Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1516 lines
58 KiB

  1. @rem = '
  2. @goto endofperl
  3. ';
  4. #
  5. # Launching script from AT scheduler.
  6. #
  7. #at 23:37 /interactive /every:M,T,W,Th,F,S,Su cmd /c "c:\perl\bin\perl.exe c:\test.pl"
  8. #
  9. use Getopt::Long;
  10. use Time::Local;
  11. use Win32::EventLog;
  12. ### use Win32::API;
  13. use Win32;
  14. use Win32::PerfLib;
  15. use Win32::Registry;
  16. # use Text::Wrap qw(wrap $columns $huge);
  17. $columns = 80;
  18. $huge = 'wrap';
  19. $initial_tab = "";
  20. $subsequent_tab = "";
  21. @REG_DT_NAME = (
  22. "REG_NONE", # No value type
  23. "REG_SZ", # Unicode nul terminated string
  24. "REG_EXPAND_SZ", # Unicode nul terminated string
  25. # (with environment variable references)
  26. "REG_BINARY", # Free form binary
  27. "REG_DWORD", # 32-bit number
  28. "REG_DWORD_BIG_ENDIAN", # 32-bit number
  29. "REG_LINK", # Symbolic Link (unicode)
  30. "REG_MULTI_SZ", # Multiple Unicode strings
  31. "REG_RESOURCE_LIST", # Resource list in the resource map
  32. "REG_FULL_RESOURCE_DESCRIPTOR", # Resource list in the hardware description
  33. "REG_RESOURCE_REQUIREMENTS_LIST",
  34. "REG_QWORD" # 64-bit number
  35. );
  36. #
  37. # The following table maps the FRS event code to the Symbolic Name
  38. #
  39. %FRS_EL_TABLE = (
  40. 13500 => "FRS_ERROR",
  41. 13501 => "STARTING",
  42. 13502 => "STOPPING",
  43. 13503 => "STOPPED",
  44. 13504 => "STOPPED_FORCE",
  45. 13505 => "STOPPED_ASSERT",
  46. 13506 => "ASSERT",
  47. 13507 => "VOLUME_NOT_SUPPORTED",
  48. 13508 => "LONG_JOIN",
  49. 13509 => "LONG_JOIN_DONE",
  50. 13510 => "CANNOT_COMMUNICATE",
  51. 13511 => "DATABASE_SPACE",
  52. 13512 => "DISK_WRITE_CACHE_ENABLED",
  53. 13513 => "JET_1414",
  54. 13514 => "SYSVOL_NOT_READY",
  55. 13515 => "SYSVOL_NOT_READY_PRIMARY",
  56. 13516 => "SYSVOL_READY",
  57. 13517 => "ACCESS_CHECKS_DISABLED",
  58. 13518 => "ACCESS_CHECKS_FAILED_USER",
  59. 13519 => "ACCESS_CHECKS_FAILED_UNKNOWN",
  60. 13520 => "MOVED_PREEXISTING",
  61. 13521 => "CANNOT_START_BACKUP_RESTORE_IN_PROGRESS",
  62. 13522 => "STAGING_AREA_FULL",
  63. 13523 => "HUGE_FILE",
  64. 13524 => "CANNOT_CREATE_UUID",
  65. 13525 => "NO_DNS_ATTRIBUTE",
  66. 13526 => "NO_SID",
  67. 13527 => "NTFRSPRF_OPEN_RPC_BINDING_ERROR_SET",
  68. 13528 => "NTFRSPRF_OPEN_RPC_BINDING_ERROR_CONN",
  69. 13529 => "NTFRSPRF_OPEN_RPC_CALL_ERROR_SET",
  70. 13530 => "NTFRSPRF_OPEN_RPC_CALL_ERROR_CONN",
  71. 13531 => "NTFRSPRF_COLLECT_RPC_BINDING_ERROR_SET",
  72. 13532 => "NTFRSPRF_COLLECT_RPC_BINDING_ERROR_CONN",
  73. 13533 => "NTFRSPRF_COLLECT_RPC_CALL_ERROR_SET",
  74. 13534 => "NTFRSPRF_COLLECT_RPC_CALL_ERROR_CONN",
  75. 13535 => "NTFRSPRF_VIRTUALALLOC_ERROR_SET",
  76. 13536 => "NTFRSPRF_VIRTUALALLOC_ERROR_CONN",
  77. 13537 => "NTFRSPRF_REGISTRY_ERROR_SET",
  78. 13538 => "NTFRSPRF_REGISTRY_ERROR_CONN",
  79. 13539 => "ROOT_NOT_VALID",
  80. 13540 => "STAGE_NOT_VALID",
  81. 13541 => "OVERLAPS_LOGGING",
  82. 13542 => "OVERLAPS_WORKING",
  83. 13543 => "OVERLAPS_STAGE",
  84. 13544 => "OVERLAPS_ROOT",
  85. 13545 => "OVERLAPS_OTHER_STAGE",
  86. 13546 => "PREPARE_ROOT_FAILED",
  87. 13547 => "BAD_REG_DATA",
  88. 13548 => "JOIN_FAIL_TIME_SKEW",
  89. 13549 => "RMTCO_TIME_SKEW",
  90. 13550 => "CANT_OPEN_STAGE",
  91. 13551 => "CANT_OPEN_PREINSTALL",
  92. 13552 => "REPLICA_SET_CREATE_FAIL",
  93. 13553 => "REPLICA_SET_CREATE_OK",
  94. 13554 => "REPLICA_SET_CXTIONS",
  95. 13555 => "IN_ERROR_STATE",
  96. 13556 => "REPLICA_NO_ROOT_CHANGE",
  97. 13557 => "DUPLICATE_IN_CXTION_SYSVOL",
  98. 13558 => "DUPLICATE_IN_CXTION",
  99. 13559 => "ROOT_HAS_MOVED",
  100. 13560 => "ERROR_REPLICA_SET_DELETED",
  101. 13561 => "REPLICA_IN_JRNL_WRAP_ERROR",
  102. 13562 => "DS_POLL_ERROR_SUMMARY",
  103. 13563 => "FRS_STAGE_HAS_CHANGED",
  104. 13564 => "FRS_LOG_SPACE"
  105. );
  106. #
  107. # The following table maps the perfmon counter types to a printable name
  108. #
  109. %PERFMON_TYPE_TABLE = (
  110. PERF_COUNTER_COUNTER => "CNTR",
  111. PERF_COUNTER_TIMER => "TIMER",
  112. PERF_COUNTER_QUEUELEN_TYPE => "QLEN_TYPE",
  113. PERF_COUNTER_LARGE_QUEUELEN_TYPE => "LARGE_QLEN",
  114. PERF_COUNTER_100NS_QUEUELEN_TYPE => "100NS_QLEN",
  115. PERF_COUNTER_OBJ_TIME_QUEUELEN_TYPE => "OBJ_TIME_QLEN",
  116. PERF_COUNTER_BULK_COUNT => "BULK_CNT",
  117. PERF_COUNTER_TEXT => "TEXT",
  118. PERF_COUNTER_RAWCOUNT => "RAWCOUNT",
  119. PERF_COUNTER_LARGE_RAWCOUNT => "LARGE_RAWCNT",
  120. PERF_COUNTER_RAWCOUNT_HEX => "RAWCOUNTX",
  121. PERF_COUNTER_LARGE_RAWCOUNT_HEX => "LARGE_RAWCNTX",
  122. PERF_SAMPLE_FRACTION => "SAMPLE_FRAC",
  123. PERF_SAMPLE_COUNTER => "SAMPLE_CNTR",
  124. PERF_COUNTER_NODATA => "CNTR_NODATA",
  125. PERF_COUNTER_TIMER_INV => "CNTR_TIMER_INV",
  126. PERF_SAMPLE_BASE => "SAMPLE_BASE",
  127. PERF_AVERAGE_TIMER => "AVG_TIMER",
  128. PERF_AVERAGE_BASE => "AVG_BASE",
  129. PERF_AVERAGE_BULK => "AVG_BULK",
  130. PERF_OBJ_TIME_TIMER => "OBJ_TIME_TIM",
  131. PERF_100NSEC_TIMER => "100NS_TIMER",
  132. PERF_100NSEC_TIMER_INV => "100NS_TIMER_INV",
  133. PERF_COUNTER_MULTI_TIMER => "CNTR_MULTI_TIM",
  134. PERF_COUNTER_MULTI_TIMER_INV => "CNTR_MULTI_TIM_INV",
  135. PERF_COUNTER_MULTI_BASE => "CNTR_MULTI_BASE",
  136. PERF_100NSEC_MULTI_TIMER => "100NS_MULTI_TIM",
  137. PERF_100NSEC_MULTI_TIMER_INV => "100NS_MULTI_TIM_INV",
  138. PERF_RAW_FRACTION => "RAW_FRACTION",
  139. PERF_LARGE_RAW_FRACTION => "LARGE_RAW_FRAC",
  140. PERF_RAW_BASE => "RAW_BASE",
  141. PERF_LARGE_RAW_BASE => "LARGE_RAW_BASE",
  142. PERF_ELAPSED_TIME => "ELAPSED_TIME",
  143. PERF_COUNTER_HISTOGRAM_TYPE => "CNTR_HISTO_TYPE",
  144. PERF_COUNTER_DELTA => "CNTR_DELTA",
  145. PERF_COUNTER_LARGE_DELTA => "CNTR_LARGE_DELTA",
  146. PERF_PRECISION_SYSTEM_TIMER => "PREC_SYSTEM_TIM",
  147. PERF_PRECISION_100NS_TIMER => "PREC_100NS_TIM",
  148. PERF_PRECISION_OBJECT_TIMER => "PREC_OBJECT_TIM",
  149. PERF_PRECISION_TIMESTAMP => "PREC_TIMESTAMP",
  150. );
  151. # Success=0x0 :STATUS_SEVERITY_SUCCESS
  152. # Informational=0x1 :STATUS_SEVERITY_INFORMATIONAL
  153. # Warning=0x2 :STATUS_SEVERITY_WARNING
  154. # Error=0x3 :STATUS_SEVERITY_ERROR
  155. @EventSev = qw(Success Info Warning Error);
  156. $elogname{"frs"} = "ntfrs";
  157. $elogname{"sys"} = "System";
  158. $elogname{"app"} = "Application";
  159. $elogname{"sec"} = "Security";
  160. $elogname{"dns"} = "DNS Server";
  161. $elogname{"ds"} = "Directory Service";
  162. $USAGE = "
  163. Usage: $0 EventLogType [-computer=ComputerName | -file=eventlogfile]
  164. [-numrec=n] [-after=date] [-timezone=n]
