File Service POG

7/29/2019 File Service POG

1/88

File Service

Product Operations Guide

Managing the Windows Server Platform


2/88

The information contained in this document represents the current view of Microsoft

Corporation on the issues discussed as of the date of publication. Because Microsoft must

respond to changing market conditions, it should not be interpreted to be a commitmenton the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information

presented after the date of publication.

This document is for informational purposes only. MICROSOFT MAKES NO

WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THISDOCUMENT.

Complying with all applicable copyright laws is the responsibility of the user. Without

limiting the rights under copyright, this document may be reproduced, stored in or

introduced into a retrieval system, or transmitted in any form or by any means (electronic,

mechanical, photocopying, recording, or otherwise), but only for the purposes provided in

the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or otherintellectual property rights covering subject matter in this document. Except as expressly

provided in any written license agreement from Microsoft, the furnishing of this document

does not give you any license to these patents, trademarks, copyrights, or other

intellectual property.

Unless otherwise noted, the example companies, organizations, products, domain names,e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no

association with any real company, organization, product, domain name, email address,

logo, person, place, or event is intended or should be inferred.

2003 Microsoft Corporation. All rights reserved.

Microsoft, Active Directory, ActiveX, Windows, and Windows Server are either registered

trademarks or trademarks of Microsoft Corporation in the United States and/or other

countries.

The names of actual companies and products mentioned herein may be the trademarks of

their respective owners.


3/88

File Service Product Operations Guide iii

ContentsIntroduction to Product Operations Guide ....................................................................................... 1

Document Purpose ...................................................................................................................... 1Intended Audience ....................................................................................................................... 1How to Use This Guide ................................................................................................................ 1Background .................................................................................................................................. 2

High-Level Processes for Maintaining Windows Server 2003 File Service..................................... 5Overview ...................................................................................................................................... 5Required Technology ................................................................................................................... 6Maintenance Processes Checklist ............................................................................................... 7

Operating Quadrant .................................................................................................................. 7Supporting Quadrant .............................................................................................................. 11Optimizing Quadrant .............................................................................................................. 13Changing Quadrant ................................................................................................................ 15

Detailed Maintenance Processes .................................................................................................. 17Overview .................................................................................................................................... 17Process: Data backup, restore, and recovery operations .......................................................... 18

Task: Run daily incremental backup ...................................................................................... 18Process: Data backup, restore, and recovery operations .......................................................... 20

Task: Run weekly normal backup .......................................................................................... 20Process: Design for service recovery ........................................................................................ 22

Task: Update automated system recovery (ASR) backup ..................................................... 22Process: Design for service recovery ........................................................................................ 24

Task: Validate ASR recovery ................................................................................................. 24Process: Maintaining the directory ............................................................................................. 26

Task: Back up DFS namespace configuration ....................................................................... 26Process: Data backup, restore, and recovery operations .......................................................... 27

Task: Verify previous days backup job .................................................................................. 27Process: Storage resource management .................................................................................. 30

Task: Monitor available disk space ........................................................................................ 30Process: Storage resource management .................................................................................. 33

Task: Review disk fragmentation ........................................................................................... 33Process: Data backup, restore, and recovery operations .......................................................... 36Task: Verify restore ................................................................................................................ 36

Process: Managing resources and service performance........................................................... 37Task: Capture service performance statistics ........................................................................ 37Task: Capture service usage statistics ................................................................................... 41

Process: Perform monitoring ..................................................................................................... 44Task: Review quota levels ...................................................................................................... 44

Process: Reviewing configuration items .................................................................................... 46Task: Compliance checkverify that shares are created in the proper location ................... 46

Process: Problem recording and classification .......................................................................... 47Task: Review daily problem management report ................................................................... 47

Process: Investigation and diagnosis ........................................................................................ 49Task: Create weekly service activity report ............................................................................ 49

Process: Incident closure ........................................................................................................... 51

Task: Roll up activity report into monthly metric..................................................................... 51Process: Managing resources and service performance........................................................... 52

Task: Captures size of DFS namespace ................................................................................ 52Process: Managing resources and service performance........................................................... 54

Task: Create quota report ...................................................................................................... 54Task: Create a service performance and usage report .......................................................... 55Task: Create a system load and utility report ......................................................................... 56

Process: Managing the directory ............................................................................................... 57


4/88

iv Managing the Windows Server Platform

Task: Check status of DFS ..................................................................................................... 57Process: Investigation and diagnosis ........................................................................................ 59

Task: Respond to daily service request ................................................................................. 59Process: Change classification and authorization ..................................................................... 61

Task: Attend CAB meeting ..................................................................................................... 61Task: Review emergency change request ............................................................................. 62

Process: Reviewing configuration items .................................................................................... 65Task: Capture configuration snapshot ................................................................................... 65

Processes by MOF Role Clusters ................................................................................................. 69Operations Role Cluster ......................................................................................................... 69Support Role Cluster .............................................................................................................. 70Release Role Cluster ............................................................................................................. 70Infrastructure Role Cluster ..................................................................................................... 71Security Role Cluster .............................................................................................................. 72Partner Role Cluster ............................................................................................................... 72

Troubleshooting ............................................................................................................................. 73Overview .................................................................................................................................... 73

Problem #1: Path not found or empty folder........................................................................ 73Problem #2: Slow connection time ......................................................................................... 74Problem #3: How to troubleshoot FRS-enabled DFS directories........................................... 75Problem #4: Using Defrag.exe on a disk that hosts FRS-replicated content ......................... 76Problem #5: DFS links not visible .......................................................................................... 77Problem #6: DFS root does not appear in MMC .................................................................... 78 Problem #7: NTFS file system log file size bottlenecks ......................................................... 79Problem #8: Excessive CPU use by Clussvc.exe or Rsrcmon.exe ....................................... 80Problem #9: "A DFS root already exists in this cluster node" ................................................ 81 Problem #10: DNS name problems ....................................................................................... 82


5/88

File Service Product Operations Guide v

Contributors

Program Manager

Jeff Yuhas, Microsoft, USA

Lead Writers

Michael Sarabosing, Covestic, USA

Akil Washington, Covestic, USA

Other Contributors

Steve Barnard, Microsoft Consulting Services

Shiloh Cleofe, Microsoft Corporation

Test Manager

Greg Gicewicz, Microsoft Corporation

QA Manager

Jim Ptaszynski, Microsoft Corporation

Lead Technical Writer

Jerry Dyer, Microsoft Corporation

Lead Technical Editor

Laurie Dunham, Microsoft Corporation

Technical Editors

Bill Karn, Volt Technical Services

Patricia Rytkonen, Volt Technical Services

Production Editor

Kevin Klein, Volt Technical Services


6/88


7/88

1Introduction to Product OperationsGuide

Document Purpose

This guide describes processes and procedures for improving the management ofMicrosoft Windows Server 2003 File Service in an information technology (IT)

infrastructure.

Intended Audience

This material should be useful for anyone planning to deploy this product into an

existing IT infrastructure, especially one based on the IT Infrastructure Library

(ITIL)a comprehensive set of best practices for IT service managementand

Microsoft Operations Framework (MOF). It is aimed primarily at two main groups:

IT managers and IT support staff (including analysts and service-desk specialists).

