threads currently servicing client API calls; it can be used to indicate whether additional processors should be used.

A fluctuating value for this measure indicates a change in the load.

A low value could point to network problems that are preventing client requests from succeeding.

DS_ser_bind Indicates the number of domain controller-to-domain controller binds per second that are serviced by this domain controller. Binds/Sec  
DS_dir_read Indicates the rate of directory reads. Reads/Sec These measures serve as effective indicators of the ability of the AD server to process read, write, and search requests.
DS_dir_write Indicates the rate of directory writes. Writes/Sec
DS_dir_search Indicates the number of directory searches per second. Searches/Sec
DS_read_frm_dra Indicates the percentage of reads on the directory by replication. Percent If the AD server is experiencing abnormally high read activity, then, you can compare the value of this measure with the values reported by the DS reads from KCC, DS reads from LSA, DS reads from NSPI, DS reads from NTDS, and DS reads from SAM measures to know which AD service is performing the maximum reads on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_read_frm_kcc Indicates the percentage of reads performed by the Knowledge Consistency Checker on the directory. Percent The Knowledge Consistency Checker (KCC) generates the replication topology by specifying what domain controllers will replicate to which other domain controllers in the site. The KCC maintains a list of connections, called a replication topology, to other domain controllers in the site. The KCC ensures that changes to any object are replicated to all site domain controllers and updates go through no more than three connections.

If the AD server is experiencing abnormally high read activity, then, you can compare the value of this measure with the values reported by the DS_read_frm_dra, DS_read_frm_lsa, DS_read_frm_nspi, DS_read_frm_ntds, and DS_read_frm_sam measures to know which AD service is performing the maximum reads on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_read_frm_lsa Indicates the percentage of reads performed by the Local Security Authority on the directory. Percent The Local Security Authority (LSA) is the security subsystem responsible for all interactive user authentication and authorization services on a local computer. The LSA is also used to process authentication requests made through the Kerberos V5 protocol or NTLM protocol in Active Directory.

If the AD server is experiencing abnormally high read activity, then, you can compare the value of this measure with the values reported by the DS_read_frm_dra, DS_read_frm_kcc, DS_read_frm_nspi, DS_read_frm_ntds, and DS_read_frm_sam measures to know which AD service is performing the maximum reads on the AD server - is it the replication service? the LSA? the KCC? the NSPI? or the NTDS?
DS_read_frm_nspi Indicates the percentage of reads performed by the Name Service Provider Interface (NSPI) on the directory. Percent The Name Service Provider Interface (NSPI) is the protocol by which Messaging API (MAPI) clients access the AD DS.

Exchange Address Book clients use the client MAPI provider Emsabp32.dll to look up e-mail addresses in the global catalog. The client-side MAPI provider communicates with the server through the proprietary Name Service Provider Interface (NSPI) RPC interface.

If the AD server is experiencing abnormally high read activity, then, you can compare the value of this measure with the values reported by the DS_read_frm_kcc, DS_read_frm_lsa, DS_read_frm_dra, DS_read_frm_ntds, and DS_read_frm_sam measures to know which AD service is performing the maximum reads on the AD server - is it the replication service? the LSA? the KCC? or the NSPI?
DS_read_frm_ntds Indicates the percentage of reads performed by the name service directory APIs on the directory. Percent If the AD server is experiencing abnormally high read activity, then, you can compare the value of this measure with the values reported by the DS_read_frm_kcc, DS_read_frm_lsa, and DS_read_frm_dra, DS_read_frm_nspi, and DS_read_frm_sam measures to know which AD service is performing the maximum reads on the AD server - is it the replication service? the LSA? the KCC? the NSPI? or the SAM?
DS_read_frm_sam Indicates the percentage of reads performed by the Security Account Manager (SAM) on the directory. Percent The Security Accounts Manager (SAM) is used for verifying passwords and for checking passwords against any existing password policies that are in effect on a domain controller.