  165. Print the most recent n eventlog records from ComputerName or EventLogFile.
  166. If -after is supplied print only those records after the given date.
  167. EventLogType can be one of (abbrev):
  168. ntfrs (frs)
  169. System (sys)
  170. Application (app)
  171. Security (sec)
  172. \"DNS Server\" (dns)
  173. \"Directory Service\" (ds)
  174. ComputerName : name of computer to access on-line eventlog, default=local computer
  175. EventLogFile : name of file containing saved event log. (overrides Computer option)
  176. NumRec : Number of event log records to read, default=200.
  177. After : Print records after the given date in the format, \"Jan 1,2000\".
  178. TimeZone : The time zone offset in seconds to apply to the eventlog record times.
  179. : zero is GMT. default is to use local timezone.
  180. ";
  181. $argcomputer = $ENV{ComputerName};
  182. $argelfile = "";
  183. $argnumrec = 200;
  184. $argafter="jan 1,1990";
  185. $argtimezone = 1000000;
  186. &GetOptions("computer=s" => \$argcomputer,
  187. "file=s" => \$argelfile,
  188. "timezone=i" => \$argtimezone,
  189. "after=s" => \$argafter,
  190. "numrec=s" => \$argnumrec);
  191. die $USAGE unless @ARGV;
  192. if ($HKEY_LOCAL_MACHINE->Open("system\\currentcontrolset\\services\\NtFrs", $regkey)) {
  193. if ($regkey->QueryKey($myclass, $numkeys, $numvalues)) {
  194. print "\nntfrs keyname contains $numkeys subkeys and $numvalues values\n\n";
  195. }
  196. ProcessKey($regkey, 4);
  197. $regkey->Close();
  198. print "\n";
  199. }
  200. goto EVENT_LOG;
  201. ###
  202. #### DWORD WINAPI GetTempPathA( DWORD nBufferLength, LPSTR lpBuffer );
  203. ###
  204. #### I: value is an integer
  205. #### N: value is a number (long)
  206. #### P: value is a pointer (to a string, structure, etc...)
  207. ###
  208. ###
  209. ###$GetTempPath = new Win32::API("kernel32", "GetTempPath", [N, P], N);
  210. ###$lpBuffer = " " x 80;
  211. ###
  212. ###$return = $GetTempPath->Call(80, $lpBuffer);
  213. ###$TempPath1 = substr($lpBuffer, 0, $return); # ignore left over bytes in buffer.
  214. ###$TempPath2 = (split(/\0/, $lpBuffer))[0];
  215. ###
  216. ###print "$TempPath1 \n";
  217. ###print "$TempPath2 \n";
  218. ###
  219. # Routines available in core:
  220. printf "%s\n", Win32::FormatMessage(Win32::GetLastError());
  221. printf "%s\n", Win32::LoginName();
  222. printf "%s\n", Win32::NodeName();
  223. printf "%s\n", Win32::DomainName();
  224. printf "%s\n", Win32::FsType();
  225. printf "%s\n", Win32::GetCwd();
  226. ($osstring, $osmajor, $osminor, $osbuild, $osid) = Win32::GetOSVersion();
  227. @os = qw(Win32s, Win95, WinNT);
  228. print "$os[$osid] $osmajor\.$osminor $osstring (Build $osbuild)\n" ;
  229. # Win32::Spawn COMMAND, ARGS, PID
  230. printf "%s\n", Win32::GetTickCount();
  231. printf "%s\n", Win32::IsWinNT();
  232. printf "%s %s\n", $ENV{PROCESSOR_ARCHITECTURE};
  233. print "perl version - $Win32::VERSION \n";
  234. #
  235. #
  236. # Perfmon calls.
  237. #
  238. my $server = "sudarctest1";
  239. Win32::PerfLib::GetCounterNames($server, \%counter);
  240. %r_counter = map { $counter{$_} => $_ } keys %counter;
  241. # retrieve the id for process object
  242. #$process_obj = $r_counter{Process};
  243. # retrieve the id for the process ID counter
  244. #$process_id = $r_counter{'ID Process'};
  245. $process_obj = $r_counter{Process};
  246. $process_id = $r_counter{'ID Process'};
  247. $process_handles = $r_counter{'Handle Count'};
  248. $process_pctproc = $r_counter{'% Processor Time'};
  249. $process_pctuser = $r_counter{'% User Time'};
  250. $process_pctpriv = $r_counter{'% Privileged Time'};
  251. $process_thrdcnt = $r_counter{'Thread Count'};
  252. $process_virtmem = $r_counter{'Virtual Bytes'};
  253. $disk_obj = $r_counter{PhysicalDisk};
  254. $disk_rdpersec = $r_counter{'Disk Reads/sec'};
  255. # create connection to $server
  256. $perflib = new Win32::PerfLib($server);
  257. $proc_ref = {};
  258. $phys_disk_ref = {};
  259. # get the performance data for the process object
  260. $perflib->GetObjectList($process_obj, $proc_ref);
  261. $perflib->GetObjectList($disk_obj, $phys_disk_ref);
  262. $processor_ref = {};
  263. $perflib->GetObjectList($r_counter{Processor}, $processor_ref);
  264. #
  265. $system_ref = {};
  266. $perflib->GetObjectList($r_counter{System}, $system_ref);
  267. #
  268. #$tcp_ref = {};
  269. #$perflib->GetObjectList($r_counter{TCP}, $tcp_ref);
  270. #
  271. $net_ref = {};
  272. $perflib->GetObjectList($r_counter{'Network Interface'}, $net_ref);
  273. #
  274. $memory_ref = {};
  275. $perflib->GetObjectList($r_counter{'Memory'}, $memory_ref);
  276. #
  277. $logical_disk_ref = {};
  278. $perflib->GetObjectList($r_counter{'LogicalDisk'}, $logical_disk_ref);
  279. #
  280. $frs_conn_ref = {};
  281. $perflib->GetObjectList($r_counter{'FileReplicaConn'}, $frs_conn_ref);
  282. #
  283. $frs_set_ref = {};
  284. $perflib->GetObjectList($r_counter{'FileReplicaSet'}, $frs_set_ref);
  285. #
  286. $perflib->Close();
  287. print "\n\n";
  288. printf("NumObjectTypes %d\n", $proc_ref->{NumObjectTypes});
  289. printf("SystemName %s\n", $proc_ref->{SystemName});
  290. printf("SystemTime %x\n", $proc_ref->{SystemTime});
  291. printf("PerfFreq %d\n", $proc_ref->{PerfFreq});
  292. printf("PerfTime %x\n", $proc_ref->{PerfTime});
  293. printf("PerfTime100nSec %x\n", $proc_ref->{PerfTime100nSec});
  294. print "\n\n";
  295. printf("NumObjectTypes %d\n", $phys_disk_ref->{NumObjectTypes});
  296. printf("SystemName %s\n", $phys_disk_ref->{SystemName});
  297. printf("SystemTime %x\n", $phys_disk_ref->{SystemTime});
  298. printf("PerfFreq %d\n", $phys_disk_ref->{PerfFreq});
  299. printf("PerfTime %x\n", $phys_disk_ref->{PerfTime});
  300. printf("PerfTime100nSec %x\n", $phys_disk_ref->{PerfTime100nSec});
  301. print "\n\n";
  302. $obj_ref = $phys_disk_ref->{Objects}->{$disk_obj};
  303. printf("DetailLevel %d\n", $obj_ref->{DetailLevel});
  304. printf("NumCounters %d\n", $obj_ref->{NumCounters});
  305. printf("NumInstances %d\n", $obj_ref->{NumInstances});
  306. printf("ObjectHelpTitleIndex %d\n", $obj_ref->{ObjectHelpTitleIndex});
  307. printf("ObjectNameTitleIndex %d\n", $obj_ref->{ObjectNameTitleIndex});
  308. printf("ObjectNameTitle %d\n", $counter{$obj_ref->{ObjectNameTitleIndex}});
  309. printf("PerfFreq %d\n", $obj_ref->{PerfFreq});
  310. printf("PerfTime %d\n", $obj_ref->{PerfTime});
  311. print "----------- \n\n";
  312. #
  313. # Select the replica set object perfmon keys with the desired data.
