Guides‎ > ‎Common Checks‎ > ‎

Network Interfaces

Windows Performance Counters

Traffic and errrors for a network interface can be measured using performance counters.

There are many performance counters available, these are the ones that I think are most useful:
  • Bytes Received/sec
    • Bytes Received/sec is the rate at which bytes are received over each network adapter, including framing characters. Network Interface\Bytes Received/sec is a subset of Network Interface\Bytes Total/sec
  • Bytes Sent/sec
    • Bytes Sent/sec is the rate at which bytes are sent over each network adapter, including framing characters. Network Interface\Bytes Sent/sec is a subset of Network Interface\Bytes Total/sec
  • Packets Outbound Errors
    • Packets Outbound Errors is the number of outbound packets that could not be transmitted because of errors
  • Packets Received Errors
    • Packets Received Errors is the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol
  • Packets Outbound Discarded
    • Packets Outbound Discarded is the number of outbound packets that were chosen to be discarded even though no errors had been detected to prevent transmission. One possible reason for discarding packets could be to free up buffer space
  • Packets Received Discarded
    • Packets Received Discarded is the number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their delivery to a higher-layer protocol.  One possible reason for discarding packets could be to free up buffer space

Warning and Critical Threshold Values
The values in the examples provided are for demonstration purposes, you will need to adjust them to suit your environment.

Labels When Using NSClient++
Normally the output is as follows:
  • Command:
    • check_nrpe -H win2008r2-01 -c CheckCounter -a 'Counter=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Bytes Received/Sec' ShowAll MaxWarn=786432000 MaxCrit=943718400
  • Output:
    • OK: \Network Interface(Intel[R] PRO_1000 MT Network Connection)\Bytes Received/Sec: 322.586|'\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Bytes Received/Sec'=322.58591;786432000;943718400

However I like to provide my own label as I don't need to display the whole name of the performance counter in my output. To do this, you simply add the label Counter<:here>= (before the equal sign, starting with a column). For example:
  • Command:
    • check_nrpe -H win2008r2-01 -c CheckCounter -a 'Counter:Bytes Received/sec=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Bytes Received/Sec' ShowAll MaxWarn=786432000 MaxCrit=943718400
  • Output:
    • OK: Bytes Received/sec: 1325.24|'Bytes Received/sec'=1325.23939;786432000;943718400
So you can see it looks cleaner ... well that's my opinion anyway :)


Network Interface Name
The performance counters are tied to the actual name of the network card, even if this is a virtual machine it's a virtual network card. Hence these can be harder to create common services unless all your servers have the same named network interfaces.


OK so on with the examples ...

Bytes Received/sec

Assuming this is a 1GB network interface, warning at 750 Megabytes Received/sec (786432000 bytes) and critical at 900 Megabytes Received/sec (943718400 bytes)

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c CheckCounter -a 'Counter:Bytes Received/sec=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Bytes Received/Sec' ShowAll MaxWarn=786432000 MaxCrit=943718400

Output:
OK: Bytes Received/sec: 1325.24|'Bytes Received/sec'=1325.23939;786432000;943718400

NSClient++ 0.5.0.17 onwards
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c check_pdh -a 'counter:Bytes Received/sec=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Bytes Received/Sec' 'warning=value>786432000' 'critical=value>943718400' 'perf-config=*(suffix:none)'

Output:
OK: Bytes Received/sec = 1254|'Bytes Received/sec'=1254;786432000;943718400

Bytes Sent/sec

Assuming this is a 1GB network interface, warning at 750 Megabytes Sent/sec (786432000 bytes) and critical at 900 Megabytes Sent/sec (943718400 bytes)

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c CheckCounter -a 'Counter:Bytes Sent/sec=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Bytes Sent/Sec' ShowAll MaxWarn=786432000 MaxCrit=943718400

Output:
OK: Bytes Received/sec: 297.61|'Bytes Received/sec'=297.609806;786432000;943718400

NSClient++ 0.5.0.17 onwards
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c check_pdh -a 'counter:Bytes Sent/sec=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Bytes Sent/Sec' 'warning=value>786432000' 'critical=value>943718400' 'perf-config=*(suffix:none)'

Output:
OK: Bytes Sent/sec = 77|'Bytes Sent/sec'=77;786432000;943718400

Packets Outbound Errors

Any errors are cause for concern!

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c CheckCounter -a 'Counter:Packets Outbound Errors=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Packets Outbound Errors' ShowAll MaxWarn=1 MaxCrit=1

Output:
OK: Packets Outbound Errors: 0|'Packets Outbound Errors'=0;1;1

NSClient++ 0.5.0.17 onwards
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c check_pdh -a 'counter:Packets Outbound Errors=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Packets Outbound Errors' 'warning=value>0' 'critical=value>0' 'perf-config=*(suffix:none)'

Output:
OK: Packets Outbound Errors = 0|'Packets Outbound Errors'=0;0;0

Packets Received Errors

Any errors are cause for concern!

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c CheckCounter -a 'Counter:Packets Received Errors=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Packets Received Errors' ShowAll MaxWarn=1 MaxCrit=1

Output:
OK: Packets Received Errors: 0|'Packets Received Errors'=0;1;1

NSClient++ 0.5.0.17 onwards
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c check_pdh -a 'counter:Packets Received Errors=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Packets Received Errors' 'warning=value>0' 'critical=value>0' 'perf-config=*(suffix:none)'

Output:
OK: Packets Received Errors = 0|'Packets Received Errors'=0;0;0

Packets Outbound Discarded

Any errors are cause for concern!

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c CheckCounter -a 'Counter:Packets Outbound Discarded=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Packets Outbound Discarded' ShowAll MaxWarn=1 MaxCrit=1

Output:
OK: Packets Outbound Discarded: 0|'Packets Outbound Discarded'=0;1;1

NSClient++ 0.5.0.17 onwards
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c check_pdh -a 'counter:Packets Outbound Discarded=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Packets Outbound Discarded' 'warning=value>0' 'critical=value>0' 'perf-config=*(suffix:none)'

Output:
OK: Packets Outbound Discarded = 0|'Packets Outbound Discarded'=0;0;0

Packets Received Discarded

Any errors are cause for concern!

NSClient++ 0.3.9 & 0.4.1
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c CheckCounter -a 'Counter:Packets Received Discarded=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Packets Received Discarded' ShowAll MaxWarn=1 MaxCrit=1

Output:
OK: Packets Received Discarded: 0|'Packets Received Discarded'=0;1;1

NSClient++ 0.5.0.17 onwards
No additional configuration is required.
Command:
check_nrpe -H win2008r2-01 -c check_pdh -a 'counter:Packets Received Discarded=\Network Interface(Intel[R] PRO_1000 MT Network Connection)\Packets Received Discarded' 'warning=value>0' 'critical=value>0' 'perf-config=*(suffix:none)'

Output:
OK: Packets Received Discarded = 0|'Packets Received Discarded'=0;0;0

Powershell Script

Willem D'Haese has a great solution available for network connection monitoring and can be found here:

http://outsideit.net/check-ms-win-network-connections/