使用 Application Diagnostics 處理事件Working with events by using Application Diagnostics

重要

已不再支援此版本的 Operations Manager,建議升級至 Operations Manager 2019This version of Operations Manager has reached the end of support, we recommend you to upgrade to Operations Manager 2019.

處理警示是使用 System Center - Operations Manager 的標準作業。Working with alerts is a standard part of working with System Center - Operations Manager. .NET 應用程式監視的警示會顯示可在其他警示看到的資訊,例如一般資訊和產品知識。Alerts for .NET application monitoring show you the information you will recognize from other alerts, such as the general information and product knowledge. 不過,NET 應用程式警示還在警示描述中提供連結。However, a .NET application alert also provides a link in the alert description. 此連結可在 Application Diagnostics 中開啟引發警示的事件。This link opens the event that raised the alert in Application Diagnostics. 您可以在此處查看有助於疑難排解以及識別問題和解決方案的詳細資訊。Here you can see far more information that will help you troubleshoot and identify your problem and solution.

注意

從應用程式效能監視進行深入的警示疑難排解通常需要存取應用程式原始碼,而且可能需要與開發人員通力合作。Deep troubleshooting of alerts from Application Performance Monitoring often requires access to the application source code and might require input from developers. 您可以安裝 Team Foundation Server 工作項目同步處理管理組件,然後將警示轉寄給開發團隊使用的 Team Foundation Server。You can install the Team Foundation Server Work Item Synchronization Management Pack and forward alerts to Team Foundation Server used by the development team. Team Foundation Server 工作項目同步處理管理組件可追蹤和同步處理對 Team Foundation Server 工作項目所做的變更,以及對相關 Operations Manager 警示所做的變更。The Team Foundation Server Work Item Synchronization Management Pack tracks and synchronizes changes made to Team Foundation Server work items and changes made to associated Operations Manager alerts.

調查 .NET 應用程式警示Investigating .NET Application alerts

減少判斷、指派和解決問題所花的時間是 Operations Manager 應用程式監視的主要目標。Decreasing the time it takes to determine, assign, and resolve issues is the central goal of application monitoring in Operations Manager. 當您收到警示時,必須了解引發警示的原因 (裝載應用程式的系統或程式碼)、能夠提出支持結論的資料,以及明確找出應修復問題的人員。When you receive an alert, you need to know what caused it - the system hosting the application or the code, be able to show the data to back up that conclusion, and clearly see who should fix the problem. 若要得知警示代表的是否為系統問題,您需要知道事件發生時的系統狀態。To know if it is a system issue, you need to know the state of your system at the time of the event. 若要得知根本問題的發生位置,您需要知道發生的呼叫鏈結。To know where the root problem occurred, you need to know the chain of calls that occurred. 若要進一步調查,您需要比對在同一時間發生的類似事件和相關事件。To further investigate you need to compare similar events and related events that happened at the same time. 綜合以上各點,事件詳細資料、效能計數器及分散式鏈結將能協助您釐清應該先讓誰來解決此問題。Together, the event details, performance counters, and distributed chains will help you triage who should look at this problem first. 如果警示代表的是系統錯誤,您可以調整主機系統的可用資源或設定,然後在主機層級解決問題。If it is a system error you can adjust the available resources or configuration of the host system and address the issue at the host level. 如果警示代表的是應用程式失敗,您可能需要將問題以及發生失敗的程式碼行轉給應用程式團隊以求解決問題。If it is an application failure, the problem will need to go to the application team along with the line of code where the failure occurred. 以下是在 Application Diagnostics 中使用檢視、篩選條件和設定的一些策略,以協助您找出根本原因、尋求解決方式,以及對該找誰來修復問題有比較深入的瞭解。Here are some strategies for using the views, filters, and settings in Application Diagnostics to help you get to the root cause, find a resolution, and better know who needs to be involved to fix the problem.