  314. #
  315. InitRSkeys();
  316. CollectReplicaSetObject($frs_set_ref);
  317. ## DumpPerfmonObject($frs_set_ref);
  318. InitConnkeys();
  319. CollectReplicaConnObject($frs_conn_ref);
  320. ## DumpPerfmonObject($frs_conn_ref);
  321. InitPhysDiskkeys();
  322. CollectPhysDiskObject($phys_disk_ref);
  323. ## DumpPerfmonObject($phys_disk_ref);
  324. @DumpInstances = ( 'ntfrs', 'lsass' );
  325. InitProcesskeys();
  326. CollectProcessObject($proc_ref);
  327. DumpPerfmonObject($proc_ref);
  328. undef @DumpInstances;
  329. DumpPerfmonObject($logical_disk_ref); # also seems to include physical disk
  330. DumpPerfmonObject($memory_ref);
  331. DumpPerfmonObject($net_ref);
  332. #
  333. ## DumpPerfmonObject($tcp_ref); Data seems same as 'Network Interface' ???
  334. #
  335. DumpPerfmonObject($system_ref);
  336. DumpPerfmonObject($processor_ref);
  337. $instance_ref = $phys_disk_ref->{Objects}->{$disk_obj}->{Instances};
  338. foreach $p (sort keys %{$instance_ref}) {
  339. $counter_ref = $instance_ref->{$p}->{Counters};
  340. foreach $i (sort keys %{$counter_ref}) {
  341. if ($counter_ref->{$i}->{CounterNameTitleIndex} == $disk_rdpersec) {
  342. $rdpersec = $counter_ref->{$i}->{Counter};
  343. }
  344. }
  345. printf("%-20s rd/sec %6d \n",
  346. $instance_ref->{$p}->{Name}, $rdpersec);
  347. }
  348. $instance_ref = $proc_ref->{Objects}->{$process_obj}->{Instances};
  349. foreach $p (sort keys %{$instance_ref}) {
  350. $counter_ref = $instance_ref->{$p}->{Counters};
  351. foreach $i (sort keys %{$counter_ref}) {
  352. if ($counter_ref->{$i}->{CounterNameTitleIndex} == $process_id) {
  353. $pid = $counter_ref->{$i}->{Counter};
  354. }
  355. if ($counter_ref->{$i}->{CounterNameTitleIndex} == $process_handles) {
  356. $handles = $counter_ref->{$i}->{Counter};
  357. }
  358. if ($counter_ref->{$i}->{CounterNameTitleIndex} == $process_thrdcnt) {
  359. $thrdcnt = $counter_ref->{$i}->{Counter};
  360. }
  361. if ($counter_ref->{$i}->{CounterNameTitleIndex} == $process_virtmem) {
  362. # type/size: 10100/8 for vm size
  363. #define PERF_SIZE_LARGE 0x00000100
  364. #define PERF_TYPE_NUMBER 0x00000000 // a number (not a counter)
  365. #define PERF_NUMBER_DECIMAL 0x00010000 // display as a decimal integer
  366. $vmsize = $counter_ref->{$i}->{Counter}/1024;
  367. $typeproc = $counter_ref->{$i}->{CounterType};
  368. $sizeproc = $counter_ref->{$i}->{CounterSize};
  369. }
  370. if ($counter_ref->{$i}->{CounterNameTitleIndex} == $process_pctproc) {
  371. # type/size: 20510500/8 for cpu pct counters. see \nt\public\sdk\inc\winperf.h
  372. #define PERF_SIZE_LARGE 0x00000100
  373. #define PERF_TYPE_COUNTER 0x00000400 // an increasing numeric value
  374. #define PERF_COUNTER_RATE 0x00010000 // divide ctr / delta time
  375. #define PERF_TIMER_100NS 0x00100000 // use 100 NS timer time base units
  376. #define PERF_DELTA_COUNTER 0x00400000 // compute difference first
  377. #define PERF_DISPLAY_PERCENT 0x20000000 // "%"
  378. $pctproc = $counter_ref->{$i}->{Counter};
  379. }
  380. if ($counter_ref->{$i}->{CounterNameTitleIndex} == $process_pctuser) {
  381. $pctuser = $counter_ref->{$i}->{Counter};
  382. }
  383. if ($counter_ref->{$i}->{CounterNameTitleIndex} == $process_pctpriv) {
  384. $pctpriv = $counter_ref->{$i}->{Counter};
  385. }
  386. }
  387. printf("%-20s pid %6d handles %6d type/size: %x/%d thrd: %d vm: %d proc/user/priv: %s/%s/%s\n",
  388. $instance_ref->{$p}->{Name}, $pid, $handles, $typeproc, $sizeproc, $thrdcnt, $vmsize, $pctproc, $pctuser, $pctpriv);
  389. }
  390. EVENT_LOG:
  391. # $argsort = "name";
  392. # &GetOptions("sort=s" => \$argsort);
  393. # $argsort = lc($argsort);
  394. # if (!($argsort =~ m/send|clean|name|lmt|lastjointime|lastvvjoin/)) {
  395. # print "Error: Invalid -sort param: $argsort using name\n";
  396. # $argsort = "name";
  397. # }
  398. #
  399. # Translate log type abbreviation if found otherwise use ARGV[0} as given.
  400. #
  401. $EventLogType = $elogname{$ARGV[0]};
  402. $EventLogType = ($EventLogType ne "") ? $EventLogType : $ARGV[0];
  403. $EventLogTypeOrFile = $EventLogType;
  404. #
  405. # -file overrides any ARGV[0].
  406. #
  407. if ($argelfile ne "") {
  408. $EventLogTypeOrFile = ($argelfile =~ m/\\/) ? $argelfile : ".\\$argelfile";
  409. }
  410. #
  411. # -after
  412. #
  413. ($mon, $day, $year) = lc($argafter) =~ m/(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)\s*(\d*).*(\d\d\d\d)/;
  414. die $USAGE unless ($mon && $day && $year);
  415. $mon = index("janfebmaraprmayjunjulaugsepoctnovdec", $mon) / 3;
  416. print "mon: $mon day: $day year: $year \n";
  417. $aftergmt = timegm(0, 0, 0, $day, $mon, $year-1900);
  418. print "aftergmt : ", scalar gmtime($aftergmt), scalar localtime($aftergmt), "\n";
  419. $lcltimezonediff = timegm(0, 0, 0, 1, 1, 99) - timelocal(0, 0, 0, 1, 1, 99);
  420. print "local tz: $lcltimezonediff \n";
  421. #
  422. if ($argtimezone eq 1000000) {$argtimezone = $lcltimezonediff};
  423. $afteradjustedtime = $aftergmt + $argtimezone;
  424. print "afteradjustedtime : ", scalar gmtime($afteradjustedtime), "\n";
  425. #
  426. # remove any leading backslashes.
  427. #
  428. $computer = ($argcomputer =~ m/\\*(.*)/);
  429. die $USAGE unless $computer;
  430. #
  431. # Open the event log on the target computer or the file.
  432. #
  433. $handle=Win32::EventLog->new($EventLogTypeOrFile, $argcomputer) or
  434. die "Can't open $EventLogType EventLog on computer $argcomputer\n";
  435. $handle->GetNumber($recs) or die "Can't get number of EventLog records\n";
  436. $handle->GetOldest($base) or die "Can't get number of oldest EventLog record\n";
  437. #
  438. # The parameters and return codes defined by the eventlog package.
