Friday, January 17, 2014

Using Performance Counters in .NET

Why use performance counters?

I have good logging you say, excellent traceability in my database, if need be I can attach Ants Profiler, I don't need performance counters.  Not true. Every application that runs on a server and serves multiple users should be load tested.  A few definitions first:
Load testing is not using the Performance Analyser in Visual Studio or Ants Profiler.  This is merely looking for memory leaks and bad performance for a single user.  Still good to do, but doesn't replace load testing.
To be able to load test and understand the results you need to be able to measure throughput and the most likely individual performance of specific tasks while the rest of the system is under load.
Performance counters are the easiest way to monitor throughput and performance of a running system in real time.  It could be achieved with logging to files or database, but why bother? Most load testing tools capture performance monitor data and later analysis, and previous test data doesn't pollute later tests.

What else are they good for? 

Even for single user applications performance counters can be a convenient way to measure individual intensive tasks within the application.  Its also a good way to measure if running tasks in parallel is better than not.

Why not, they're easy to use and there's some free stuff

There's a huge array of standard performance counters that come with the OS and with .NET, that are very useful.  Counters to measure processor utilisation, number of logical threads created, memory usage, GC stats, and ASP.Net requests per second, and % of WCF throttles used.  Basically only code that you have written inside your app won't be measured.  Writing your own performance counters is dead easy, and there isn't much code that invades into your source to make it happen. 

var perfCounter = new PerformanceCounter("My App Name", "Counter 1", false);

Watching Performance Counters

To view performance counters and watch live data coming through use PerfMon. This is part of Windows OS.


  1. You may need to reboot after installing a performance counter with the OS.  It may appear in the PerfMon list, but no data comes through.  A reboot will likely fix this, it did for me.
  2. Admin priviledges will be required to install custom performance counters into the OS and delete them.  This works in code, but isn't a great idea to run / require production apps to use admin credentials.  To update performance counter data the app only needs to be a member of the Performance Log Users Group.
  3. There are some random gaps sometimes in the counters, but in my experience never more than a few minutes.

Download my sample code

Other References:

Azure gets PCI DSS Compliance

From Scott Guthrie's blog:

Windows Azure Now Validated for PCI DSS Compliance

We are very excited to announce that Windows Azure has been validated for compliance with the Payment Card Industry (PCI) Data Security Standards (DSS) by an independent Qualified Security Assessor (QSA).
The PCI DSS is the global standard that any organization of any size must adhere to in order to accept payment cards, and to store, process, and/or transmit cardholder data. By providing PCI DSS validated infrastructure and platform services, Windows Azure delivers a compliant platform for you to run your own secure and compliant applications. You can now achieve PCI DSS certification for those applications using Windows Azure.
To assist customers in achieving PCI DSS certification, Microsoft is making the Windows Azure PCI Attestation of Compliance and Windows Azure Customer PCI Guide available for immediate download.
Visit the Trust Center for a full list of in scope features or for more information on Windows Azure security and compliance.


Today’s release includes a bunch of great features that enable you to build even better cloud solutions.  If you don’t already have a Windows Azure account, you can sign-up for a free trial and start using all of the above features today.  Then visit the Windows Azure Documentation Centerto learn more about how to build apps with it.

Sunday, January 12, 2014

Check your own security

Checks how good your current client is at using a secure SSL/TLS connection.
Checks if your name has been published as having been inappropriately accessed by unauthorized persons.

How secure is your password? How long would it take for a standard desktop PC to brute force your password?