從警示開啟 Application DiagnosticsOpen Application Diagnostics from an alert

  1. 由於您是對已設定之特定應用程式群組的相關警示做出回應,因此界定作用中警示的領域並依照應用程式群組來加以檢視將有助於解決問題。Since you are responding to alerts related to specific application groups that you configured, it is helpful to scope active alerts and view them by application group. 在 Operations 主控台的瀏覽窗格中,選取 [監視] ,並展開 [應用程式監視.NET 監視] ,然後按一下以您已設定要監視且想要調查警示的應用程式群組所命名的資料夾,再按一下 [作用中警示] 。In the Operations console, in the navigation pane, select Monitoring, expand Application Monitoring.NET Monitoring, click the folder with the name of the application group you configured for monitoring whose alerts you want to investigate, and then click Active Alerts.

  2. 按兩下要開啟的警示。Double-click the alert you want to open.

  3. 在 [警示內容] 頁面中,按一下 [警示描述] 窗格中的連結。On the Alert Properties page, click the link in the Alert Description pane. 這會在網頁瀏覽器中開啟 Application Diagnostics 這項 Operations Manager 的新監視功能。This opens Application Diagnostics, a new monitoring feature in Operations Manager in a web browser. 您可以在這裡的 [事件內容] 索引標籤上看到資訊,例如效能計量、呼叫堆疊以及與警示相關的收集附註。Here on the Event properties tab you can see information, such as the performance metrics, the call stack, and collection notes about the alert. 這些標籤可讓您查看類似事件、相關事件、事件鏈結和效能計數器。Using the tabs, you can see similar events, related events, event chains, and performance counters. 這些是與應用程式所引發的效能或例外狀況事件相關的詳細資訊,可協助您診斷問題是來自應用程式本身、Web 服務的呼叫或資料庫的呼叫。This is detailed information about the performance or exception event that was raised for the application that will help you diagnose whether the issue is coming from the application itself, a call to a web service, or a call to a database. 如需 [事件內容] 索引標籤的詳細資訊,請參閱<效能事件詳細資料>。For more information on the Event properties tab, see Performance Event Details. 當事件資訊載入時,按一下 [是] 關閉主視窗。Click Yes to close the main window once the event information has loaded.

    注意

    [警示內容] 索引標籤上也有 Application Diagnostics 的連結。This link to Application Diagnostics is also on the on the Alert Context tab.

請使用下列程序來調查警示。Use the following procedures to investigate your alert. IT 專業人員可能會使用 [事件內容]、[效能計數器] 和 [分散式鏈結] 索引標籤上的資訊來找出發生什麼事、瞭解問題是否由系統問題引發,以及調查根本原因發生的位置。IT Pros will most likely want to use information on the Event properties, Performance counters, and Distributed chains tabs to find out what happened, understand if a system issue caused the problem, and investigate where the root cause occurred. 開發人員可能會需要使用 [分散式鏈結]、[類似事件] 和 [相關事件] 索引標籤上的資訊來瞭解發生程式碼問題的特定內容。Developers will most likely need to use the information on the Distributed chains, Similar events, and Related events tabs to understand the specific context around a code problem.

在 Application Diagnostics 中使用例外狀況事件內容來進行疑難排解Troubleshoot by using Exception Event properties in Application Diagnostics

  1. 在要調查的例外狀況警示的 [Application Diagnostics] 視窗中,按一下 [事件內容] 索引標籤,檢視警示的重要詳細資料。In the Application Diagnostics window for the exception alert you are investigating, click the Event properties tab to view key details about the alert. 當您要知道警示問題是否確立時,這是第一個要查看的位置。This is the first place to check to see if the alert problem is apparent. 您可以在 [事件內容] 頁面上看到的一些重要資訊類別如下:Some of the key categories of information you will see on the Event properties page are as follows:

    • 來源 若要顯示應用程式載入和回應時間,請按一下左上角的 [來源] 連結。Source To display the application load and response times, click the Source link in the upper-left corner. 這些資訊會顯示例外狀況事件失敗發生時系統的負載。This information shows the load the system was under in the context of the exception event failure. 若要檢視效能計數器及進一步評估系統狀態,請按一下 [來源] 頁面中的 [趨勢報表] 索引標籤。若要查看此應用程式運作所在的電腦及瞭解電腦間是否曾發生負載平衡問題,請按一下 [電腦] 索引標籤。若要查看相關呼叫的細目或事件在鏈結中的發生位置,請按一下 [拓撲] 索引標籤。To view performance counters and further assess system state, on the Source page, click the Trend reports tab. To see which computers this application is working on and see if there might be a load balancing problem across computers, click the Computers tab. To see a breakdown of related calls, or where the events are happening based on chains, click the Topology tab.