  439. #
  440. # EVENTLOG_AUDIT_FAILURE EVENTLOG_PAIRED_EVENT_ACTIVE
  441. # EVENTLOG_AUDIT_SUCCESS EVENTLOG_PAIRED_EVENT_INACTIVE
  442. # EVENTLOG_BACKWARDS_READ EVENTLOG_SEEK_READ
  443. # EVENTLOG_END_ALL_PAIRED_EVENTS EVENTLOG_SEQUENTIAL_READ
  444. # EVENTLOG_END_PAIRED_EVENT EVENTLOG_START_PAIRED_EVENT
  445. # EVENTLOG_ERROR_TYPE EVENTLOG_SUCCESS
  446. # EVENTLOG_FORWARDS_READ EVENTLOG_WARNING_TYPE
  447. # EVENTLOG_INFORMATION_TYPE
  448. #
  449. # item EVENTLOG_ERROR_TYPE
  450. # item EVENTLOG_WARNING_TYPE
  451. # item EVENTLOG_INFORMATION_TYPE
  452. # item EVENTLOG_AUDIT_SUCCESS
  453. # item EVENTLOG_AUDIT_FAILURE
  454. #
  455. # ERROR_EVENTLOG_CANT_START
  456. # ERROR_EVENTLOG_FILE_CHANGED
  457. # ERROR_EVENTLOG_FILE_CORRUPT
  458. #
  459. $x = ($recs >= $argnumrec ) ? $recs - $argnumrec : $base;
  460. while ($x < $recs) {
  461. $handle->Read(EVENTLOG_FORWARDS_READ|EVENTLOG_SEEK_READ, $base+$x, $hashRef)
  462. or die "Can't read EventLog entry #$x\n";
  463. $x++;
  464. if ($first-- <= 0) {
  465. print "\f\n";
  466. print "EventLog : ", $EventLogType, "\n";
  467. print "LogFileName : ", $argelfile, "\n" if ($argelfile ne "");
  468. print "LocalTimeZoneOffset : ", $lcltimezonediff/60, " min\n";
  469. print "AppliedTimeZoneOffset : ", $argtimezone/60, " min\n";
  470. print "Computer : ", $hashRef->{Computer}, "\n\n";
  471. printf(" Record Time Source Category Sev EventID NumStr Strings\n\n");
  472. # 1938 Sat Nov 4 20:07:02 2000 NtFrs 0 Warning LONG_JOIN 3 NTDSDC9 | NTDEV-DC-03 | f:\w
  473. $first = 50;
  474. }
  475. #
  476. # Apply the time filter.
  477. #
  478. #printf "hr: %d\n", ($hashRef->{TimeGenerated}+$argtimezone);
  479. #printf "af: %d\n", $afteradjustedtime;
  480. #printf "df: %d\n", ($hashRef->{TimeGenerated}+$argtimezone) - $afteradjustedtime;
  481. next if (($hashRef->{TimeGenerated}+$argtimezone) <= $afteradjustedtime);
  482. # print "Data : ", $hashRef->{Data}, "\n";
  483. # $hashRef->{User} appears to be a SID. Don't know how to display it.
  484. # $hashRef->{Category} appears to be an index into a string resource in a dll specified in the registry.
  485. #
  486. # Count the number of null terminated insertion strings.
  487. # Replace the nulls with | and the CR and LF with dots.
  488. #
  489. $numstrings = ($hashRef->{Strings}=~tr/\0/\0/);
  490. $hashRef->{Strings}=~s/\0/ \| /gs;
  491. $hashRef->{Strings}=~tr/\x0D\x0A/../;
  492. $eventid = $hashRef->{EventID} & 0x0FFFFFFF;
  493. $eventsym = $eventid;
  494. if (lc($hashRef->{Source}) eq "ntfrs") {
  495. $eventsym = $FRS_EL_TABLE{$eventid};
  496. if ($eventsym eq "") {$eventsym = $eventid;}
  497. }
  498. printf("%8d %25s %-16s %5d %-7s %-26s %4d %s\n",
  499. $hashRef->{RecordNumber}, scalar (gmtime($hashRef->{TimeGenerated}+$argtimezone)),
  500. substr($hashRef->{Source}, 0, 16),
  501. $hashRef->{Category}, $EventSev[$hashRef->{EventID} >> 30],
  502. $eventsym,
  503. $numstrings , $hashRef->{Strings});
  504. #
  505. # The below can be used to the message text and print it. It only
  506. # appears to work if you are running on the local computer and reading
  507. # the on-line event log.
  508. #
  509. #Win32::EventLog::GetMessageText($hashRef);
  510. #print "$hashRef->{Message}\n";
  511. #print Text::Wrap::wrap($initial_tab, $subsequent_tab, $hashRef->{Message}), "\n";
  512. #print Text::Wrap::fill($initial_tab, $subsequent_tab, $hashRef->{Message}), "\n\n";
  513. }
  514. sub ProcessKey
  515. {
  516. my ($key, $indent);
  517. my ($subkeyname, $subkey, @keylist);
  518. my ($value, %valuelist);
  519. my ($Ctype);
  520. $key = $_[0];
  521. $indent = $_[1];
  522. $key->GetValues( \%valuelist );
  523. foreach $value (sort( keys(%valuelist))) {
  524. $regtype = $REG_DT_NAME[$valuelist{$value}[1]];
  525. printf("%s%s = %s ", " "x$indent, $value, $regtype);
  526. if ($regtype eq "REG_BINARY") {
  527. printf("\n");
  528. } else {
  529. printf("%s\n", $valuelist{$value}[2]);
  530. }
  531. }
  532. $key->GetKeys(\@keylist);
  533. foreach $subkeyname (sort(@keylist)) {
  534. if ($key->Open ($subkeyname, $subkey)) {
  535. print " " x $indent, $subkeyname, "\n";
  536. ProcessKey($subkey, $indent+4);
  537. $subkey->Close();
  538. }
  539. }
  540. }
  541. sub DumpPerfmonObject
  542. {
  543. my ($arg_ref, $p_ref, $q_ref, $r_ref);
  544. my ($p, $px, $q, $qx, $r, $rx);
  545. my ($i, $display);
  546. $arg_ref = $_[0];
  547. $p_ref = $arg_ref->{Objects};
  548. foreach $p (sort keys %{$p_ref} ) {
  549. $px = $arg_ref->{Objects}->{$p};
  550. printf("DetailLevel %d\n", $px->{DetailLevel});
  551. printf("NumCounters %d\n", $px->{NumCounters});
  552. printf("NumInstances %d\n", $px->{NumInstances});
  553. printf("PerfFreq %d\n", $px->{PerfFreq});
  554. printf("PerfTime %d\n", $px->{PerfTime});
  555. printf("ObjectHelpTitleIndex %d\n", $px->{ObjectHelpTitleIndex});
  556. printf("ObjectNameTitleIndex %d\n", $px->{ObjectNameTitleIndex});
  557. printf("ObjectNameTitle %s\n", $counter{$px->{ObjectNameTitleIndex}});
  558. print "\n";
  559. $q_ref = $arg_ref->{Objects}->{$p}->{Counters};
  560. foreach $q (sort keys %{$q_ref} ) {
  561. $qx = $arg_ref->{Objects}->{$p}->{Counters}->{$q};
  562. $Ctype = $qx->{CounterType};
  563. printf(" %-12d %-6s %2d %-13s %s\n",
  564. $qx->{Counter}, $qx->{Display}, $qx->{CounterSize},
  565. $PERFMON_TYPE_TABLE{Win32::PerfLib::GetCounterType($Ctype)},
  566. $counter{$qx->{CounterNameTitleIndex}});
  567. #printf(" Display %s\n", $qx->{Display});
  568. #printf(" Counter %d\n", $qx->{Counter});
  569. #printf(" CounterSize %d\n", $qx->{CounterSize});
  570. #printf(" CounterType %x\n", $qx->{CounterType});
  571. #printf(" CounterTypeStr %s\n", Win32::PerfLib::GetCounterType($qx->{CounterType}));
  572. #printf(" DefaultScale %d\n", $qx->{DefaultScale});
  573. #printf(" DetailLevel %d\n", $qx->{DetailLevel});
  574. #printf(" CounterHelpTitleIndex %d\n", $qx->{CounterHelpTitleIndex});
  575. #printf(" CounterNameTitleIndex %d\n", $qx->{CounterNameTitleIndex});
  576. #printf(" CounterNameTitle %s\n", $counter{$qx->{CounterNameTitleIndex}});
  577. #print "\n";
  578. }
  579. print "\n";
  580. $q_ref = $arg_ref->{Objects}->{$p}->{Instances};
  581. foreach $q (sort keys %{$q_ref} ) {
  582. $qx = $arg_ref->{Objects}->{$p}->{Instances}->{$q};
  583. $display = !defined @DumpInstances;
  584. foreach $i (0 .. $#{ @DumpInstances }) {
  585. if ( index(lc($qx->{Name}), lc($DumpInstances[$i])) == 0 ) {
  586. $display = 1;
  587. last;
  588. }
  589. }
  590. if ($display) {
  591. print "\n";
  592. printf(" Name %s\n", $qx->{Name});
  593. printf(" ParentObjectInstance %d\n", $qx->{ParentObjectInstance});
  594. printf(" ParentObjectTitleIndex %d\n", $qx->{ParentObjectTitleIndex});
  595. printf(" ParentObjectTitle %s\n", $counter{$qx->{ParentObjectTitleIndex}});
  596. print "\n";
  597. $r_ref = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters};
  598. foreach $r (sort keys %{$r_ref} ) {
  599. $rx = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters}->{$r};
  600. $Ctype = $rx->{CounterType};
  601. printf(" %-12d %-6s %2d %-13s %s\n",