How to Use This Guide

This guide is divided into five main chapters. The first chapter provides basic

background information. The second chapter provides a high-level checklist of the

tasks required for maintaining this product. The third chapter takes a more detailed

look at the tasks described in the maintenance section. The fourth chapter organizes

tasks by the MOF role cluster responsible for each task. The fifth chapter provides

information about common troubleshooting techniques for Windows Server 2003

File Service.

The guide may be read as a single volume, including the detailed maintenance andtroubleshooting sections. Reading the document this way will provide the necessary

context so that later material can be understood more readily. However, some people

will prefer to use the document as a reference, looking up information only as they

need it.


8/88

2 Managing the Windows Server Platform

Background

This guide is based on Microsoft Solutions for Management (MSM). MSM provides a

combination of best practices, best-practice implementation services, and best-

practice automation, all of which help customers achieve operational excellence as

demonstrated by high quality of service, industry reliability, availability, and

security, and low total cost of ownership (TCO).

These MSM best practices are based on MOF, a structured, yet flexible approach

centered around ITIL. MOF includes guidelines on how to plan, deploy, and

maintain IT operational processes in support of mission-critical service solutions.

Central to MOFand to understanding the structure of this guideare the MOF

Process and Team Models. The Process Model and its underlying service

management functions (SMFs) are the foundation for the process-based approach

that this guide recommends for maintaining a product. The Team Model and its role

clusters offer guidance for ensuring the proper people are assigned to operational

roles.

Figure 1 shows the MOF Process Model combined with the SMFs that make up each

quadrant of the Process Model.

Figure 1

MOF Process Model and SMFs


9/88

File Service Product Operations Guide 3

Figure 2 shows the MOF Team Model, along with some of the many functional roles

or function teams that might exist in service management organizations. These roles

and function teams are shown mapped to the MOF role cluster to which they would

likely belong.

Security

Release

Infrastructure

Support

Operations

Partner

Change management Release/systems engineering Configuration control/asset

management Software distribution/licensing Quality assurance

Messaging operations Database operations Network administration Monitoring/metrics

Availability management

Intellectual property protection Network and system security Intrusion detection Virus protection Audit and compliance admin Contingency planning

Maintenance vendors Environment support Managed services, outsourcers,

trading partners Software/hardware suppliers

Enterprise architecture Infrastructure engineering Capacity management Cost/IT budget management Resource and long-range

planning

Service desk/help desk Production/production support Problem management Service level management

Figure 2

MOF Team Model and examples of functional roles or teams


10/88


The MOF Team Model is built on six quality goals, which are described and matched

with the applicable team role cluster in Table 1.

Table 1. MOF Team Model Quality Goals and Role Clusters

Quality goal Team role cluster

Effective release and change management. Accurate inventorytracking of all IT services and systems.

Release

Management of physical environments and infrastructure tools. Infrastructure

Quality customer support and a service culture. Support

Predictable, repeatable, and automated system management. Operations

Mutually beneficial relationships with service and supply partners. Partner

Protected corporate assets, controlled authorization, and proactive

security planning.

Security

Further information about MSM and MOF is available at

http://www.microsoft.com/solutions/msm/techinfo/default.asp, or search for the

topic on TechNet athttp://www.microsoft.com/technet/default.asp. You can also

contact your local Microsoft or partner representative.
http://www.microsoft.com/solutions/msm/techinfo/default.asphttp://www.microsoft.com/solutions/msm/techinfo/default.asphttp://www.microsoft.com/technet/default.asphttp://www.microsoft.com/technet/default.asphttp://www.microsoft.com/technet/default.asphttp://www.microsoft.com/technet/default.asphttp://www.microsoft.com/solutions/msm/techinfo/default.asp


11/88

2High-Level Processes for MaintainingWindows Server 2003 File Service

Overview

Every company consists of employees (people), activities that these employeesperform (processes), and tools that help them perform these activities (technology).

Regardless of what the business is, it most likely consists of people, processes, and

technology working together to achieve a common goal. Table 2 illustrates this point.

Table 2. Examples of People, Process, and Technology Working Together

Area People Process Technology

Auto repair

industry

Mechanic Repair manual Socket set

Software

developmentindustry

Programmer Project plan Compiler,

debugger

IT operations IT technician Microsoft

Operations

Framework

Windows Server

2003 File Service

At the heart of any IT organization is the ability to efficiently manage file resources

while keeping them available and secure for users. As the network expands with

more users located on-site, in remote locations, or even at partner companies, IT

administrators face an increasingly heavy burden.

This product operations guide combines people and process with technology to offerbest-practice advice for the maintenance of Windows Server 2003 file services.


12/88


Required Technology

Table 3 lists the tools or technologies used in the procedures described in this guide.

All tools should be accessed from a Windows Server 2003 server console, except in

those cases where a link is provided. All tools should be accessed from a WindowsServer 2003 server console, except in those cases where a link is provided.

Table 3. File Service Tools or Technologies

Required Technology Description Location

Disk Defragmenter Tool used to analyze

volumes for

fragmentation. Also used

to defragment volumes.

Start > All Programs >

Accessories > System

Tools > Disk

Defragmenter

System Monitor

(formerly known as

Performance Monitor)

Tool used to collect data

on server health and

performance


Administrative Tools >

System Monitor

Event Viewer Tool used to monitor

and gather information

on system, security, and

application events



Event Viewer

Quota Entries window To be used to view and

configure quotas on a

volume

On the properties page

of a NTFS volume

Microsoft Distributed

File System (DFS)

Microsoft Management

Console (MMC)

Tool used to monitor

DFS namespace,

including roots, links,

and targets



Distributed File System

Disk Cleanup Tool used to remove

temporary files, Internet

cache files, and

unnecessary program

files



Tools > Disk Cleanup

Backup Tool used to perform

backup and restore

operations



Tools > Backup

Ntfrsutl.exe Tool used for

troubleshooting FRS on

DFS

Windows Server 2003

Support Tools

Dfsutil.exe Tool used to configure

and troubleshoot DFS

Windows Server 2003

Support Tools


13/88


Recommended Technology Description Location

Srvinfo.exe Tool used to gather

system information from

servers

Windows Server 2003

Resource Kit

Volperf.exe Tool used to install

performance objects and

counters for volume

shadow service

Windows Server 2003

Resource Kit

Fsutil.exe Tool used to manage

Windows file system

\Winnt\System32

Iologsum.cmd Tool used for

troubleshooting FRS on

DFS

Windows Server 2003

Support Tools

Windows ManagementInstrumentation (WMI)

Tool used to configureWMI settings such as

permissions for

authorized users and

groups and turning error

logging on or off

Start > Run > typewmimgmt.msc

Maintenance Processes Checklist

The following checklists provide a quick reference for those product maintenance

processes that must be performed on a regular basis. These process lists are a

summary of the processes described in subsequent sections of this guide. They are

limited to those processes required for maintaining the product.

