Performance Analysis of Log (PAL) Tool

We have all been there. You install a system, and everything works just perfect. Then, after a few weeks or maybe months, things begin to happen, and your task list fills up with users complaining about poor performance.

Therefore, you dive in and monitors a bunch of counters you found using your favorite search engine on the internet, but everything looks just fine. Well, I know, it is a real pain. This is where PAL could be your savior.

Over at CodePlex, there is a tool with the describing mane Performance Analysis of Log Tool, or just short PAL.

What PAL can do for you is to create a Perfmon template with just the interesting counters. After you have created a new Data Collection Set using this template and collected some data, PAL then analyze the output for you. What you then need to do is to read though a HTML document, looking for any red or yellow text.

In the steps below, I crated a template for Microsoft Active Directory, and let it run on a DC in my LAB network. While it run, I created some bad powershell scripts that did some searching in AD, and some IO intensive operations to the disk. We should get some red flags…

After you have installed PAL, open it and navigate to the Threshold File tab. Then simply select a predefined template in the Threshold file title drop down box, and click Export to Perfmon template file. To see, or edit, the counters used in this template, simply click Edit before exporting the file.


Save the exported XML file to a known location, and copy it to your Active Directory Server.

Safely there, open Performance Monitor, and expand Data Collection Sets and click User Defined. Right click User Defined, and select New, Data Collection Set. To learn more about Data Collection Sets take a look at this link


In the wizard that pops up, give the DCS a good name like PAL_ActiveDirectory, and make sure that Create from a template (Recommended) is selected. Then click Next.


Now we want to select our exported template. Click Browse… when asked to select template, and find to XML file you imported.


You should then end up with something like this


Then just click Finish, unless you want to run this under a specific account, or want the data saved elsewhere. Now start the collector and let it run for a few hours. You could also schedule this, as you normally would do when working with Data Collection Sets.

OK, so our DCS have been running for a few hours, and it is time to do something with the data.

Sign in to the domain controller, and copy your perfmon log from C:\PerfLogs back to your computer where you have PAL installed. The next job could take some time. Depending on the amount of data you have collected, and how badass your computer is, this could take hours. On my old HP 6465b laptop, it took about 3.5 hours to process about 550MB of Exchange 2010 log files using one tread.

First, go to the Threshold File tab, and choose the same template and settings you used earlier. Then open the Questions tab, and select correct Operating system, and the amount of Physical Memory (or virtual) installed on the DC. As the last step before beginning the analysis, open the File Output and specify an Output Directory.

If you open the Queue tab you should see something like this. The window is showing how you could execute the job without using the PAL Wizard.


Then go to Execute, and click Finish. Now, wait while PAL does its magic.



After some time, the analysis is done.


And you are left off with a great report to study. Have fun doing it. If you are a bit geeky like me, it could actually be some interesting reading.



Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s