  602. $rx->{Counter}, $rx->{Display}, $rx->{CounterSize},
  603. $PERFMON_TYPE_TABLE{Win32::PerfLib::GetCounterType($Ctype)},
  604. $counter{$rx->{CounterNameTitleIndex}});
  605. #printf(" Display %s\n", $rx->{Display});
  606. #printf(" Counter %d\n", $rx->{Counter});
  607. #printf(" CounterSize %d\n", $rx->{CounterSize});
  608. #printf(" CounterType %x\n", $rx->{CounterType});
  609. #printf(" CounterTypeStr %s\n", substr(Win32::PerfLib::GetCounterType($rx->{CounterType}),13));
  610. #printf(" DefaultScale %d\n", $rx->{DefaultScale});
  611. #printf(" DetailLevel %d\n", $rx->{DetailLevel});
  612. #printf(" CounterHelpTitleIndex %d\n", $rx->{CounterHelpTitleIndex});
  613. #printf(" CounterNameTitleIndex %d\n", $rx->{CounterNameTitleIndex});
  614. #printf(" CounterNameTitle %s\n", $counter{$rx->{CounterNameTitleIndex}});
  615. #print "\n";
  616. }
  617. }
  618. }
  619. }
  620. print "-------------------------- \n";
  621. print "-------------------------- \n";
  622. print "-------------------------- \n";
  623. print "-------------------------- \n";
  624. print "-------------------------- \n";
  625. print "-------------------------- \n\n";
  626. }
  627. sub CollectProcessObject
  628. {
  629. my ($arg_ref, $p_ref, $q_ref, $r_ref);
  630. my ($p, $px, $q, $qx, $r, $rx);
  631. my ($NumInstances, $i);
  632. my ($display);
  633. my ($Ctype, $Ctypename, $Cname);
  634. $arg_ref = $_[0];
  635. $p_ref = $arg_ref->{Objects};
  636. foreach $p (sort keys %{$p_ref} ) {
  637. $px = $arg_ref->{Objects}->{$p};
  638. printf("DetailLevel %d\n", $px->{DetailLevel});
  639. printf("NumCounters %d\n", $px->{NumCounters});
  640. printf("NumInstances %d\n", $px->{NumInstances});
  641. printf("PerfFreq %d\n", $px->{PerfFreq});
  642. printf("PerfTime %d\n", $px->{PerfTime});
  643. printf("ObjectHelpTitleIndex %d\n", $px->{ObjectHelpTitleIndex});
  644. printf("ObjectNameTitleIndex %d\n", $px->{ObjectNameTitleIndex});
  645. printf("ObjectNameTitle %s\n", $counter{$px->{ObjectNameTitleIndex}});
  646. print "\n";
  647. $NumInstances = $px->{NumInstances};
  648. $q_ref = $arg_ref->{Objects}->{$p}->{Instances};
  649. foreach $q (sort keys %{$q_ref} ) {
  650. $qx = $arg_ref->{Objects}->{$p}->{Instances}->{$q};
  651. $display = !defined @DumpInstances;
  652. foreach $i (0 .. $#{ @DumpInstances }) {
  653. if ( index(lc($qx->{Name}), lc($DumpInstances[$i])) == 0 ) {
  654. $display = 1;
  655. last;
  656. }
  657. }
  658. if ($display) {
  659. #
  660. # Save the instance name.
  661. # ntfrs_780
  662. #
  663. push @processinstance, $qx->{Name};
  664. #print "\n";
  665. #printf(" Name %s\n", $qx->{Name});
  666. #printf(" ParentObjectInstance %d\n", $qx->{ParentObjectInstance});
  667. #printf(" ParentObjectTitleIndex %d\n", $qx->{ParentObjectTitleIndex});
  668. #printf(" ParentObjectTitle %s\n", $counter{$qx->{ParentObjectTitleIndex}});
  669. #print "\n";
  670. #
  671. # Get the counters for each instance.
  672. #
  673. $r_ref = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters};
  674. foreach $r (sort keys %{$r_ref} ) {
  675. $rx = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters}->{$r};
  676. $Ctype = $rx->{CounterType};
  677. $Ctypename = $PERFMON_TYPE_TABLE{Win32::PerfLib::GetCounterType($Ctype)};
  678. $Cname = $counter{$rx->{CounterNameTitleIndex}};
  679. if (exists($processcountertable{$Cname})) {
  680. if (!exists($processvaluetable{$Cname})) {
  681. $processvaluetable{$Cname} = [ $rx->{Counter} ];
  682. $processsizetable{$Cname} = $rx->{CounterSize};
  683. $processdisplaytable{$Cname} = $rx->{Display};
  684. $processtypetable{$Cname} = $rx->{CounterType};
  685. $processtypenametable{$Cname} = $Ctypename;
  686. } else {
  687. push @{ $processvaluetable{$Cname} }, $rx->{Counter};
  688. }
  689. }
  690. #printf(" %-12d %-6s %2d %-13s %s\n",
  691. # $rx->{Counter}, $rx->{Display}, $rx->{CounterSize},
  692. # $Ctypename, $Cname);
  693. }
  694. }
  695. }
  696. }
  697. #
  698. # print header.
  699. #
  700. print " ";
  701. foreach $i (0 .. $#{ @processinstance }) {
  702. printf("%-20s", $processinstance[$i]);
  703. }
  704. print "\n\n";
  705. #
  706. # Print in order of hash value.
  707. #
  708. foreach $r (sort { $processcountertable{$a} <=> $processcountertable{$b} }
  709. keys %processcountertable) {
  710. printf("%-40s %8s %2d %08x %-15s", $r,
  711. $processdisplaytable{$r}, $processsizetable{$r}, $processtypetable{$r}, $processtypenametable{$r});
  712. foreach $i (0 .. $#{ $processvaluetable{$r} }) {
  713. printf("%-12d", $processvaluetable{$r}[$i]);
  714. }
  715. print "\n";
  716. }
  717. print "\n\n\n";
  718. }
  719. sub InitProcesskeys
  720. {
  721. my $i = 1;
  722. $processcountertable{'% Processor Time'} = $i++;
  723. $processcountertable{'% User Time'} = $i++;
  724. $processcountertable{'Private Bytes'} = $i++;
  725. $processcountertable{'Thread Count'} = $i++;
  726. $processcountertable{'Priority Base'} = $i++;
  727. $processcountertable{'Elapsed Time'} = $i++;
  728. $processcountertable{'ID Process'} = $i++;
  729. $processcountertable{'Creating Process ID'} = $i++;
  730. $processcountertable{'Pool Paged Bytes'} = $i++;
  731. $processcountertable{'Pool Nonpaged Bytes'} = $i++;
  732. $processcountertable{'Handle Count'} = $i++;
  733. $processcountertable{'IO Read Operations/sec'} = $i++;
  734. $processcountertable{'% Privileged Time'} = $i++;
  735. $processcountertable{'IO Write Operations/sec'} = $i++;
  736. $processcountertable{'IO Data Operations/sec'} = $i++;
  737. $processcountertable{'IO Other Operations/sec'} = $i++;
  738. $processcountertable{'IO Read Bytes/sec'} = $i++;
  739. $processcountertable{'IO Write Bytes/sec'} = $i++;
  740. $processcountertable{'IO Data Bytes/sec'} = $i++;
  741. $processcountertable{'IO Other Bytes/sec'} = $i++;
  742. $processcountertable{'Virtual Bytes Peak'} = $i++;
  743. $processcountertable{'Virtual Bytes'} = $i++;
  744. $processcountertable{'Page Faults/sec'} = $i++;
  745. $processcountertable{'Working Set Peak'} = $i++;
  746. $processcountertable{'Working Set'} = $i++;
  747. $processcountertable{'Page File Bytes Peak'} = $i++;
  748. $processcountertable{'Page File Bytes'} = $i++;
  749. }
  750. sub CollectPhysDiskObject
  751. {
  752. my ($arg_ref, $p_ref, $q_ref, $r_ref);
  753. my ($p, $px, $q, $qx, $r, $rx);
  754. my ($NumInstances, $i);
  755. my ($Ctype, $Ctypename, $Cname);
  756. my (@ratio, $npairs, $denom, $scale);
  757. $arg_ref = $_[0];
  758. $p_ref = $arg_ref->{Objects};
  759. foreach $p (sort keys %{$p_ref} ) {
  760. $px = $arg_ref->{Objects}->{$p};
  761. printf("DetailLevel %d\n", $px->{DetailLevel});
  762. printf("NumCounters %d\n", $px->{NumCounters});
  763. printf("NumInstances %d\n", $px->{NumInstances});
  764. printf("PerfFreq %d\n", $px->{PerfFreq});
  765. printf("PerfTime %d\n", $px->{PerfTime});
  766. printf("ObjectHelpTitleIndex %d\n", $px->{ObjectHelpTitleIndex});
  767. printf("ObjectNameTitleIndex %d\n", $px->{ObjectNameTitleIndex});
  768. printf("ObjectNameTitle %s\n", $counter{$px->{ObjectNameTitleIndex}});
  769. print "\n";
  770. #
  771. # No counters at this level for Replica Set Object.