Operating Quadrant

The processes for this section are based on the service management function guides

that make up the MOF Operating Quadrant. For more information on the MOF

Process Model and the SMFs, seehttp://www.microsoft.com/solutions/msmand

http://www.microsoft.com/mof.
http://www.microsoft.com/solutions/msmhttp://www.microsoft.com/solutions/msmhttp://www.microsoft.com/mofhttp://www.microsoft.com/mofhttp://www.microsoft.com/mofhttp://www.microsoft.com/solutions/msm


14/88


Storage Management SMF

Daily Processes

Process Name Related SMFs MOF Role Cluster

Storage resourcemanagement Infrastructure

Data backup, restore,

and recovery operations

Support

Weekly Processes


Storage resource

management

Infrastructure



Support

Monthly Processes


There are no monthly

processes for this SMF.

As-Needed Processes




Operations


15/88


Service Monitoring and Control SMF

Daily Processes


Perform monitoring InfrastructureWeekly Processes


There are no weekly


Monthly Processes




As-Needed Processes


There are no as-needed



16/88


Directory Services Administration SMF

Daily Processes


Maintaining thedirectory Infrastructure

Weekly Processes


There are no weekly


Monthly Processes




As-Needed Processes





17/88


Supporting Quadrant

The processes for this section are based on the SMF guides that make up the MOF

Supporting Quadrant.

Incident Management SMF

Daily Processes


Investigation and

diagnosis

Support

Weekly Processes


Investigation and

diagnosis

Support

Monthly Processes


Incident closure Operations

As-Needed Processes





18/88


Problem Management SMF

Daily Processes


Problem recording andclassification Operations

Weekly Processes


There are no weekly


Monthly Processes




As-Needed Processes





19/88


Optimizing Quadrant

The tasks for this section are based on the SMF guides that make up the MOF

Optimizing Quadrant.

Availability Management SMF

Daily Processes


There are no daily


Weekly Processes


Design for recovery Operations

Monthly Processes




Quarterly Processes


Design for recovery Operations

As-Needed Processes




Operations


20/88


Capacity Management SMF

Daily Processes


Managing resources andservice performance Operations

Managing resources and

service performance

Operations

Weekly Processes



service performance

Infrastructure

Monthly Processes



service performance

Infrastructure

As-Needed Processes





21/88


Changing Quadrant

The processes for this section are based on the SMF guides that make up the MOF

Changing Quadrant.

Change Management SMF

Daily Processes


Change classification Infrastructure

Weekly Processes


Change authorization Infrastructure

Monthly Processes




As-Needed Processes





22/88


Configuration Management SMF

Daily Processes


There are no dailyprocesses for this SMF.

Weekly Processes


There are no weekly


Monthly Processes


Reviewing configuration

items

Infrastructure

As-Needed Processes





23/88

3Detailed Maintenance ProcessesOverview

This chapter provides detailed information about the processes that must be

performed in order to maintain Windows Server 2003 File Service. The chapter is

first arranged according to the MOF quadrant to which each process belongs. Thequadrants are:

Operating Quadrant

Supporting Quadrant

Optimizing Quadrant

Changing Quadrant

Within each quadrant, the processes are further arranged according to the MOF SMF

guides that make up that quadrant, the particular Team Model role cluster to which

the process belongs, and the time (daily, weekly, monthly, or as-needed) when the

process occurs.For more information about the MOF Process Model and the MOF SMF guides that

make up each quadrant of the model, seehttp://www.microsoft.com/solutions/msm.

For more information about the MOF Team Model and team role clusters, see

http://www.microsoft.com/mof.
http://www.microsoft.com/solutions/msmhttp://www.microsoft.com/solutions/msmhttp://www.microsoft.com/solutions/msmhttp://www.microsoft.com/mofhttp://www.microsoft.com/mofhttp://www.microsoft.com/mofhttp://www.microsoft.com/solutions/msm


24/88


Operating Quadrant Storage Management

SMF

Support Role Cluster Daily

Process: Data backup, restore, and recovery operations

Description

Backing up, restoring, and recovering data are key storage management activities for

maintaining company data. Data should be classified by type, and a strategy should

be developed to ensure that those processes fulfill business requirements and service

level objectives.

Task: Run daily incremental backup

Purpose

Performing regularly scheduled backups is an integral part of any file service

operations environment. A good backup strategy should include daily incrementalor differential backups as well as weekly backups. Numerous strategies exist

regarding the frequency and types of backup jobs that an operations team can

implement.


25/88


Procedure: Configure incremental backup job

1. Start Backup utility and select the Backup tab.

2. Select the drives, folders, and files that will be included in the backup. It is a

good idea to include the system state information as part of the backup

operation.3. On the Tools menu, click Options. In the Options window, on the Backup Log

tab, select Detailed, and click OK.

Backup logs can be vital to troubleshooting and recording status of the backup

operation. The default setting in Windows Server 2003 is for backup logs to

contain such summary information as loading a tape, starting the backup,

backing up files, backing up bytes, or failing to open a file. Some operations

environments require more detail informationspecifically, what files are being

backed up for a particular backup job.

4. On the Tools menu, click Options. In the Options window, click the Backup

Type tab. In the Default Backup Type drop-down list, select Incremental, andclick OK.

5. In Backup Destination, select one of the following:

Choose file to back up files and folders to a file. This is the default setting.

Choose a tape device if you want to back up files and folders to a tape.

6. In Backup media or file name, select one of the following:

If you are backing up files and folders to a file, enter the path and file name

of the backup (.bkf) file.

If you are backing up files and folders to tape, choose the tape you want to

use.

7. Click Start Backup, then click Advanced, select Data Verification, and click OK.

8. Click Schedule and enter the logon name and password that the backup will run

as, and then click OK. In the Schedule Job Options window, enter the name for

the backup jobfor example, "ServerName-IncBackup-Date," and click OK.

9. In the Schedule Job window, confirm that the Schedule tab is selected. Under

Schedule Task, select Weekly and click the days of the week you want the

incremental job to run. In Start time, enter the time you want the backup to start

and click OK.

10. Enter the logon name and password that the backup job will run as and then

click OK. Click OK again to exit the window.

The daily incremental job is now scheduled to run.

Dependencies

None

Technology Required

Backup.exe


26/88



SMF

Support Role Cluster Weekly


Description

Storing, restoring, and recovering data are key storage management activities for


be developed to ensure that backup and recovery processes fulfill business

requirements and service level objectives.

Task: Run weekly normal backup

Purpose

Performing regularly scheduled backups is an integral part of any file service

operations environment. A good backup strategy should include daily incrementalor differential backups as well as weekly backups. Numerous strategies exist

regarding the frequency and types of backup jobs that an operations team can

implement.

Procedure: Configure normal backup job

1. Start the Backup utility.

2. On the Backup tab, select the drives, folders, and files that will be

included in the backup job. It is a good idea to include the system state

information as part of the backup operation.

3. On the Tools menu, click Options. In the Options window, click the Backup Log

tab, select Detailed, and click OK.