    • 例外狀況鏈結 :這會顯示例外狀況事件。Exception Chain This displays for exception events. 展開 [例外狀況鏈結] 可檢視實際發生的例外狀況。Expand Exception Chain to view the actual exception that occurred.

    • 例外狀況資料 :這會顯示例外狀況事件,以及顯示透過例外狀況為類別設定的參數和變數。Exception Data This displays for exception events and shows parameters and variables set for the class through the exception.

    • 堆疊 :這是呼叫堆疊或事件的發生順序。Stack This is the call stack, or order in which things happened. 執行樹狀檢視可讓您展開節點以調查呼叫。The Execution Tree View allows you to expand nodes to investigate the calls. 按一下 [資源群組檢視] 選項按鈕可顯示時間花在哪裡的概觀。Click the Resource Group View radio button to display an overview of where time was spent. 這可指出問題的所在層次或發生的位置。This answers which tier the problem is in, or where is it occurring.

    • 模組清單 :這會顯示例外狀況事件並指出例外狀況發生時載入的模組。Modules List This displays for exception events and shows modules loaded at time of exception.

    • 集合附註 :這會顯示與事件相關的任何附註。Collection Notes This displays any notes about the event.

    提示

    使用與例外狀況事件相同的疑難排解步驟來處理效能事件、類似事件、分散式鏈結和效能計數器。Use the same troubleshooting steps for Performance events, Similar events, Related events, Distributed chains, and Performance counters as you did for Exception events.

在 Application Diagnostics 中使用效能事件內容來進行疑難排解Troubleshoot by using Performance Event properties in Application Diagnostics

  1. 在要調查的效能警示的 [Application Diagnostics] 視窗中,按一下 [事件內容] 索引標籤,檢視警示的重要詳細資料。In the Application Diagnostics window for the performance alert you are investigating, click the Event properties tab to view key details about the alert. 當您要知道警示問題是否確立時,這是第一個要查看的位置。This is the first place to check to see if the alert problem is apparent. 您可以在 [效能內容] 頁面上看到的一些重要資訊類別如下:Some of the key categories of information you will see on the Performance properties page are as follows:

    • 來源 若要顯示應用程式載入和回應時間,請按一下左上角的 [來源] 連結。Source To display the application load and response times, click the Source link in the upper-left corner. 這些資訊會顯示例外狀況事件失敗發生時系統的負載。This information shows the load the system was under in the context of the exception event failure. 若要檢視效能計數器及進一步評估系統狀態,請按一下 [來源] 頁面中的 [趨勢報表] 索引標籤。若要查看此應用程式運作所在的電腦及瞭解電腦間是否曾發生負載平衡問題,請按一下 [電腦] 索引標籤。若要查看相關呼叫的細目或事件在鏈結中的發生位置,請按一下 [拓撲] 索引標籤。To view performance counters and further assess system state, on the Source page, click the Trend reports tab. To see which computers this application is working on and see if there might be a load balancing problem across computers, click the Computers tab. To see a breakdown of related calls, or where the events are happening based on chains, click the Topology tab.

    • 最慢的節點 :這是執行樹狀檢視中最慢的節點清單,很有可能是導致應用程式發生效能問題的原因。Slowest Nodes This is a list of the slowest nodes in the Execution Tree View and the most likely cause of the performance issues in the application.

    • 堆疊 :這是呼叫堆疊或事件的發生順序。Stack This is the call stack, or order in which things happened. 執行樹狀檢視可讓您展開節點以調查呼叫。The Execution Tree View allows you to expand nodes to investigate the calls. 按一下 [資源群組檢視] 選項按鈕可顯示時間花在哪裡的概觀。Click the Resource Group View radio button to display an overview of where time was spent. 這可指出問題的所在層次或發生的位置。This answers which tier the problem is in-where is it occurring?