If the AD server is experiencing abnormally high read activity, then, you can compare the value of this measure with the values reported by the DS_read_frm_kcc, DS_read_frm_lsa, and DS_read_frm_dra, DS_read_frm_nspi, and DS_read_frm_ntds measures to know which AD service is performing the maximum reads on the AD server - is it the replication service? the LSA? the KCC? the NSPI? or the NTDS?
DS_write_frm_dra Indicates the percentage of writes on the AD server by replication. Percent If the AD server is experiencing abnormally high write activity, then, you can compare the value of this measure with the values reported by the DS_write_frm_kcc, DS_write_frm_lsa, DS_write_frm_nspi, DS_write_frm_ntds, and DS_write_frm_sam measures to know which AD service is performing the maximum writes on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_write_frm_kcc Indicates the percentage of writes performed by the Knowledge Consistency Checker on the directory. Percent If the AD server is experiencing abnormally high write activity, then, you can compare the value of this measure with the values reported by the DS_write_frm_dra, DS_write_frm_lsa, DS_write_frm_nspi, DS_write_frm_ntds, and DS_write_frm_sam measures to know which AD service is performing the maximum writes on the AD server - is it the replication service? the KCC? the LSA? the NSPI? the NTDS? or the SAM?
DS_write_frm_lsa Indicates the percentage of writes performed by the Local Security Authority on the directory. Percent If the AD server is experiencing abnormally high write activity, then, you can compare the value of this measure with the values reported by the DS_write_frm_dra, DS_write_frm_kcc, DS_write_frm_nspi, DS_write_frm_ntds, and DS_write_frm_sam measures to know which AD service is performing the maximum writes on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_write_frm_nspi Indicates the percentage of writes performed by the Name Service Provider Interface (NSPI) on the directory. Percent If the AD server is experiencing abnormally high write activity, then, you can compare the value of this measure with the values reported by the DS_write_frm_dra, DS_write_frm_kcc, DS_write_frm_lsa, DS_write_frm_ntds, and DS_write_frm_sam measures to know which AD service is performing the maximum writes on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_write_frm_ntds Indicates the percentage of writes performed by the name service directory APIs on the directory. Percent If the AD server is experiencing abnormally high write activity, then, you can compare the value of this measure with the values reported by the DS_write_frm_dra, DS_write_frm_kcc, DS_write_frm_lsa, DS_write_frm_nspi, and DS_write_frm_sam measures to know which AD service is performing the maximum writes on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_write_frm_sam Indicates the percentage of writes performed by the Security Accounts Manager (SAM) on the directory. Percent If the AD server is experiencing abnormally high write activity, then, you can compare the value of this measure with the values reported by the DS_write_frm_dra, DS_write_frm_kcc, DS_write_frm_lsa, DS_write_frm_nspi, and DS_write_frm_ntds measures to know which AD service is performing the maximum writes on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_search_frm_dra Indicates the percentage of searches performed by the replication service on the AD server. Percent If the AD server is processing an abnormally large number of search requests, then, you can compare the value of this measure with the values reported by the DS_search_frm_kcc, DS_search_frm_lsa, DS_search_frm_nspi, DS_search_frm_ntds, and DS_search_frm_sam measures to know which AD service is performing the maximum number of searches on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_search_frm_kcc Indicates the percentage of searches performed by the Knowledge Consistency Checker on the directory. Percent If the AD server is processing an abnormally large number of search requests, then, you can compare the value of this measure with the values reported by the DS_search_frm_dra, DS_search_frm_lsa, DS_search_frm_nspi, DS_search_frm_ntds, and DS_search_frm_sam measures to know which AD service is performing the maximum number of searches on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_search_frm_lsa Indicates the percentage of searches performed by the Local Security Authority on the directory. Percent If the AD server is processing an abnormally large number of search requests, then, you can compare the value of this measure with the values reported by the DS_search_frm_dra, DS_search_frm_kcc, DS_search_frm_nspi, DS_search_frm_ntds, and DS_search_frm_sam measures to know which AD service is performing the maximum number of searches on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_search_frm_nspi Indicates the percentage of searches performed by the Name Service Provider Interface (NSPI) on the directory. Percent If the AD server is processing an abnormally large number of search requests, then, you can compare the value of this measure with the values reported by the DS_search_frm_dra, DS_search_frm_kcc, DS_search_frm_lsa, DS_search_frm_ntds, and DS_search_frm_sam measures to know which AD service is performing the maximum number of searches on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_search_frm_ntds Indicates the percentage of searches performed by the name service directory APIs on the directory. Percent If the AD server is processing an abnormally large number of search requests, then, you can compare the value of this measure with the values reported by the DS_search_frm_dra, DS_search_frm_kcc, DS_search_frm_lsa, DS_search_frm_nspi, and DS_search_frm_sam measures to know which AD service is performing the maximum number of searches on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?
DS_search_frm_sam Indicates the percentage of searches performed by the Security Accounts Manager (SAM) on the directory. Percent If the AD server is processing an abnormally large number of search requests, then, you can compare the value of this measure with the values reported by the DS_search_frm_dra, DS_search_frm_kcc, DS_search_frm_lsa, DS_search_frm_nspi, and DS_search_frm_ntds measures to know which AD service is performing the maximum number of searches on the AD server - is it the replication service? the LSA? the KCC? the NSPI? the NTDS? or the SAM?