Monitoring collector performance counters

If you have enabled auditing and installed the collector service on a local Windows computer, you can add audit-specific performance counters to Performance Monitor to help you analyze and resolve audit-related issues. When you install the collector, the performance counters are added automatically, if you uninstall the collector, the counters are also automatically removed from Performance Monitor.

To add authentication, privilege elevation, and audit and monitoring services performance counters:

  1. Log on to a computer with a collector service.
  2. Click Start > Administrative Tools > Performance Monitor.
  3. Expand Monitoring Tools and select Performance Monitor.
  4. Click the green plus (+) icon in the toolbar.
  5. Find the Audit Collector from the list, and expand it to show the list of available performance counters.

    The performance counters generally fall into one of three categories; agent information, packet volume, and data loads. For example, if you add the counter # Connected Agent, you will be able to view the number of agents currently connected. If you add the counter # Unix Meta Message Packet, you will be able to view the number of Unix meta message packets. If you add the counter, Bytes Unix Command, you will be able to view Unix command data in bytes.

  6. Choose the performance counter you would like to add and click Add.

  7. Repeat Step 6 until you have added the counters you want to monitor.

  8. Click OK.