    • 集合附註 :這會顯示與事件相關的任何附註。Collection Notes This displays any notes about the event.

使用效能計數器針對系統狀態進行疑難排解Troubleshoot the state of the system by using Performance counters

  1. 若要檢視重要效能計數器的表格或圖表,請按一下 [效能計數器] 索引標籤。To view a table or diagram of key performance counters, click the Performance counters tab.

    注意

    系統會針對受監視系統收集和快取十五分鐘的效能資料。Fifteen minutes of performance data is collected and cached on the monitored system. 當系統產生效能或例外狀況時,會連同事件將效能資料傳送回 Operations Manager。When a performance or exception is raised, the performance data is sent back to Operations Manager along with the event.

  2. 針對要納入資訊中的效能計數器選取效能計數器核取方塊,然後按一下 [套用] 。Select the performance counter checkboxes for the performance counters you want to include in your information, and then click Apply.

  3. 此顯示畫面中的資訊可讓您評估調查的事件發生時的系統效能狀態。Use the information in this display to assess the system performance state around the event you are investigating. 例如,如果事件發生時的效能均一致地處於低落的狀態,表示警示可能是由系統效能問題引發的。For example, if the performance is uniformly slow at the time of the event, then your alert is likely due to a system performance problem.

使用分散式鏈結找出根本問題Find the root problem by using Distributed chains

  1. 按一下 [分散式鏈結] 索引標籤,檢視呼叫的順序 (即事件參與其中的事件鏈結)。Click the Distributed chains tab to view the order of calls-the chain of events of which the event is part. 有助於瞭解調查的事件受應用程式或相關應用程式引發的其他事件影響的程度。This helps you understand how the event you are investigating was impacted by other events from the application or related applications.

  2. 在分散式鏈結檢視中,按一下鏈結中的某一個呼叫或連結。In the Distributed chains view, click one of the calls, or links, in the chain. 如果同一個物件有多個事件,鏈結精靈將會開啟。If there are multiple events for the same object, the Chaining Wizard will open. 此精靈可讓您選取可相互關聯成事件鏈結的可能事件。This wizard allows you to select possible events to correlate into a chain of events. 若要開始精靈,請按一下 [下一步] 。To begin the Wizard, click Next.

    注意

    請取得所選呼叫的時間戳記,因為您需要在下一個頁面中與事件配對。Get the time stamp from the call you select as you will pair this with an event on the next page.

  3. 在 [選取可能的鏈結事件] 頁面中選取要檢查的事件。The Select Possible Chain Event page, select the event that you want to examine. 在理想的情況下,該事件是時間戳記與在 [分散式鏈結] 檢視中選取的呼叫最接近的事件。Ideally it will be the event with the time stamp that is closest to call you selected in the Distributed Chains view.

  4. 接下來,畫面中會出現的內容將取決於您所調查問題的種類。What you see next depends on the kind of problem you are investigating. 例如,如果您選取找不到伺服器的交易,就可能會移至該事件的事件內容頁面。For example, if you select a transaction where a server is not found, you might go to the event properties page for that event. 這可讓您將伺服器錯誤與原本調查的事件配對。This will let you pair the server error with the event you were initially investigating. 由於這個問題是伺服器錯誤,因此您知道問題並非出自用戶端,而是伺服器端。Since it is a server error, you know that the problem is not on the client side, but server side. 您可能會看到所選事件的圖表,並且能根據頁面載入時間分析效能事件。You might see a graph of the event you selected and be able to breakdown a performance event in terms of the page load time.

  5. 在事件內容中按一下伺服器端呼叫,然後按一下 [效能計數器] 索引標籤以取得詳細資料。From event properties, click the server-side call, and click the Performance Counters tab for more details.

檢視類似事件來進行疑難排解Troubleshoot by viewing similar events

  1. 按一下 [類似事件] 索引標籤來查看是否有類似的警示遭擲回多次,這可能代表應用程式發生問題。Click the Similar events tab to see if similar alerts have been thrown more times, which could mean that there is a problem with the application.