Backup logs can be vital for troubleshooting and recording status of the backup

operation. The default setting in Windows Server 2003 is for backup logs to

contain summary information such as loading a tape, starting the backup,

backing up files, backing up bytes, or failing to open a file. Some operations

environments require more detailed informationspecifically, what files are

being backed up for a particular backup job.

4. On the Tools menu, click Options. In the Options window, click the Backup

Type tab. In the Default Backup Type drop-down list, select Normal and click

OK.

5. In Backup Destination, select one of the following:

Choose a file to back up files and folders to a file. This is the default setting.

Choose a tape device if you want to backup files and folders to a tape.


27/88


6. In Backup media or file name, select one of the following:

If you are backing up files and folders to a file, enter the path and file name

of the backup (.bkf) file.

If you are backing up files and folders to tape, choose the tape you want to

use.

7. Click Start Backup, click Advanced, select Data Verification, and click OK.

8. Click the Schedule, enter the logon name and password that the backup job will

run as, and then click OK.

9. In the Schedule Job Options window, enter the name for the backup job, such as

"Increment Backup," and click OK.

10. In the Schedule Job window, confirm the Schedule tab is selected. Under

Schedule Task, select Weekly and click the days of the week you want the

incremental job to run. In Start Time, enter the time you want the backup job to

start, and click OK.

11. Enter the logon name and password that the backup job will run as and thenclick OK.

12. Click OK.

The weekly normal job is now scheduled to run.

Dependencies

None

Technology Required

Backup.exe


28/88


Optimizing Quadrant Availability

Management SMF

Operations Role Cluster Weekly

Process: Design for service recovery

Description

Regardless of how well designed and managed an IT service is, problems with its

delivery can still occurwhether as the result of an unexpected event or even the

failure of a countermeasure deployed to protect the service. A major design

consideration for high availability is a reactive one, charged with recovering service

as quickly and efficiently as possible. Rapid recovery may also be the appropriate

design choice for a particular availability risk if an effective countermeasure proves

to be too expensive for the customer to justify.

Task: Update automated system recovery (ASR) backup

Purpose

There is a potential for a system failure during the lifetime of a file server. Several

startup options, such as safe mode and last known good configuration, are available

to use to recover from system failure. However, automated system recovery (ASR)

backups should be included in the regular maintenance of your file server to act as a

last resort in system recovery.

ASR will back up the system files necessary for starting the file server. Other data

should be included as part of the daily and weekly backup jobs for the server. ASR

backups are performed using Backup in interactive mode. They cannot be scheduled.

Procedure 1: Get media for ASR backupASR backup requires a blank 1.44-MB disk to save system settings, and media such

as tapes or compact discs that will contain the backup files.

1. A separate media set is recommended for ASR backups. The media set should be

stored in a secure location, separate from data backup files.

2. Store the 1.44-MB disk with the ASR backup set it was created with. You must

have the disk that was created with the ASR backup set in order to perform ASR

recovery.

Procedure 2: Create ASR backup

1. Click Start, point to All Programs, point to Accessories, point to System Tools,and then click Backup.

2. On the Jobs menu, click New.

3. On the Tools menu, click ASR Wizard.

4. Follow the instructions that appear on the screen.


29/88


Procedure 3:File server does not have a floppy disk drive

1. Perform an ASR backup on the computer without the floppy disk drive. ASR

backup will log an error.

2. Copy the Asr.sif and Asrpnp.sif files located in the %systemroot%\Repair

directory to another computer with a floppy disk drive, and then copy those files

onto a disk.

Dependencies

File server should have a floppy disk drive. Procedure 3 provides a workaround

to copy system files to a disk, but a floppy disk drive is required for ASR

recovery.

You must be a member of an administrators or backup operators group to

perform ASR.

Technology Required

Backup.exe


30/88


Optimizing Quadrant Availability

Management SMF

Operations Role Cluster Quarterly

Process: Design for service recovery

Description

Regardless of how well designed and managed an IT service is, problems with its

delivery can still occurwhether as the result of an unexpected event or even the

failure of a countermeasure deployed to protect the service. A major design

consideration for high availability is a reactive one, charged with recovering service

as quickly and efficiently as possible. Rapid recovery may also be the appropriate

design choice for a particular availability risk if an effective countermeasure proves

to be too expensive for the customer to justify.

Task: Validate ASR recovery

Purpose

The ASR backup must be validated in order to confirm the integrity of the backup

process. The operations team must also be familiar with the hardware and software

involved in the ASR recovery process.

Procedure 1: Prepare for ASR recovery

1. Retrieve the latest ASR backup media set and disk from the secure location.

Verify that the media and disks are from the same backup.

2. Retrieve the media set for the most recent normal backup of the server.

3. Retrieve the original Windows Server 2003 installation CD.

4. Retrieve any mass storage device driver files supplied by the manufacturer.

Verify that you have this file before beginning the recovery operation.

5. Configure the recovery server hardware.

Procedure 2: Perform ASR recovery

1. Insert the original Windows Server 2003 installation CD.

2. Restart the server. If prompted to press a key to start the computer from the CD,

press the requested key.

3. If you have a separate driver file as described in Procedure 1, Step 4, use the

driver as part of the Setup by pressing F6 when prompted.

4. Press F2 when prompted at the beginning of the text-only mode section of Setup.

You will be prompted to insert the ASR disk you have previously created.

5. Follow the directions on the screen.

6. If you have a separate driver file as described in Procedure 1, Step 4, press F6 (a

second time) when prompted after the system restarts.

7. Follow the directions on the screen.


31/88


Procedure 3: Restore data files to the recovery server


2. On the Welcome tab, click Restore Wizard (Advanced).

3. Click Next.

4. Select the items to be restored from the latest normal backup set and click Next.5. At this point, you can click Finish to start the restore or click the Advanced

button for more options. If you decide to configure Advanced options, the

following is a list of items that should be selected.

Restore files to original location

Leave existing files

Restore security settings

Restore junction points but not the folders and file data they reference

Preserve existing volume mount points

Dependencies ASR recovery requires that the recovery server have the same hardware and disk

configuration as the server where the ASR backup was performed.

Perform regular ASR backup.

Manufacturer-supplied device drivers for mass storage devices.

Technology Required

Backup.exe


32/88


Operating Quadrant Directory Services

Administration SMF

Infrastructure Role

Cluster

Daily

Process: Maintaining the directory

Purpose

The data contained in the directory is, or very soon will be, critical to the base

operation and productivity of the organization. If the directory becomes unavailable

for any reasonfor example, through equipment failure or data corruptionthe

business will suffer from lost productivity and financial loss. Developing sound

backup and restore procedures for the directory and supporting system components

ensures that no critical directory data and configuration information will be lost.

Task: Back up DFS namespace configuration

Purpose

This task creates a backup of the DFS namespace and a restoration script to resolve

issues with DFS objects.

Procedure 1: Export DFS namespace

Windows Server 2003 Support Tools include the Dfsutil.exe in the can be used to

export the DFS namespace configuration into a script that can be used later for

restoration.

The following command will export the links:

Dfsutil /Root :\\dfsname\root/Export:

wherefilenameis the name of the script that will contain the DFS namespaceconfiguration for restoration.

