At a loss, for Network issue any help?

[Scottf66]

Hello all, I am not a networking guy, but I work for a company and part of my job is "assist" with tech issues. I am not tech stupid, but I also do not have a degree or anything. Anyways my question is this. We had a server project done, and a couple new servers with VM's were installed. Now a user (the president only) has recurring issues around 5-6pm, and she claims the file server slows way down, and that when trying to delete email, she just gets the spinning circle. (they are on office 365).

This issue only happens a couple times a week. Some other users have claimed they felt some slowness, however most people leave at 5, and I have noticed people complain for even the smallest issue. I have checked with the ISP to see if there is any traffic of note exiting the network or if excessive traffic is leaving. Of the 40 or so people who work there only like 2-3 "feel" this issue. I have checked to make sure the backups are not running at the same time. I have stayed late and did generic file transfers and never saw any issues. I checked for scheduled tasks, yet do not see anything that would use resources. I see nothing on either her event viewer, or the file share server event viewer other then some iscsi errors. This is used for their storage.
Error ID:
49
20
39
9
7
are the associated Id's. It does show some connection issues, however there is like maybe 4 errors in a row then a break for about 20 min then repeat. Why this wouldn't affect everyone I don't know.

I upped the ram allocated to the server to 8gb, (it's a vm) and still she has issues but only in that time window.

Anyone know of any tools, or what I should look for that could be causing this? Or how to troubleshoot down to isolate the issue?

 

[Scottf66]

Wow, really not a single tip?

 

[Oyeve]

I would swap out her computer. Then go from there.

 

[Ketchup]

So is internet access in general slowing down for her, or just email?

Is her connection wired or wireless?

 

[Scottf66]

So is internet access in general slowing down for her, or just email?

Is her connection wired or wireless?

The internet isn't slowing down. I had the ISP run a 24 hour monitor, and there isn't any spikes of usage at the time she is having this issue. I did notice her company firewall for some reason was blocking 5Mb of bandwidth in. I removed that rule, and waiting to see. However the issue with the network slowness is persisting. There are also other users who are now having the same issue. When they try to move, or "check" out their drawins, it takes a long time. We recently moved the storage to a new 5tb iscsi network that is connected to the vm for the fileshare. It has a 10GB connection and shouldn't be bottlenecking. So far this is as far as I have gotten in my troubleshooting. Event viewer is clear as well.

 

[JackMDS]

As oppose to Human Networking, solving Computer networking issues is Not poetry.

Measure - I.e,. make an afford to actuality run Tools that measure the phenomenon.

Check all computers To make sure that No one is severly infected or do a No No user behavior.

First step try to measure the LAN. I.e., Traffic exchange between local wired computers.

You cam install on each computer this free App and see what is the Networking behavior.

https://www.softperfect.com/products/networx/

 

[dave_the_nerd]

Intermittent iSCSI problems? Oh, joy.

Did you enable jumbo frames? I know you're supposed to, but that always breaks iSCSI for me.

 

[PliotronX]

Oh lawdy I love the intermittent slowness calls. Is 365 using ADFS? Does she use the shared files through a mapped drive? In event viewer of the server, check out the SMB server events. Any operational errors there? Is the VM using teamed NICs?

 

[ch33zw1z]

iSCSI, guess post up some specs on the environment, could be a problem anywhere in the path.

 

[Scottf66]

Thank you for all the suggestions. I will try some of these, and see what happens. I will update specs tomorrow.

 

[PliotronX]

Would you also happen to be using cisco small business switches?

 

[ylin0811]

iscsi uses tcp. the fact the performance degrades over iscsi means there is a significant amount of packet loss causing tcp to trigger its slow start mechanism.

i don't know how office 365 works, but the best way to troubleshoot slowness in networks is to perform iperf tests when it is and not working. this should give you a good idea whether the issue is caused by the network or something else.

another way to do this would be to perform a packet dump through tcpdump or wireshark during the issue, and observe what each packet is doing.

 

[holden j caufield]

I usually check from easiest solution to hardest. I was just pulling out my hair on an issue checked everything for a day then I thought hey maybe the cable went bad. Boom fixed it in 10 seconds.

Our av scanner is set to run after 530 not only that but virus definitions are set to update around that time, also we run the backups after 530.

Are you running vmware, hyperv? There are tools in each and you can set the time frame from 5pm-6pm and pinpoint. Knowing the time frame should help you a lot.

That being said in vmware I've had issues where another vm server with lots of delta changes is running a backup at 530 which creates and removes a snapshot and causes a lot of IO on the SAN which the fileserver also resides on. Thus it will sometimes slow the fileserver down.

 

[[DHT]Osiris]

A lot of misdirection in this thread...

If it's happening to only a handful of users, and it's affecting a variety of services, look to their systems first. Get a hold of their laptop/desktop during the timeframes when they're having issues, and see what it does, fire up procmon and see what's thrashing the CPU/disk. It's probably not network related, as the ISP checked that and it isn't affecting all users. It's probably not the servers, as it isn't affecting all users.