A performance data Object called Module is created internally, when you include the Module Object in your Data Collection Set (DCS) data definition. Each instance of the Module Object shows a load module name, usually a DLL (dynamically linked library module) that is loaded within the specific process. The Module Object also has a parent instance, which is the name of the process that has loaded the module.
The Module data is for identification purposes. The only Counters available for each Module are the process ID, which is used to identify the parent process uniquely, and the Load Address of the Module within the parent process virtual address space.
The Module data is intended to assist in identifying the application being executed within a container process, which is something we notice occurring more and more frequently in Windows Server. There are three specific container processes that you are likely to collect Module Object information about: mtx.exe in Windows NT 4.0, dllhost.exe and svchost.exe in Windows Server and XP. The function of these container processes is described below:
mtx.exe is a container processes used by the Microsoft Transaction Server (mts) to execute COM components (which are DLLs). When COM program DLLs are loaded as server components and execute out-of-process, the component is executed inside the mtx.exe container process.
dllhost.exe is the Windows Server version of mtx.exe that executes COM+ components. When COM+ program DLLs are loaded as server components and execute out-of-process, the component is executed inside the dllhost.exe container process. dllhost.exe is also used to execute Active Server Pages application scripts in IIS in separate container processes, when Medium or High Application Protection is specified. Medium Application Protection, a runtime option introduced with IIS and is the default setting, leads to all ASP script running inside a single copy of dllhost.exe. When a High level of Application Protection is chosen, each ASP script executes in an isolated instance of dllhost.exe. ASP scripts can be identified inside dllhost.exe by looking for the presence of wam.dll.
svchost.exe is used in Windows XP to host system services like Browser, Redirector, and Server. In Windows XP, those system services that used to execute within the services.exe container process in earlier versions of Windows NT, are arrayed across multiple instances of the svchost process, each executing under a different security profile, either SYSTEM, LOCAL SERVICE, or NETWORK SERVICE.
If you are experiencing application-related performance problems and notice lots of mtx.exe or dllhost.exe processes executing, use the Module function to identify which applications were running inside which container processes. During reporting Merge the Module instance with the parent process, using the ID Process field to uniquely identify specific processes, and replace the generic process name with the Module instance name.
Comments are closed.