Procedure 2: Automate DFS configuration export

This process can be automated using Microsoft Windows Shell Scripting. The

following is a simple command that can read an input file.

Each line of the input file lists a DFS root:

echo off

for /f %%i in (input.txt) do dfsutil.exe /view:%%i /export:

exit

wherefilename is the name of the file that will contain the report.

Dependencies

None

Technology Required

Dfsutil.exe

Windows Host Script


33/88



SMF

Support Role Cluster Weekly


Description



be developed to ensure that operations fulfill business requirements and service level

objectives.

Task: Verify previous days backup job

Purpose

This task provides guidance on verifying the integrity of the daily scheduled backup.

Regardless of the utility used to provide backup service to the file server, theoperations team should verify each backup job after its completion. This verification

allows the operations team to resolve issues concerning backups that may put the

organization at risk of data loss.

Procedure 1: Verify completion of backup

You can use Event Viewer to verify whether a backup started and completed, and if

any errors were encountered during the backup operation.

1. Start Event Viewer.

2. Right-click Application Log, and click Properties, highlight View, and select

Filter.

3. In Event Source, click the drop-down menu, select Backup, and click OK.

4. Search for the following events:

Event 8000. This event signals the start of a backup on a volume. You should

receive this event for each volume in the backup job.

Event 8001. This event signals the end of a backup on a volume. You should

receive n-1 of this event for a backup job, where n is equal to the number of

volumes in the backup job. When a volume has been backed up successfully,

Event 8001 will be logged as an informational event. When errors are

encountered backing up a volume, Event 8001 will be logged as an error

event. Event 8019. This event signals the end of the backup operation. You should

receive one 8019 event per backup job.


34/88


Procedure 2: Review the backup log

Backup logs can be vital for troubleshooting and recording status of the backup

operation. The default setting in Windows Server 2003 is for backup logs to contain

summary information such as loading a tape, starting the backup, backing up files,

backing up bytes, or failing to open a file. Some operations environments requiremore detailed informationspecifically, what files are being backed up for a

particular backup job.

To get more detailed logging in the backup logs


2. On the Tools menu, click Options.

3. In the Options window, click the Backup Log tab, select Detailed, and click OK.

Backup logs will now contain detailed information regarding the backup operations.

To review the backup log

1. Start Backup utility.

2. On the Tools menu, click Reports.

3. In the Backup Reportdialog box, select the previous nights backup report, and

click View.


35/88


Procedure 3: Report backup problems to incident management

Use your organization's incident management process to record the following

conditions in your environment. This procedure describes some of the steps that

should be followed when filling out the incident management report.

1. Event 8000 is not logged in the application log. When this occurs, the file serveris at risk of data loss. Verify that the backup job has not been deleted. Review the

start time for the job to verify that it has not been modified.

2. Event 8000 is not logged for all volumes on the server. When this occurs, a

volume is at risk of data loss. Review the backup configuration for the backup

job to see if the volume has been removed from the backup job. Check the

configuration management database (CMDB) to see if the volume has been

removed from the backup job.

3. Event 8001 is logged as a warning event in the application log . Review the

backup log by searching for the "Warning:" string in the body of the log. Record

what the warning is and the reason for the warning.4. Event 8019 is not logged in the application log. This means the backup job is

still running. Review the application log and record the last volume to trigger a

successful 8001 informational event. Record the last volume to trigger an 8000

event.

Dependencies

Backup jobs are logged to disk

Incident management process

Technology Recommended

Backup Third-party backup software


36/88



SMF

Infrastructure Role

Cluster

Daily

Process: Storage resource management

Description

Storage resource management (SRM) is a key storage management activity that

ensures that important storage devices, such as disks, are formatted and installed

with appropriate file systems.

In addition, SRM includes using management technologies to monitor storage

resources in order to ensure that they meet availability, capacity, and performance

requirements.

Task: Monitor available disk space

PurposeThis task proactively monitors disk space on a volume to control the allocation of

disk space and to provide reporting for capacity planning. It mitigates any problems

that may result in rapid file growth on a volume.

In an IT environment, it is important to set alerts on a logical volume at differing

capacity levels. Some alerts are informational so that the status of the disk volume

can be reported. Other alerts are used to warn the operations team of a real problem

with capacity on a volume. The following are suggested thresholds on a volume:

Sixty-five percent capacity. It is important to note that a particular volume is at

65 percent or more full. This means that volume has only 35 percent or less

capacity for growth. Seventy-five percent capacity. When a volume is 75 percent full, consider

creating new shares on another volume.

Ninety percent capacity. Volumes that are at 90 percent capacity should not

have file shares created on them. Volumes that are at 90 percent should be

included in the problem management report.

Once the 90 percent capacity threshold is reached and an alert is generated, an

administrator should initiate appropriate changes such as increasing available

capacity, or begin to migrate the shares to higher-capacity subsystems.

Additional administrative actions might include performing disk

defragmentation and disk cleanup. (See Task: Review Disk Fragmentation.)


37/88


Procedure 1: Configure alert

1. Start System Monitor.

2. Expand the Performance Logs and Alerts node, right-click Alerts, and click New

Alert Settings.

3. Type Jobs Spooling and click OK.

4. On the General tab, click Add, and select the following object, instance, and

counter:

Object Instance Counter

Logical Disk Space Each Logical Volume

Instance.

% Free Space

5. In the Alert when the value is drop-down box, select Over and enter the limit

for your environment.

6. On the Action tab, the default selection is Log an entry in the application event

log.7. Select the Schedule tab, click Start Log At, and enter the start time for the alert.

8. Click Apply, and then click OK.

The alert is activated and will have a green status indicating that it is logging

information based on the configuration and schedule.

Procedure 2: Stop creating share alert

Review the event log for Event 2031:

Event Type: Information

Event Source: SysmonLog

Event Category: None

Event ID: 2031Description:

Counter: \\Servername\LogicalDisk(driveletter)\% Free Space has tripped its alert

threshold. The counter value of n is under the limit value of n.

When you begin to receive Event 2031, the capacity of the volume must be

included in the daily problem management report. This alert can indicate when

to stop creating new shares on a volume. The remaining space on the volume is

used to accommodate data growth on existing shares.

This alert will continue be written to the application log until the alert is stopped.

It is okay to stop the alert, but once a volume has triggered the Stop Creating

Share alert, the capacity should always be included in the daily problem

management report.


38/88


Procedure 3: Capacity alert

Review the event log for Event 2031. (See Procedure 2: Stop creating share alert.)

Once the capacity alert is triggered, the disk has reached capacity. The alert

should be set as 20-25 percent free space. Once a volume has triggered the

capacity alert, submit a request for change (RFC) to move data to another volumeor to extend the volume.

Dependencies

An alert must be configured to perform an action when a certain disk capacity

threshold is reached.

Technology Required

Performance Logs and Alerts in Windows Server 2003


39/88



SMF

Infrastructure Role

Cluster

Weekly

Process: Storage resource management

Description

Storage resource management (SRM) is a key process for ensuring that important

storage devices, such as disks, are formatted and installed with appropriate file

systems.