  772. #
  773. # $q_ref = $arg_ref->{Objects}->{$p}->{Counters};
  774. # foreach $q (sort keys %{$q_ref} ) {
  775. #
  776. # $qx = $arg_ref->{Objects}->{$p}->{Counters}->{$q};
  777. #
  778. # printf(" %-12d %-6s %2d %-20s %s\n",
  779. # $qx->{Counter}, $qx->{Display}, $qx->{CounterSize},
  780. # substr(Win32::PerfLib::GetCounterType($qx->{CounterType}),13),
  781. # $counter{$qx->{CounterNameTitleIndex}});
  782. #
  783. # }
  784. #
  785. # print "\n";
  786. $NumInstances = $px->{NumInstances};
  787. $q_ref = $arg_ref->{Objects}->{$p}->{Instances};
  788. foreach $q (sort keys %{$q_ref} ) {
  789. $qx = $arg_ref->{Objects}->{$p}->{Instances}->{$q};
  790. #
  791. # Save the instance name.
  792. # 0 C: D:
  793. #
  794. push @physdiskinstance, $qx->{Name};
  795. #print "\n";
  796. #printf(" Name %s\n", $qx->{Name});
  797. #printf(" ParentObjectInstance %d\n", $qx->{ParentObjectInstance});
  798. #printf(" ParentObjectTitleIndex %d\n", $qx->{ParentObjectTitleIndex});
  799. #printf(" ParentObjectTitle %s\n", $counter{$qx->{ParentObjectTitleIndex}});
  800. #print "\n";
  801. #
  802. # Get the counters for each instance.
  803. #
  804. $r_ref = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters};
  805. foreach $r (sort keys %{$r_ref} ) {
  806. $rx = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters}->{$r};
  807. $Ctype = $rx->{CounterType};
  808. $Ctypename = $PERFMON_TYPE_TABLE{Win32::PerfLib::GetCounterType($Ctype)};
  809. $Cname = $counter{$rx->{CounterNameTitleIndex}};
  810. if (exists($physdiskcountertable{$Cname})) {
  811. if (!exists($physdiskvaluetable{$Cname})) {
  812. $physdiskvaluetable{$Cname} = [ $rx->{Counter} ];
  813. $physdisksizetable{$Cname} = $rx->{CounterSize};
  814. $physdiskdisplaytable{$Cname} = $rx->{Display};
  815. $physdisktypetable{$Cname} = $rx->{CounterType};
  816. $physdisktypenametable{$Cname} = $Ctypename;
  817. } else {
  818. push @{ $physdiskvaluetable{$Cname} }, $rx->{Counter};
  819. }
  820. }
  821. #printf(" %-12d %-6s %2d %-13s %s\n",
  822. # $rx->{Counter}, $rx->{Display}, $rx->{CounterSize},
  823. # $Ctypename, $Cname);
  824. }
  825. }
  826. }
  827. #
  828. # print header.
  829. #
  830. print " ";
  831. foreach $i (0 .. $#{ @physdiskinstance }) {
  832. printf("%-20s", $physdiskinstance[$i]);
  833. }
  834. print "\n\n";
  835. #
  836. # Print in order of hash value.
  837. #
  838. foreach $r (sort { $physdiskcountertable{$a} <=> $physdiskcountertable{$b} }
  839. keys %physdiskcountertable) {
  840. if (exists($physdiskratiotable{$r})) {
  841. $scale = ($physdiskdisplaytable{$r} eq '%') ? 100.0 : 1.0;
  842. $npairs = ($#{ $physdiskvaluetable{$r} }+1) / 2;
  843. undef @ratio;
  844. while ($npairs > 0) {
  845. $denom = $physdiskvaluetable{$r}[1];
  846. if ($denom != 0) {
  847. push @ratio, sprintf("%.2f", $scale * $physdiskvaluetable{$r}[0] / $denom) ;
  848. } else {
  849. push @ratio, 0;
  850. }
  851. $npairs--;
  852. splice @{$physdiskvaluetable{$r}}, 0, 2;
  853. }
  854. @ {$physdiskvaluetable{$r}} = @ratio;
  855. }
  856. printf("%-40s %8s %2d %08x %-15s", $r,
  857. $physdiskdisplaytable{$r}, $physdisksizetable{$r}, $physdisktypetable{$r}, $physdisktypenametable{$r});
  858. foreach $i (0 .. $#{ $physdiskvaluetable{$r} }) {
  859. printf("%-12s", $physdiskvaluetable{$r}[$i]);
  860. }
  861. print "\n";
  862. }
  863. print "\n\n\n";
  864. }
  865. sub InitPhysDiskkeys
  866. {
  867. my $i = 1;
  868. $physdiskcountertable{'Current Disk Queue Length'} = $i++;
  869. $physdiskcountertable{'% Disk Time'} = $i++;
  870. $physdiskcountertable{'Avg. Disk sec/Transfer'} = $i++; #AVG_TIMER / AVG_BASE
  871. $physdiskcountertable{'Avg. Disk sec/Read'} = $i++; #AVG_TIMER / AVG_BASE
  872. $physdiskcountertable{'Avg. Disk sec/Write'} = $i++; #AVG_TIMER / AVG_BASE
  873. $physdiskcountertable{'Disk Transfers/sec'} = $i++;
  874. $physdiskcountertable{'Disk Reads/sec'} = $i++;
  875. $physdiskcountertable{'Disk Writes/sec'} = $i++;
  876. $physdiskcountertable{'Disk Bytes/sec'} = $i++;
  877. $physdiskcountertable{'% Disk Time'} = $i++;
  878. $physdiskcountertable{'Disk Read Bytes/sec'} = $i++;
  879. $physdiskcountertable{'Disk Write Bytes/sec'} = $i++;
  880. $physdiskcountertable{'Avg. Disk Bytes/Transfer'} = $i++; #AVG_BULK / AVG_BASE
  881. $physdiskcountertable{'Avg. Disk Bytes/Read'} = $i++; #AVG_BULK / AVG_BASE
  882. $physdiskcountertable{'Avg. Disk Bytes/Write'} = $i++; #AVG_BULK / AVG_BASE
  883. $physdiskcountertable{'% Idle Time'} = $i++;
  884. $physdiskcountertable{'Avg. Disk Queue Length'} = $i++;
  885. $physdiskcountertable{'Split IO/Sec'} = $i++;
  886. $physdiskcountertable{'% Disk Read Time'} = $i++;
  887. $physdiskcountertable{'Avg. Disk Read Queue Length'} = $i++;
  888. $physdiskcountertable{'% Disk Write Time'} = $i++;
  889. $physdiskcountertable{'Avg. Disk Write Queue Length'} = $i++;
  890. $physdiskratiotable{'Avg. Disk sec/Transfer'} = 1;
  891. $physdiskratiotable{'Avg. Disk sec/Read'} = 1;
  892. $physdiskratiotable{'Avg. Disk sec/Write'} = 1;
  893. $physdiskratiotable{'Avg. Disk Bytes/Transfer'} = 1;
  894. $physdiskratiotable{'Avg. Disk Bytes/Read'} = 1;
  895. $physdiskratiotable{'Avg. Disk Bytes/Write'} = 1;
  896. $physdiskratiotable{'% Disk Time'} = 1;
  897. $physdiskratiotable{'% Idle Time'} = 1;
  898. $physdiskratiotable{'% Disk Read Time'} = 1;
  899. $physdiskratiotable{'% Disk Write Time'} = 1;
  900. }
  901. sub CollectReplicaConnObject
  902. {
  903. my ($arg_ref, $p_ref, $q_ref, $r_ref);
  904. my ($p, $px, $q, $qx, $r, $rx);
  905. my ($NumInstances, $i);
  906. my ($Ctype, $Ctypename, $Cname);
  907. my ($rootpath, $inout, $server, $domain);
  908. $arg_ref = $_[0];
  909. $p_ref = $arg_ref->{Objects};
  910. foreach $p (sort keys %{$p_ref} ) {
  911. $px = $arg_ref->{Objects}->{$p};
  912. printf("DetailLevel %d\n", $px->{DetailLevel});
  913. printf("NumCounters %d\n", $px->{NumCounters});
  914. printf("NumInstances %d\n", $px->{NumInstances});
  915. printf("PerfFreq %d\n", $px->{PerfFreq});
  916. printf("PerfTime %d\n", $px->{PerfTime});
  917. printf("ObjectHelpTitleIndex %d\n", $px->{ObjectHelpTitleIndex});
  918. printf("ObjectNameTitleIndex %d\n", $px->{ObjectNameTitleIndex});
  919. printf("ObjectNameTitle %s\n", $counter{$px->{ObjectNameTitleIndex}});
  920. print "\n";
  921. #
  922. # No counters at this level for Replica Set Object.
