ISA Server 2000 performance Monitoring and optimization (i)

The primary purpose of monitoring the performance of ISA Server is to enable managers to get relevant alerts in a timely manner to view and address problems when the server is in an unusual situation.

Open the ISA Management Console, expand the Monitoring Configuration node, and click the Alerts folder to list all alerts in the details pane on the right (see Figure 1).

By default, ISA server automatically enables 39 of the 45 alerts. Each alert specifies an event, and the event is reported to the Windows 2000 event log by default. This allows you to see the events of ISA Server in the application log of Windows 2000 Event Viewer.

It is to be noted that only the first occurrence of events since the last shutdown can be viewed from the ISA Management. To view all of the information for ISA Server events, you must use the Windows 2000 Event Viewer.

In addition to using the default alerts, we can also create new alerts ourselves or modify existing alerts by right-clicking the "Alerts" folder, pointing to "new" in the pop-up menu, and then clicking Alert, then filling in the name of the alert, such as setting up an alert for the name "DNS intrusion."

Since the new alert is based on an existing alert and then adds some additional, specific criteria, setting up a DNS intrusion alert in "event and Conditions" requires "DNS intrusion" as an alert event, and then "any DNS intrusion" condition is specified as an attached condition. However, if you are setting up an alert for "overflow of host names due to DNS intrusion", select "DNS Intrusion" as an alert event and select "Hostname Overflow" as an additional condition. By doing so we can assemble the conditions that we want to alert (see Figure 2).

The Actions dialog box that pops up, in fact, is the setting of one or more actions that the computer will perform when an alert that satisfies the condition is present:

Send an e-mail message. After you select the Send an e-mail message check box, you will then need to enter information such as the SMTP server name, the recipient, and the sender.

Run a specific program. Select the Run a program check box, and then you need to enter information such as the location of the command or program you want to run, and the account in which you run it.

This event is logged in the Windows 2000 event log. Select the "Check to Windows tab Event Log" checkbox.

Stop or start any of the selected ISA Server services, such as firewall services, WEB Proxy services, timed content download services, and so on. If some ISA Server services are stopped, select the Stop Selected services check box, and then in the Stop Service dialog box, select the service you want to stop; If you start some ISA Server services, select Start Selected service check box, select the service you want to start in the Start Service dialog box.

In this way, we have created a new Isa alert, and when there is a satisfied event occurs, the server will follow the set to do the appropriate action to prevent the occurrence of adverse events. If you need to modify some alerts, you can find the appropriate alerts in the "Alerts" folder, which can be changed after the double hits the Properties box.

Double-click the "DNS intrusion" alert we just established, and then open the Events tab (see Figure 3).

You can see the "Actions will being excuted when the selected conditions occur" option group, which alerts you when an event occurs.

Set items from top to bottom in the following order:

Several such incidents should occur before an alarm is issued;

Before an alert is issued, it should occur several times per second (how often the event occurs).

The time of action execution can be set as follows:

You can select the immediately radio button if the event should be alerted again immediately.

Select the after Manual reset of alert radio button if you can only be alerted after the alert reset.

If you need to issue an alert after a specified number of times, select the ' If Time Since ' Execution is more Than Minutes radio button, and enter the minutes that should last before performing the operation.

In addition to this alert, ISA server also has its own logs and reports, in "Logs" and "Report Jobs" under the "Monitoring Configuration" node, which must also be opened or created to allow readers to learn from themselves.

Because these day-to-day data are important for management, network administrators must learn to read and analyze the problems they reflect. The format is similar to Windows 2000.