In addition, SRM includes using management technologies to monitor storage

resources to ensure that they meet availability, capacity, and performance

requirements.

Task: Review disk fragmentation

PurposeDisk fragmentation occurs when files are written to non-adjacent clusters on a disk.

During normal operations of a file server, the file system will become fragmented.

Fragmentation has a performance effect on the read/write action. A disk that is

highly fragmented requires several passes of the disks read and write heads to

retrieve or store data to the disk.

To analyze the extent of disk fragmentation on a volume and to remediate

performance issues associated with fragmented files and free space, run the Disk

Defragmenter utility. An effective use of the Disk Defragmenter utility should

include removing unnecessary files from the volume. Prior to defragmenting a

volume, run the Disk Cleanup utility to perform the following activities:

Remove temporary Internet files.

Remove any downloaded program files (for example, Microsoft ActiveX

controls and Java applets downloaded from the Internet).

Empty the Recycle Bin.

Remove Windows temporary files.

Remove Windows components that you are not using.

Remove installed programs that you no longer use.


40/88


Procedure 1: Analyze the volume

1. Start Disk Defragmenter.

2. Select the volume that you want to analyze, and then click Analyze.

3. Click Save As to save the report.

You can use Defrag.exe to schedule an analysis of the disk fragmentation on a

volume. To output the report to a text file, the syntax for the command line is:

defrag -a v >filename.txt

wherefilename is the name of the file that will contain the report.

The Disk Defragmenter window displays the estimated disk usage before

defragmentation. For more detail, use the command line above to perform this task.

Based on the results of the report, either run disk cleanup and proceed to defragment

the volume, or wait for the next scheduled defragmentation. If, after conducting

several analyses of the volume for fragmentation, the results show there is no need to

defragment the disk, then you may want to move the frequency of this task to once amonth.

Procedure 2: Clean up the volume

1. Start Disk Cleanup.

2. Select the volume that was analyzed in Procedure 1.

3. Select the file types to delete and click OK.

Cleanmgr.exe can be scheduled to run. Prior to scheduling the Cleanmgr.exe,

you must specify which tasks you want performed during the disk cleanup. This

can be accomplished by running the following command at the command line:

cleanmgr /d driveletter: /sageset:n

where driveletter is the volume that you want to clean up.

4. When you enter this command, the Disk Cleanup Settings dialog box appears.

Select the file types you want removed and click OK.

Now you can schedule the disk cleanup task you just created by running the

following command from the command line or Task Scheduler:

cleanmgr /sagerun:n


41/88


Procedure 3: Defragment the volume

1. Start Disk Defragmenter.

2. Click the volume that you want to defragment, and then click the Defragment

button.

You can use Defrag.exe to schedule defragmentation on a volume. It is best todefragment a volume during low usage periods in order to reduce the effect the

process has on file server performance. The syntax for the command line is:

defrag -v >filename.txt

where volume is the drive you want to defragment, andfilename is the name of

the file that will contain the defragmentation report. For a list of switches for the

Defrag command, at the command prompt, type defrag.

Dependencies

Administrator privileges are required to run Disk Defragmenter.

Defragmentation requires 15 percent free disk space. If there is low disk space,consider using the f switch. This switch forces defragmentation even if free disk

space is low.

Confirm that there is a good backup of the volume prior to performing

defragmentation.

For more information on running Disk Cleanup from the command line, see the

Automating Disk Cleanup Tool in Windows white paper available at

http://support.microsoft.com/default.aspx?scid=kb;EN-US;253597.

Disk Defragmenter cannot be run on a volume that has Volume Shadow Copies

activated. For more information, see the Shadow Copies May Be Lost When You

Defragment a Volume white paper available athttp://support.microsoft.com/default.aspx?scid=kb;en-us;312067.

Technology Required

Disk Defragmenter

Disk Cleanup
http://support.microsoft.com/default.aspx?scid=kb;EN-US;253597http://support.microsoft.com/default.aspx?scid=kb;EN-US;253597http://support.microsoft.com/default.aspx?scid=kb;en-us;312067http://support.microsoft.com/default.aspx?scid=kb;en-us;312067http://support.microsoft.com/default.aspx?scid=kb;en-us;312067http://support.microsoft.com/default.aspx?scid=kb;EN-US;253597


42/88



SMF

Operations Role Cluster As Needed


Description



be developed to ensure that backup and recovery processes fulfill business

requirements and service level objectives.

Task: Verify restore

Purpose

When restoring files and folders to the file system, it is important to verify the

successful completion of the restoration task. Without verifying that data has beenrestored prior to directing users to the restore location, the integrity of the

backup/restore process could be questioned by users.

Procedure: Verify restore configuration tasks


2. On the Tools menu, select Reports.

3. In the Backup Reports window, select the report that contains the Restore Job,

and click View.

4. Search the log for the Operation: Restore string.

5. Verify that the restore location and restore files are in the location specified in the

initial restore request.

6. Use Windows Explorer to navigate to the location of the restore and verify that

the data exists.

Dependencies

Scheduled backups are being performed.

Technology Required

Backup


43/88


Optimizing Quadrant Capacity Management

SMF

Operations Role Cluster Daily

Process: Managing resources and service performance

Description

Capacity management is concerned with optimizing the use of IT resources in order

to achieve the level of service performance agreed upon with the client. These

resources are supplied by support organizations to ensure that the requirements of

the business are met. The capacity management process can be either reactive or

proactive. Iterative activities, such as monitoring, analyzing, tuning, and reporting,

are also important in the process of managing resources and service performance.

Each process requires different types of data. For example, managing IT resources

involves documenting the usage levels of individual components in the

infrastructure, whereas managing service performance records transaction

throughput rates and response times.

Task: Capture service performance statistics

Purpose

During the normal operation of a file server, it is important to monitor the overall

health of the server. This information will be used to review general performance,

adherence to service level agreements (SLAs), and capacity planning and to create a

baseline for the file server.

Procedure: Create performance monitor logs

1. Start System Monitor.2. Double-click Performance Logs and Alerts, right-click Counter Logs, and select

New Settings.

3. Enter the name for this logfor example, "Service Performance Statistics"and

click OK.


44/88


4. On the General tab, click Add Counters and select the following counters:

Processor Performance Notes

Processor\% Processor

Time

The percentage of elapsed time the processor

spent executing instructions for processes or

services. It reports the sum of the time theprocessors spent executing code in privileged

mode and executing code in user mode. This

counter provides an overall view of the

processors' activity.

Processor\% Privileged

Time

The percentage of elapsed time that the

process threads spent executing code in

privileged mode. The operating system

switches application threads to privileged

mode to allow direct access to the systems

kernel.

System\Context

Switches/sec

The combined rate at which all processors on

the computer are switched from one thread to

another. Context switches occur when a

running thread voluntarily relinquishes the

processor, is preempted by a higher priority

ready thread, or switches between user mode

and privileged mode to use an executive or

subsystem service. High rates of context

switching can result from inefficient hardware

or poorly designed device drivers or

applications.

