Monitoring and Troubleshooting Windows Server Environments
Core concepts
Monitoring uses Performance Monitor, Event Viewer, and Azure Monitor with the Log Analytics agent or Azure Monitor Agent. Know data collection rules, alerts, and workbooks. Understand performance counters (Processor, Memory, PhysicalDisk, Network), and tools such as Resource Monitor, Task Manager, Server Manager, and Windows Admin Center. Troubleshooting includes DNS (nslookup, ipconfig /flushdns, DNS debug logging), networking (Test-NetConnection, tracert, netsh), and storage (chkdsk, Get-PhysicalDisk). Know Event IDs and logs relevant to services, clustering, and backup.
Traps to watch
Azure Monitor Agent replaces the legacy Log Analytics agent; data collection rules control what is collected. Performance Monitor counters are not the same as Task Manager percentages. High memory usage may be cache, not a leak; check Available MBytes and Pages/sec. DNS client cache and server cache are separate; flush the right one. Event Viewer filtering by log and source matters. Do not confuse Azure Monitor alerts with Azure Service Health.
Worked example
Users report slow file access on a server. Rule of thumb: check PhysicalDisk Avg. Disk sec/Read and Write; above 25 ms suggests latency. Correlate with Event Viewer and Resource Monitor, then check network and SMB. If latency is storage-bound, investigate disk queue length and CSV or Storage Spaces health before changing network settings.
Exam approach
Start with the symptom layer (network, DNS, storage, service), choose the tool that isolates it, and verify with logs and counters.