• account logon events
• account management
• directory service access
• logon events
• object access
• policy changes
• privilege use
• process tracking
• system events ,this can be enabled by a specific host (pc,uo,ecc..)
• active directory objects
• files and folders,printers,registry keys

If resources have been enabled for auditing but don't appear in the event viewer ,check that the security settogns have been enabled.

EVENT VIEWER

The Event Viewer contains the following audit logs :

• system log ,events affect the system ,all have the access
• security log ,events enabled for auditing by an administrator ,only admin have the access
• application log ,events that results from applications ,all have the access
• DNS server ,log contains dns events ,alll have access

Metaframe save the logs and can be viewed with Event Viewer too.
Can be set manually to clear logs at regular intervals.

SYSTEM INFORMATION

Displays config. info about software and hardware on win200 server but is not capable of make any tests.
In addition ,info about hardware resources ,components ,software environment and internet explorer can be found using Computer Management console.

PERFORMANCE MONITOR

Graphical tool for monitoring XP server's performance ,because XP has an enormous effect on the system performance as measured by user response time.
Collects and allows an administrator to examine data about system activity.
Monitor the following areas :

• processors
• memory
• physical disks/logical disks
• server

If one of these resources exceeds the supply a system problems occour.

• processor
  • processor utilization ,over 90%on a regular basis increase the number or the speed of processors in the xp server.
  • interrupts ,some device adapter can cause an excessive number of interrupts ,degrades the performance because most of the processor time is spent to handling interrupts.
  • context switches ,typical value is 500 per second or fewer ,screen saver use many processor resources.
• memory
  • available bytes ,displays the size of the virtual memory available for applications.
  • page/sec ,this counter identifies when excessive memory pressure or paging is occuring.
• physical disks and logical disks ,two ares should be monitored on physical disks and logical disks.
  • disk time
  • current disk queue lenght
• server
  • bytes total/sec ,this the total number of bytes per second passing to and fromthe server.

Monitoring many servers can cause high network utilization.

NETWORK MONITOR

w2k server component ,can capture and dysplys frame to detect and troubleshooting problems on networks.
Not installed by default ,the metaframe packets are recognized by the port number and could be a filter to this port.

CITRIX RESOURCE MANAGER

Component of metaframe xpe.
The administrators can :

• monitor one or more servers in the farm
• set alerts (e-amil,sms,snmp) for one or more servers when an event or process is outside the limits set for the metric.
• store and retrieve data about application usage and user activity
• create reports and graphs from the data collected by the citrix resource manager

Can be accessed by the CMC.

CITRIX NETWORK MANAGER

provides system management capabilities to xp servers via an snmp management console by querying the metaframe agents to obtain status info about the xp servers.
Works with HP openview or Tivoli Netview.
Network manager can be :

• explore and gather info from xp servers on a network
• update the gathred info in an snmpmap
• log metaframe xp status traps to an snmp browser
• display specific status trap messages in an alarm window and log the same to th event browser
• represent subsytems as icons in a submap
• by default ,access the CMC ,license info ,performance counters and info about processes ,servers and sessions by clicking on an icon
• discover if a node is a xp node
• update the status of a xp node
• remotely shut down a xp node
• remotely boot xp node
• automatically change a node symbol to represent a xp node.
• start and stop the display of trap messages from all xp nodes.

Requires snmp agent enable in the properties of xp server farm.