Memory Performance Notes

Memory\Pages/sec Pages/sec is the rate at which pages are read

from or written to the disk in order to resolve

hard page faults. This counter is a primary

indicator of the kinds of faults that cause

system-wide delays.

Memory\Available

megabytes (MB)

Available megabytes is the amount of

physical memory, in megabytes, immediately

available for allocation to a process or for

system use.

Paging File\% Usage The amount of the page file instance in use in

percent.


45/88


Network Performance Notes

Server\Error System The number of times an internal server error

was detected. Unexpected errors usually

indicate a problem with the server.

Server\Work Item

Shortages

This occurs when no work item is available or

can be allocated to service the incoming

request. A work item is the location where the

server stores a server message block (SMB).

Work item shortages might be caused by an

overloaded server.

Server\Blocking Requests

Rejected

The number of times the server has rejected

blocking SMBs due to insufficient count of

free work items. This counter indicates

whether the MaxWorkItem or

MinFreeWorkItems server parameters mightneed to be adjusted.

Server Work

Queues\Queue Length

Queue length is the current length of the

server work queue for this CPU. A sustained

queue length greater than four might indicate

processor congestion. This is an instantaneous

count, not an average over time.

Disk Performance Notes

Physical Disk\Current

Disk Queue Length

Current disk queue length is the number of

requests outstanding on the disk at the time

the performance data is collected. It alsoincludes requests in service at the time of the

collection. This is an instantaneous snapshot,

not an average over time interval. Multi-

spindle disk devices can have multiple

requests that are active at one time, but other

concurrent requests are awaiting service.

This counter might reflect a transitory high or

low queue length, but if there is a sustained

load on the disk drive, it is likely that this will

be consistently high. This counter requests

experience delays proportional to the lengthof this queue minus the number of spindles

on the disks. For good performance, this

difference should average less than two.

Physical Disk\Avg. Disk

sec/read

Avg. Disk sec/read is the average time, in

seconds, of a data read from the disk.


46/88


Disk Performance Notes

Physical Disk\Disk read

bytes/sec

Disk read bytes/sec is the rate at which bytes

are transferred from the disk during read

operations.

Physical Disk\Disk write

bytes/sec

Disk write bytes/sec is the rate at which bytes

are transferred to the disk during write

operations.

Physical Disk\Disk

read/sec

Disk read/sec is the rate of read operations on

the disk.

Physical Disk\Disk

write/sec

Disk write/sec is the rate of write operations

on the disk.

5. Fifteen is the default sampling interval. You can modify this number. Increasing

the interval will reduce the size of the log file but at the risk of losing data.

Decreasing the interval will increase the size of the log file and provide a more

detailed look at the performance.

6. On the Log Files tab, click the Log File Type drop-down box and select the

output format. Choose a CSV file type if you want to be able to manipulate the

data in Excel. The data can also be written to an SQL database format.

7. Make sure the End File Names checkbox is checked. Use the year, month, and

day format yyyymmdd.

8. On the Schedule tab, click the Start Log At checkbox, and enter the start time for

logging.

9. Click the Stop Log At checkbox and enter the time at which logging should stop.

10. Click Apply, and then click OK. The log files will be created in \Perflogs by default.

The log is activated and will have a green status, indicating that it is logging

information based on the configuration and schedule.

Dependencies

You must be a member of the administrators group or the performance log users

group on the local computer, or have been delegated the appropriate authority.

There must be adequate space on the disk where the log files are being created.

Technology Required

System Monitor


47/88


Task: Capture service usage statistics

Purpose

During the normal operation of a file server, it is important to monitor service usage.

Service usage differs from service performance by focusing on how users consume

file server resources. This information will be used to review general performance,

adherence to SLAs, and capacity planning and to create a baseline for the file server.

Procedure: Create performance monitor logs

1. Start System Monitor.

2. Double-click Performance Logs and Alerts, right-click Counter Logs, and select

New Settings.

3. Enter the name for this log, such as "Service Performance Statistics,"and click

OK.

4. On the General tab, click Add Counters and select the following counters:

Logical Disk

Performance

Notes

Logical Disk\% Free

Space

% Free Space is the percentage of total usable space that

was free on the selected logical disk drive.

Logical

Disk\Current Disk

Queue Length

Current Disk Queue Length is the number of requests

outstanding on the disk at the time the performance

data is collected. It also includes requests in service at

the time of the collection. This is an instantaneous

snapshot, not an average over time interval. Multi-

spindle disk devices can have multiple requests that are

active at one time, but other concurrent requests are

awaiting service.

This counter might reflect a transitory high or low

queue length, but if there is a sustained load on the disk

drive, it is likely that this will be consistently high. This

counter requests experience delays proportional to the

length of this queue minus the number of spindles on

the disks. For good performance, this difference should

average less than two.

Logical Disk\Avg.

Disk sec/read

Avg. Disk sec/read is the average time, in seconds, of a

data read from the disk.

Logical Disk\Avg.

Disk sec/write

Avg. Disk sec/write is the average time, in seconds, of a

data write to the disk.

Logical Disk\Disk

read bytes/sec

Disk read bytes/sec is the rate at which bytes are

transferred from the disk during read operations.

Logical Disk\Disk Disk write bytes/sec is the rate at which bytes are


48/88


Logical Disk

Performance

Notes

write bytes/sec transferred to the disk during write operations.

Logical Disk\Disk

read/sec

Disk read/sec is the rate of read operations on the disk.

Logical Disk\Disk

write/sec

Disk write/sec is the rate of write operations on the

disk.

Network Performance Notes

Server\Server

Sessions

The number of sessions currently active in the server.

This value indicates current server activity.

Server\Bytes

Total/sec

The number of bytes the server has sent to and received

from the network. This value provides an overall

indication of how busy the server is.

Server\Files Open The number of files currently opened in the server. Thisvalue indicates current server activity.

Volume Shadow Copy

Service Performance

Notes

Shadow Copies\%

Disk Used by Diff

Area File

Size of all diff area files on the input volume divided by

volume.

Shadow

Copies\Allocated

Space(MB)

Space used in the shadow storage volume for all the

shadow copies of the input volume.

Shadow Copies\Nb

of Shadow Copies

Number of shadow copies of a volume.

Shadow

Copies\Used Space

Space used in the shadow storage volume for all the

shadow copies of the input volume.

Shadow Copies\Nb

of Diff Area Files

Total number of diff area files on a volume. This value

is the same as the total number of shadow copies on the

system whose shadow storage is configured on the

input volume.

Shadow

Copies\Size of DiffArea Files

Size of all diff area files on the input volume.


49/88


5. Fifteen is the default sampling interval. You can modify this number. Increasing

the interval will reduce the size of the log file but at the risk of losing data.

Decreasing the interval will increase the size of the log file and provide a more

detailed look at the performance.

6. On the Log Files tab, click the Log File Type drop-down box and select the

output format. Choose a CSV file type if you want to be able to manipulate the

data in Excel. The data can also be sent to a SQL database format.

7. Make sure the End File Names checkbox is checked. Use the year, month, and

day format yyyymmdd.