  923. #
  924. # $q_ref = $arg_ref->{Objects}->{$p}->{Counters};
  925. # foreach $q (sort keys %{$q_ref} ) {
  926. #
  927. # $qx = $arg_ref->{Objects}->{$p}->{Counters}->{$q};
  928. #
  929. # printf(" %-12d %-6s %2d %-20s %s\n",
  930. # $qx->{Counter}, $qx->{Display}, $qx->{CounterSize},
  931. # substr(Win32::PerfLib::GetCounterType($qx->{CounterType}),13),
  932. # $counter{$qx->{CounterNameTitleIndex}});
  933. #
  934. # }
  935. #
  936. # print "\n";
  937. $NumInstances = $px->{NumInstances};
  938. $q_ref = $arg_ref->{Objects}->{$p}->{Instances};
  939. foreach $q (sort keys %{$q_ref} ) {
  940. $qx = $arg_ref->{Objects}->{$p}->{Instances}->{$q};
  941. #
  942. # Save the instance name.
  943. # d:\replica1::FROM:FRS0614\SUDARCTEST2$
  944. #
  945. push @conninstance, $qx->{Name};
  946. ($rootpath, $inout, $domain, $server) = $qx->{Name} =~ m/(.*)::(FROM|TO):(.*)\\(.*)/;
  947. push @connroot, $rootpath;
  948. push @conninout, $inout;
  949. push @connserver, $server;
  950. push @conndomain, $domain;
  951. #print "\n";
  952. #printf(" Name %s\n", $qx->{Name});
  953. #printf(" ParentObjectInstance %d\n", $qx->{ParentObjectInstance});
  954. #printf(" ParentObjectTitleIndex %d\n", $qx->{ParentObjectTitleIndex});
  955. #printf(" ParentObjectTitle %s\n", $counter{$qx->{ParentObjectTitleIndex}});
  956. #print "\n";
  957. #
  958. # Get the counters for each instance.
  959. #
  960. $r_ref = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters};
  961. foreach $r (sort keys %{$r_ref} ) {
  962. $rx = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters}->{$r};
  963. $Ctype = $rx->{CounterType};
  964. $Ctypename = $PERFMON_TYPE_TABLE{Win32::PerfLib::GetCounterType($Ctype)};
  965. $Cname = $counter{$rx->{CounterNameTitleIndex}};
  966. if (exists($conncountertable{$Cname})) {
  967. if (!exists($connvaluetable{$Cname})) {
  968. $connvaluetable{$Cname} = [ $rx->{Counter} ];
  969. $connsizetable{$Cname} = $rx->{CounterSize};
  970. $conndisplaytable{$Cname} = $rx->{Display};
  971. $conntypetable{$Cname} = $rx->{CounterType};
  972. $conntypenametable{$Cname} = $Ctypename;
  973. } else {
  974. push @{ $connvaluetable{$Cname} }, $rx->{Counter};
  975. }
  976. }
  977. #printf(" %-12d %-6s %2d %-13s %s\n",
  978. # $rx->{Counter}, $rx->{Display}, $rx->{CounterSize},
  979. # $Ctypename, $Cname);
  980. }
  981. }
  982. }
  983. #
  984. # print header.
  985. #
  986. print "Domain ";
  987. foreach $i (0 .. $#{ @conndomain }) {
  988. printf("%-20s", $conndomain[$i]);
  989. }
  990. print "\n";
  991. print "Server ";
  992. foreach $i (0 .. $#{ @connserver }) {
  993. printf("%-20s", $connserver[$i]);
  994. }
  995. print "\n";
  996. print "Root ";
  997. foreach $i (0 .. $#{ @connroot }) {
  998. printf("%-20s", $connroot[$i]);
  999. }
  1000. print "\n";
  1001. print "In/out ";
  1002. foreach $i (0 .. $#{ @conninout }) {
  1003. printf("%-20s", $conninout[$i] eq 'FROM' ? 'In' : 'Out');
  1004. }
  1005. print "\n\n";
  1006. #
  1007. # Print in order of hash value.
  1008. #
  1009. foreach $r (sort { $conncountertable{$a} <=> $conncountertable{$b} }
  1010. keys %conncountertable) {
  1011. printf("%-40s %8s %2d %08x %-15s", $r,
  1012. $conndisplaytable{$r}, $connsizetable{$r}, $conntypetable{$r}, $conntypenametable{$r});
  1013. foreach $i (0 .. $#{ $connvaluetable{$r} }) {
  1014. printf("%-12d", $connvaluetable{$r}[$i]);
  1015. }
  1016. print "\n";
  1017. }
  1018. print "\n\n\n";
  1019. }
  1020. sub InitConnkeys
  1021. {
  1022. my $i = 1;
  1023. $conncountertable{'Packets Sent in Bytes'} = $i++;
  1024. $conncountertable{'Fetch Blocks Sent in Bytes'} = $i++;
  1025. $conncountertable{'Packets Sent in Error'} = $i++;
  1026. $conncountertable{'Communication Timeouts'} = $i++;
  1027. $conncountertable{'Fetch Requests Sent'} = $i++;
  1028. $conncountertable{'Fetch Requests Received'} = $i++;
  1029. $conncountertable{'Fetch Blocks Sent'} = $i++;
  1030. $conncountertable{'Fetch Blocks Received'} = $i++;
  1031. $conncountertable{'Join Notifications Sent'} = $i++;
  1032. $conncountertable{'Join Notifications Received'} = $i++;
  1033. $conncountertable{'Joins'} = $i++;
  1034. $conncountertable{'Unjoins'} = $i++;
  1035. $conncountertable{'Fetch Blocks Received in Bytes'} = $i++;
  1036. $conncountertable{'Bindings'} = $i++;
  1037. $conncountertable{'Bindings in Error'} = $i++;
  1038. $conncountertable{'Authentications'} = $i++;
  1039. $conncountertable{'Authentications in Error'} = $i++;
  1040. $conncountertable{'Local Change Orders Sent'} = $i++;
  1041. $conncountertable{'Local Change Orders Sent At Join'} = $i++;
  1042. $conncountertable{'Remote Change Orders Sent'} = $i++;
  1043. $conncountertable{'Remote Change Orders Received'} = $i++;
  1044. $conncountertable{'Inbound Change Orders Dampened'} = $i++;
  1045. $conncountertable{'Outbound Change Orders Dampened'} = $i++;
  1046. $conncountertable{'Packets Sent'} = $i++;
  1047. }
  1048. sub CollectReplicaSetObject
  1049. {
  1050. my ($arg_ref, $p_ref, $q_ref, $r_ref);
  1051. my ($p, $px, $q, $qx, $r, $rx);
  1052. my ($NumInstances, $i);
  1053. $arg_ref = $_[0];
  1054. $p_ref = $arg_ref->{Objects};
  1055. foreach $p (sort keys %{$p_ref} ) {
  1056. $px = $arg_ref->{Objects}->{$p};
  1057. printf("DetailLevel %d\n", $px->{DetailLevel});
  1058. printf("NumCounters %d\n", $px->{NumCounters});
  1059. printf("NumInstances %d\n", $px->{NumInstances});
  1060. printf("PerfFreq %d\n", $px->{PerfFreq});
  1061. printf("PerfTime %d\n", $px->{PerfTime});
  1062. printf("ObjectHelpTitleIndex %d\n", $px->{ObjectHelpTitleIndex});
  1063. printf("ObjectNameTitleIndex %d\n", $px->{ObjectNameTitleIndex});
  1064. printf("ObjectNameTitle %s\n", $counter{$px->{ObjectNameTitleIndex}});
  1065. print "\n";
  1066. #
  1067. # No counters at this level for Replica Set Object.
  1068. #
  1069. # $q_ref = $arg_ref->{Objects}->{$p}->{Counters};
  1070. # foreach $q (sort keys %{$q_ref} ) {
  1071. #
  1072. # $qx = $arg_ref->{Objects}->{$p}->{Counters}->{$q};
  1073. #
  1074. # printf(" %-12d %-6s %2d %-20s %s\n",
  1075. # $qx->{Counter}, $qx->{Display}, $qx->{CounterSize},
  1076. # substr(Win32::PerfLib::GetCounterType($qx->{CounterType}),13),
  1077. # $counter{$qx->{CounterNameTitleIndex}});
  1078. #
  1079. # }
  1080. #
  1081. # print "\n";
  1082. $NumInstances = $px->{NumInstances};
  1083. $q_ref = $arg_ref->{Objects}->{$p}->{Instances};
  1084. foreach $q (sort keys %{$q_ref} ) {
  1085. $qx = $arg_ref->{Objects}->{$p}->{Instances}->{$q};
  1086. #
  1087. # Save the instance name.
  1088. #
  1089. push @rsinstance, $qx->{Name};
  1090. #print "\n";
  1091. #printf(" Name %s\n", $qx->{Name});
  1092. #printf(" ParentObjectInstance %d\n", $qx->{ParentObjectInstance});
  1093. #printf(" ParentObjectTitleIndex %d\n", $qx->{ParentObjectTitleIndex});
  1094. #printf(" ParentObjectTitle %s\n", $counter{$qx->{ParentObjectTitleIndex}});
  1095. #print "\n";
  1096. #
  1097. # Get the counters for each instance.