  2. 篩選類似事件的方法有數種。There are several ways to filter similar events. 按一下 [相似依據] 下拉式功能表以選取類似事件的分組依據:依照問題、動作、例外狀況類別或失敗函式。Click the Similar by dropdown menu to select how you want to group the similar events: by problem, action, exception class, or failed function. 在 [從] 和 [到] 文字方塊中,您可以設定要檢視類似事件的日期範圍。In the From and To text boxes, you can set the range of dates from which you want to view the similar events. 使用 [類似事件] 索引標籤來檢視是否有類似的警示遭擲回多次,這可能代表應用程式發生問題。Use the Similar events tab to view if similar alerts has been thrown more times, which could mean that there is a problem with the application.

    • 依問題篩選 會顯示屬於相同類型的類似事件。Filtering by Problem shows you similar events that are of the same type. 例如,您可以查看物件參考未設定為物件執行個體的所有類似事件。For example you can see all similar events where the object reference is not set to an instance of an object. 按一下 [圖表檢視] 按鈕可查看目前問題的事件總數與其他問題的事件總數的比率。Click the Diagram View button and you can see the ratio of total number of events for the current problem and the total number of events from other problems. 這項資訊可讓您快速瞭解此特定事件的問題範圍。This information gives you a quick view into the magnitude of the problem that this particular event has. 如果目前有許多類似事件均發生相同的問題,表示這個問題的解決優先順序較高,因為它能大幅減少您收到的警示數目。If many of the current total similar events have the same problem, it might be a higher priority problem to resolve since it will have high impact in reducing the number of alerts you receive.

    • 依動作篩選 可依照安全性、效能、連線及應用程式失敗等方面將類似事件分組。Filtering by Action groups the similar events by aspect: security, performance, connectivity, and application failure. 按一下 [圖表檢視] 按鈕可查看依上述方面類別分組的類似事件數目,讓您輕易地辨識可能與問題相關的事件。Click the Diagram View button and you can see the number of similar events by these aspect categories and more easily see which ones the problem might be related to.

    • 依例外狀況類別篩選 可根據您在設定期間命名事件的方式,將類似事件分組。Filtering by Exception class groups the similar events according to how you named them during configuration. 這些名稱可能是能夠幫助您識別例外狀況種類的名稱,例如 System.NullReferenceException 類別。Presumably, these would be names that would help you identify the kind of exceptions they are, such as System.NullReferenceException class.

    • 依失敗函式篩選 可依照擲回例外狀況的相同函式將類似事件分組。Filtering by Failed function groups the similar events by the same function is throwing the exception. 這可能表示進入點發生問題。This could mean that there is a problem with the entry point.

    請牢記,這些全都是定義上相關的類似事件,而這些篩選器可讓您更瞭解這些事件的實際關聯。Keep in mind that these are all similar events-related by definition-and these filters give you a better idea of exactly how they are related. 因此,使用類似事件篩選器時,您可能會有下列發現:大部分的事件都有和您檢視的事件相同的問題、事件是效能問題、這些事件屬於您設定的例外狀況類別,以及類似事件半數都有相同的失敗函式。So, using the Similar Events filters, you might find that most of your total events have the same problem as the event you are viewing, that it is a performance problem, that they belong to an exception class you configured, and that half of the similar events had the same failed function. 動作:將函式交給需要更新函式程式碼的開發人員。Action: The function goes to the developer who needs to update the function code.

  1. 按一下 [相關事件] 索引標籤,檢視具有時間相關性的事件。Click the Related events tab to view events that are related by time. 這些是與其他事件交互關聯的例外狀況,可讓您瞭解問題所在。These are exceptions correlated with other events that might give you an insight to the problem.

  2. 若要檢視清單中某個事件的事件詳細資料,請按一下 [描述] 欄中的連結。To view the event details of an event in the list, click the link in the Description column.

    在相關事件中,您可能會注意到某一段時間的回應非常慢。In the related events you might notice that response time is very slow for all events during a certain time. 這可能表示系統發生問題,而非程式碼,因此可能會轉交給 IT 專業人員來解決。This could indicate a problem with the system, not the code, and so it might be redirected to the IT pro for a solution.

後續步驟Next steps