8. On the Schedule tab, click the Start Log At checkbox, and enter the start time for

logging.

9. Click the Stop Log At checkbox and enter the time at which logging should stop.

10. Click Apply, and then click OK. The log files will be created in \Perflogs by default.

The log is activated and will have a green status indicating that it is logginginformation based on the configuration and schedule.

Dependencies

You must be a member of the administrators group or the performance log users

group on the local computer, or have been delegated the appropriate authority.

Adequate space on the disk where the log files are being created.

Run Volperf.exe from the Windows Server 2003 Resource Kit to enable Volume

Shadow Copy service performance counters.

Technology Required

System Monitor Volperf.exe


50/88


Operating Quadrant Service Monitoring and

Control SMF

Infrastructure and

Operations Role

Clusters

Daily

Process: Perform monitoringDescription

Monitoring is concerned with the real-time recording of critical data values on an

ongoing basis. The aim of recording critical data values is to ensure that adequate

management information is available in order to maintain a service or services at

agreed-on levels of service performance or, or at a minimum, to be recovered

quickly.

Task: Review quota levels

Purpose

Monitor quota levels on volumes and notify users when the volumes have exceeded

assigned warning levels and quota limits.

Procedure 1: View quota events in event log

1. Start Event Viewer.

2. Right-click System, point to View, and click Filter. Use the following filter

configuration:

Event Source: NTFS

From: Events On

To: Events On

Note Use a consistent 24-hour period for reporting quota information.

3. Sort the list by event. When a user exceeds his or her quota limit, Event 37 will be

logged to the file. The user field will point to the user who has exceeded his or

her quota threshold. The description field will point to the volume where the

threshold was assigned.

4. Note the user and volume where the quota threshold was exceeded. You can

record this information in a program such as Microsoft Excel.


51/88


Procedure 2: Viewing quotas

The user interface (UI) can be used to view quota entries on a volume.

1. In Windows Explorer, click My Computer, right-click a volume, and then click

Properties.

2. In the Properties dialog box, click the Quota tab.

3. On the Quota tab, click Quota Entries.

4. Click the Status column to sort by status.

5. For each user who has exceeded a quota threshold, record the following

information in the spreadsheet created in Procedure 1, Step 4:

Amount Used

Quota Limit

Warning Level

Percent Used

Server and Volume where quota has been assigned

Procedure 3: Notify users that quota thresholds have been exceeded

For each user identified in Procedures 1 and 2, send an e-mail message notifying the

user that he or she has exceeded the warning level or quota limit.

Based on your operations environment, recommend steps to rectify the quota. Some

options for resolving this situation are:

Delete non-business-essential data from the volume.

Request an increase in quota limit.

Dependencies Quotas enabled on volume.

Logging events to event log has been selected for exceeding warning levels and

quota limits.

Technology Suggested

Microsoft Excel


52/88


Changing Quadrant Configuration

Management SMF

Infrastructure Role

Cluster

Monthly

Process: Reviewing configuration items

Description

Because the accuracy of the information stored in the configuration management

database (CMDB) is crucial to the success of Change Management, Incident

Management, and other SMFs, a review process should be established to ensure that

the database accurately reflects the production IT environment.

Task: Compliance checkverify that shares are created in the

proper location

Purpose

This task ensures that shares created on file servers are in compliance withorganization standards for the location of file shares.

Procedure 1: Create server share report

1. Create a custom MMC and add the Shared Folder snap-in.

2. On the Actions menu, choose Export List to copy this information to a text file.

3. To automate the procedure, the following sample script can be used to create a

report of the folder shared on a file server and the path:

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _

& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colShares = objWMIService.ExecQuery("Select * from Win32_Share")

For each objShare in colSharescscript.Echo "AllowMaximum: " & vbTab & objShare.AllowMaximum

cscript.Echo "Caption: " & vbTab & objShare.Caption

cscript.Echo "MaximumAllowed: " & vbTab & objShare.MaximumAllowed

cscript.Echo "Name: " & vbTab & objShare.Name

cscript.Echo "Path: " & vbTab & objShare.Path

cscript.Echo "Type: " & vbTab & objShare.Type

Next

Procedure 2: Verify shared folders against shared folder location standard

1. Compare the path of the shared folder to the organizations standard for shared

folder creation in the CMDB.

2. If there are any discrepancies in the shared folders report and the CMDB, submit

an emergency RFC CAB/EC.

Dependencies

CMDB

Technology Required

Windows Management Instrumentation (WMI)


53/88


Supporting Quadrant Problem Management

SMF

Operations Role Cluster Daily

Process: Problem recording and classification

Description

This process deals with the recording and classification of a problem, which can

originate from a variety of sources and media. Problems may be reported through

the incident management process or as a result of analysis from the data collected by

the problem management team. Additionally, other SMF teams, such as availability

management and capacity management, might detect problems and pass this

information to the problem management team. It is important that all problems be

linked to existing incidents and that each problem be recorded in order to prioritize

its resolution. Once a problem has been recorded, it is assessed against the business

impact of the problem and the urgency of the required solution. This assessment

determines the problem classification.

Task: Review daily problem management report

Purpose

Ensure that the appropriate resources and priority levels have been assigned to

current problems. The report should include the status of any problems from the

previous day or any that occurred overnight.

Procedure 1: Check file server status

The status of each file server should be included in this report. This information

could include: Whether the file server is online.

Whether there any approved RFCs pending.

Status of last backup.

Confirmation that the performance monitor log from the previous day exists for

the server.

Current capacity for storage disk.

Status of DFS links.

Procedure 2: Review problems transferred from incident management

Review each incident that has been transferred to the problem management team.


54/88


Procedure 3:Prioritize and assign

Based on the information received on the status of the file server and any problems

transferred from incident management, set the priority of each problem and assign

the appropriate team members.

Dependencies

File server monitoring

Technology Required

None


55/88


Supporting Quadrant Incident Management

Control SMF

Supporting Role Cluster Weekly

Process: Investigation and diagnosis

Description

This process deals with investigating an incident and gathering diagnostic data. Its

aim is to identify how the incident can be resolved as quickly as possible.

The process allows for management escalation or functional escalation if either

becomes necessary in order to meet SLA targets.

Task: Create weekly service activity report

Purpose

This task provides a high-level report on a service request from the perspective of

when it was opened, when it was closed, and how long it took to resolve. Theorganization may have an SLA on the time it takes a customer to receive a response

from the incident management team once an incident has been reported. Managers

and leads can use such data to better balance the workload of the incident

management team.

Management can also use the service activity report to measure the effectiveness and

efficiency of the incident management staff itself. This information is important to

the members of the incident management team because it shows how long cases

have been open. This helps to determine which cases must be addressed next. The

following is an example of some of the information that can be included in the

activity report:

Total number of cases opened.

Total number of cases closed.

Number of cases closed on first contact with the incident management team.

Number of days a case has been open.


56/88


Procedure: Create report metrics

The method used to collect the data is dependent on the features of an organizations

incident tracking solution. But however the organization collects the data, it should

include the following informati

Documents

File Service POG