  1098. #
  1099. $r_ref = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters};
  1100. foreach $r (sort keys %{$r_ref} ) {
  1101. $rx = $arg_ref->{Objects}->{$p}->{Instances}->{$q}->{Counters}->{$r};
  1102. $Ctype = $rx->{CounterType};
  1103. $Ctypename = $PERFMON_TYPE_TABLE{Win32::PerfLib::GetCounterType($Ctype)};
  1104. $Cname = $counter{$rx->{CounterNameTitleIndex}};
  1105. if (exists($rscountertable{$Cname})) {
  1106. if (!exists($rsvaluetable{$Cname})) {
  1107. $rsvaluetable{$Cname} = [ $rx->{Counter} ];
  1108. $rssizetable{$Cname} = $rx->{CounterSize};
  1109. $rsdisplaytable{$Cname} = $rx->{Display};
  1110. $rstypetable{$Cname} = $rx->{CounterType};
  1111. $rstypenametable{$Cname} = $Ctypename;
  1112. } else {
  1113. push @{ $rsvaluetable{$Cname} }, $rx->{Counter};
  1114. }
  1115. }
  1116. #printf(" %-12d %-6s %2d %-13s %s\n",
  1117. # $rx->{Counter}, $rx->{Display}, $rx->{CounterSize},
  1118. # $Ctypename, $Cname);
  1119. }
  1120. }
  1121. }
  1122. #
  1123. # print header.
  1124. #
  1125. print " ";
  1126. foreach $i (0 .. $#{ @rsinstance }) {
  1127. printf("%-25s", $rsinstance[$i]);
  1128. }
  1129. print "\n\n";
  1130. #
  1131. # Print in order of hash value.
  1132. #
  1133. foreach $r (sort { $rscountertable{$a} <=> $rscountertable{$b} }
  1134. keys %rscountertable) {
  1135. printf("%-40s %8s %2d %08x %-15s", $r,
  1136. $rsdisplaytable{$r}, $rssizetable{$r}, $rstypetable{$r}, $rstypenametable{$r});
  1137. foreach $i (0 .. $#{ $rsvaluetable{$r} }) {
  1138. printf("%-12d", $rsvaluetable{$r}[$i]);
  1139. }
  1140. print "\n";
  1141. }
  1142. print "\n\n\n";
  1143. }
  1144. sub InitRSkeys
  1145. {
  1146. my $i = 1;
  1147. $rscountertable{'Bytes of Staging Generated'} = $i++;
  1148. $rscountertable{'Bytes of Staging Fetched'} = $i++;
  1149. $rscountertable{'Staging Files Generated'} = $i++;
  1150. $rscountertable{'Staging Files Generated with Error'} = $i++;
  1151. $rscountertable{'Staging Files Fetched'} = $i++;
  1152. $rscountertable{'Staging Files Regenerated'} = $i++;
  1153. $rscountertable{'Files Installed'} = $i++;
  1154. $rscountertable{'Files Installed with Error'} = $i++;
  1155. $rscountertable{'Change Orders Issued'} = $i++;
  1156. $rscountertable{'Change Orders Retired'} = $i++;
  1157. $rscountertable{'Change Orders Aborted'} = $i++;
  1158. $rscountertable{'Change Orders Retried'} = $i++;
  1159. $rscountertable{'Bytes of Staging Regenerated'} = $i++;
  1160. $rscountertable{'Change Orders Retried at Generate'} = $i++;
  1161. $rscountertable{'Change Orders Retried at Fetch'} = $i++;
  1162. $rscountertable{'Change Orders Retried at Install'} = $i++;
  1163. $rscountertable{'Change Orders Retried at Rename'} = $i++;
  1164. $rscountertable{'Change Orders Morphed'} = $i++;
  1165. $rscountertable{'Change Orders Propagated'} = $i++;
  1166. $rscountertable{'Change Orders Received'} = $i++;
  1167. $rscountertable{'Change Orders Sent'} = $i++;
  1168. $rscountertable{'Change Orders Evaporated'} = $i++;
  1169. $rscountertable{'Local Change Orders Issued'} = $i++;
  1170. $rscountertable{'Bytes of Files Installed'} = $i++;
  1171. $rscountertable{'Local Change Orders Retired'} = $i++;
  1172. $rscountertable{'Local Change Orders Aborted'} = $i++;
  1173. $rscountertable{'Local Change Orders Retried'} = $i++;
  1174. $rscountertable{'Local Change Orders Retried at Generate'} = $i++;
  1175. $rscountertable{'Local Change Orders Retried at Fetch'} = $i++;
  1176. $rscountertable{'Local Change Orders Retried at Install'} = $i++;
  1177. $rscountertable{'Local Change Orders Retried at Rename'} = $i++;
  1178. $rscountertable{'Local Change Orders Morphed'} = $i++;
  1179. $rscountertable{'Local Change Orders Propagated'} = $i++;
  1180. $rscountertable{'Local Change Orders Sent'} = $i++;
  1181. $rscountertable{'KB of Staging Space In Use'} = $i++;
  1182. $rscountertable{'Local Change Orders Sent At Join'} = $i++;
  1183. $rscountertable{'Remote Change Orders Issued'} = $i++;
  1184. $rscountertable{'Remote Change Orders Retired'} = $i++;
  1185. $rscountertable{'Remote Change Orders Aborted'} = $i++;
  1186. $rscountertable{'Remote Change Orders Retried'} = $i++;
  1187. $rscountertable{'Remote Change Orders Retried at Generate'} = $i++;
  1188. $rscountertable{'Remote Change Orders Retried at Fetch'} = $i++;
  1189. $rscountertable{'Remote Change Orders Retried at Install'} = $i++;
  1190. $rscountertable{'Remote Change Orders Retried at Rename'} = $i++;
  1191. $rscountertable{'Remote Change Orders Morphed'} = $i++;
  1192. $rscountertable{'KB of Staging Space Free'} = $i++;
  1193. $rscountertable{'Remote Change Orders Propagated'} = $i++;
  1194. $rscountertable{'Remote Change Orders Sent'} = $i++;
  1195. $rscountertable{'Remote Change Orders Received'} = $i++;
  1196. $rscountertable{'Inbound Change Orders Dampened'} = $i++;
  1197. $rscountertable{'Outbound Change Orders Dampened'} = $i++;
  1198. $rscountertable{'Usn Reads'} = $i++;
  1199. $rscountertable{'Usn Records Examined'} = $i++;
  1200. $rscountertable{'Usn Records Accepted'} = $i++;
  1201. $rscountertable{'Usn Records Rejected'} = $i++;
  1202. $rscountertable{'Packets Received'} = $i++;
  1203. $rscountertable{'Packets Received in Bytes'} = $i++;
  1204. $rscountertable{'Packets Received in Error'} = $i++;
  1205. $rscountertable{'Packets Sent'} = $i++;
  1206. $rscountertable{'Packets Sent in Error'} = $i++;
  1207. $rscountertable{'Communication Timeouts'} = $i++;
  1208. $rscountertable{'Fetch Requests Sent'} = $i++;
  1209. $rscountertable{'Fetch Requests Received'} = $i++;
  1210. $rscountertable{'Fetch Blocks Sent'} = $i++;
  1211. $rscountertable{'Fetch Blocks Received'} = $i++;
  1212. $rscountertable{'Join Notifications Sent'} = $i++;
  1213. $rscountertable{'Join Notifications Received'} = $i++;
  1214. $rscountertable{'Packets Sent in Bytes'} = $i++;
  1215. $rscountertable{'Joins'} = $i++;
  1216. $rscountertable{'Unjoins'} = $i++;
  1217. $rscountertable{'Bindings'} = $i++;
  1218. $rscountertable{'Bindings in Error'} = $i++;
  1219. $rscountertable{'Authentications'} = $i++;
  1220. $rscountertable{'Authentications in Error'} = $i++;
  1221. $rscountertable{'DS Polls'} = $i++;
  1222. $rscountertable{'DS Polls without Changes'} = $i++;
  1223. $rscountertable{'DS Polls with Changes'} = $i++;
  1224. $rscountertable{'DS Searches'} = $i++;
  1225. $rscountertable{'Fetch Blocks Sent in Bytes'} = $i++;
  1226. $rscountertable{'DS Searches in Error'} = $i++;
  1227. $rscountertable{'DS Objects'} = $i++;
  1228. $rscountertable{'DS Objects in Error'} = $i++;
  1229. $rscountertable{'DS Bindings'} = $i++;
  1230. $rscountertable{'DS Bindings in Error'} = $i++;
  1231. $rscountertable{'Replica Sets Created'} = $i++;
  1232. $rscountertable{'Replica Sets Deleted'} = $i++;
  1233. $rscountertable{'Replica Sets Removed'} = $i++;
  1234. $rscountertable{'Replica Sets Started'} = $i++;
  1235. $rscountertable{'Threads started'} = $i++;
  1236. $rscountertable{'Fetch Blocks Received in Bytes'} = $i++;
  1237. $rscountertable{'Threads exited'} = $i++;
  1238. }
  1239. __END__
  1240. :endofperl
  1241. @perl %~dpn0.cmd %*