Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my clients is experiencing internet delays and outages within their small network. They've verified with their cable company that the issue is not related to any cable company outages. The concern has been raised that either there's too much network activity for their one server to handle, or their website might be getting attacked. Due to this, we'd like to start logging their main server's network activity.

This server has the following responsibilities:

  • DNS
  • Web Server hosting a public site
  • Hosts a WCF service that their "admin" desktop application heavily interacts with
  • Runs SQL Server 2008, which the WCF server and public website interact with

Goal: Ideally, I'd like to log network bandwidth used by the processes, as I feel this would give a good handle on what services/software is eating too much bandwidth. I started looking at the native Windows Performance Monitor tool, but I can't figure out how to log the data to a file, and I'm wondering if there's a better [free] logging tool that will give details about how much bandwidth a given process is using.

Questions:

  1. How do I log the activity seen from the Perfomance Monitor Tool (if possible)

  2. Is there a better logging tool that will log how much bandwidth a given process is using?

enter image description here

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Presumably "internet (sic) delays and outages" is referring to problems with PCs accessing websites. Assuming that this server is acting as the DNS server for PCs its only material role in Internet access by PCs would be in name resolution.

The web server logs can give you some idea of the bandwidth being consumed by access to the website being hosted by this server computer. You certainly could user Performance Monitor but I think it's the wrong tool for the job in this case. Regarding using Performance Monitor, a Data Collector Set is what you're looking for.

I think you'd be better off examining ingress/egress traffic at the firewall to ascertain if bandwidth there is being exhausted, packets are being dropped by policy, etc. Something like ntop or a Netflow probe is going to give you a breakdown on that traffic. I'd argue that you need visibility into the traffic at the firewall before you start spending time breaking that traffic down at the host level.

I'd suspect a PC with malware, a failing switch, or an overloaded firewall before I'd suspect the web server.

share|improve this answer
    
+1 because you beat me! :) Congrats on the 100k mate! –  TheCleaner Apr 9 at 17:55

This is where you put on your IT sleuthing hat.

First, let's start with:

One of my clients is experiencing internet delays and outages within their small network

While troubleshooting this on the server is fine, you need to get details like:

  • time of day affected?
  • who is affected?
  • examples of what is affected?
  • how long is "it" affected?

Your comment above mixed with your other details and comments almost sounds more like:

One of my clients is experiencing delays and outages serving up their website

not "internet delays"...whatever that specifically means.

If you want to go the Perfmon route, you can collect logs with a Data Collector set in Perfmon. But you might be better off deducing what is really affected by first starting with some simple questions and answers from the client.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.