Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a file server running Win2k8R2 on an older HP DL380G4. It has nothing set up on it other than file sharing. All drivers/firmware/updates installed. The file server is used as a dump for a bunch of test machines - so essentially a lot of small files are being written to it. It was working fine until it started showing the following symptoms:

  1. Shares became either very slow/intermittent or could not access them at all.
  2. Logging in the the server, you could use it like normal but windows would start freezing and eventually you had to hard reboot it because nothing was responsive.
  3. After rebooting, it would work fine for 20min-2hours and then degrade into this broken state again.

Some info after investigation: HP Raid Config utility shows the Raid array as functioning properly (RAID5 btw).

  1. Event log shows a bunch of DoS attacks from the test machines, saying it has disconnected the connection a. AFAIK (not part of my job) the test machines haven't changed the way they log information to this server or the amount of them hasn't increased. b. Nothing is infected, this server was scanned fully, and the test machines are re-imaged almost daily.
  2. Nothing in performance monitor shows as anything being pegged at maximum (CPU/HD/Network/RAM)
  3. I installed MS Network Monitor and it is showing a lot of traffic
  4. The server was using one gigabit Ethernet connection, I connected the second one as well with the same results.
  5. Forgot to add - one of the commonly written to dirs on the share has over 16k subdirs in it, with a crapton of small files within those dirs. Some of the OS instability was slow access to the drive which has this directory - perfmon doesn't show much activity on the HD though so I'm not sure if this crowded dir is the cause.

Here is one important fact: I ran into this issue 2-3 months ago, couldn't figure it out, but I had a spare identical machine so I swapped them out (thought it was related to the machine), and now I have the same issue.

Also, the computer will be stable if I turn off file sharing.

So is the server just getting DoS'd by the test machines? I've never dealt with such an issue. Is instability in the server's OS common when getting DoS'd? Is there anything I can do to confirm this before telling the owners of the test machines to optimize their traffic? (I'm not sure what they'll be able to do).

Is there something within Win2k8R2 that can balance the traffic across the two NICs?

Any help would be appreciated.

Update: Another thought - the drive with the share is RAID5 across 6 SCSI320 300GB HDs. They are near full capacity about 100GB from 1TB left. Could the amount of tiny files could be causing some weirdness with the parity in this array? I think I've read something about this in the past but I'm no expert on RAID.

share|improve this question
    
Some other info, in PerfMon disk activity, I see it writing constantly to the NTFS Volume log on the drive with the shares, at around 2-3MB/s. I read that if this log fills up due to the hardware not being able to keep up then all access to the disk will be paused until it's cleared. Sometimes explorer does freeze up when just trying to browse the drive with the shares... –  Jack B. Jan 5 '11 at 19:16
add comment

3 Answers

You should run Process Explorer from Sysinternals suite. There you can see under system idle process Interrupts and DFCs load on your CPU, if high when is your problem occuring, your CPU+ICSI controller+Drives cannot handle the amount of small files and directories. This could be causing the system freezing and slowness but not show in task manager or perfmon. If the case, might be solved with better hardware or better, with buffering dumps in less bigger files/directories(zip :)). PS: Sorry for my English, not native speaker.

share|improve this answer
add comment

The event log says too many connections are occuring (or at least more than expected and previously), NetMon shows "a lot of traffic"...looking at the traffic on the wire would be a logical next step to get more info about about the connections. Wireshark would be one tool to use, or NetMon.

share|improve this answer
    
Doing a capture with NetMon gives you about 2700 results in a 10 second capture. Almost all of it is SMB2 traffic. Too many machines hitting the shares? I don't know how much traffic is "normal" or too much. –  Jack B. Jan 5 '11 at 18:23
    
"Too much" varies but many connections from a single machine would be 1 sign of a problem, possibly malware. 1 machine that has much more activity could be normal or the sign of a problem depending on the network and applications. –  Ed Fries Jan 6 '11 at 15:55
    
More than a few connections from a single machine would be 1 sign of a problem. Pick one of the PC's that are "DoS'g", and figure out why it's opening so many connections: check the wire traffic for that IP but also check a suspect PC directly for clues. If it's pounding the server then figure out why: virus/malware, application change, bad DNS, attaching to a share that doesn't exist, authentication issue, offline files sync of the a large mapped drive, etc. –  Ed Fries Jan 6 '11 at 16:46
add comment

I'm with Ed on this ones it has a malware sound to it. Do your computers and servers have anti-virus software installed?

Try running malwarebytes and ThreatStops scanner (use the 30 minute setting) on the client machines that are connecting to your share. It also wouldn't harm to run them on the problem server also.

One more thing. If your client computers have anti-virus, check if they are set to scan mapped drives. I had a problem awhile ago where client anti-virus software was scanning my mapped drives causing a slow down on the server.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.