Tuesday, October 22, 2013

Kaseya Alert – Pages/Sec

Have you ever received an alert from Kaseya? If you answered yes, you’ve came to the right place, I too have seen what feels like thousands of tickets like the one pictured below.

Luckily for us With PowerShell we can easily reverse engineer a ticket like above. Notice the ‘Log Object Name’ which in this case is ‘Pages/Sec’ with refers to memory consumption. From what I’ve noticed Kaseya monitors the specific performance counters which we can also monitor with PowerShell.
While logged onto the effected server run the following cmdlet in an Elevated PowerShell window.

(Get-Counter -ListSet Memory).Paths

PS C:\> (Get-Counter -ListSet Memory).paths
\Memory\Page Faults/sec
\Memory\Available Bytes
\Memory\Committed Bytes
\Memory\Commit Limit
\Memory\Write Copies/sec
\Memory\Transition Faults/sec
\Memory\Cache Faults/sec
\Memory\Demand Zero Faults/sec
\Memory\Pages Input/sec
\Memory\Page Reads/sec
\Memory\Pages Output/sec
\Memory\Pool Paged Bytes
\Memory\Pool Nonpaged Bytes
\Memory\Page Writes/sec
\Memory\Pool Paged Allocs
\Memory\Pool Nonpaged Allocs
\Memory\Free System Page Table Entries
\Memory\Cache Bytes
\Memory\Cache Bytes Peak
\Memory\Pool Paged Resident Bytes
\Memory\System Code Total Bytes
\Memory\System Code Resident Bytes
\Memory\System Driver Total Bytes
\Memory\System Driver Resident Bytes
\Memory\System Cache Resident Bytes
\Memory\% Committed Bytes In Use
\Memory\Available KBytes
\Memory\Available MBytes
\Memory\Transition Pages RePurposed/sec
\Memory\Free & Zero Page List Bytes
\Memory\Modified Page List Bytes
\Memory\Standby Cache Reserve Bytes
\Memory\Standby Cache Normal Priority Bytes
\Memory\Standby Cache Core Bytes
\Memory\Long-Term Average Standby Cache Lifetime (s)
PS C:\>

Notice \Memory\Pages/Sec
now run the below cmdlet to output the current \Memory\Pages/Sec.
Get-Counter \Memory\Pages/Sec
PS C:\> Get-Counter \Memory\Pages/sec

Timestamp                 CounterSamples
---------                 --------------
10/24/2013 1:40:02        \\vt-mkerfoot-w8\memory\pages/sec :
MATTHEW                   0

PS C:\>
I like to gather a little more information typically…

Hostname ; Get-Counter -Counter \Memory\Pages/sec -SampleInterval 1 -MaxSamples 3

PS C:\> hostname ; Get-Counter -Counter "\Memory\Pages/sec" -SampleInterval 1 -MaxSamples 3

Timestamp                 CounterSamples
---------                 --------------
10/24/2013 2:08:04        \\vt-mkerfoot-w8\memory\pages/sec :
MATTHEW                   1749.75083141259

10/24/2013 2:08:05        \\vt-mkerfoot-w8\memory\pages/sec :
MATTHEW                   1421.4409519757

10/24/2013 2:08:06        \\vt-mkerfoot-w8\memory\pages/sec :
MATTHEW                   4602.18149317241

PS C:\>