HELP! Problem I can't solve - network, vague symptoms

[bluegreenturtle]

I appreciate help very much, I just am not getting this worked out.

I have a problem in our office that I can't figure out. Everything was fine until about this weekend.

Here's the setup:

1 Domain controller: w2k
1 File server w2k3

25 workstations, mix of w2k and xp

1 16 port gigabit switch
2 24 port 10/100 cisco switches

Various plotters, printers, including an oce, an hp plotter, an epson hardware rip, a few other printers.

1 usr8200 router - DHCP servicing all the workstations
1 linksys router that services only a machine that is setup as an ftp server.

PROBLEM:

Various users (on a mix of OS) complain about certain programs: Autocad, Powerpoint, Outlook, Acrobat - freeze once you try to print from them. Cannot reopen the program without a reboot. Autocad freezes sometimes with the same problem. Doesn't happen consistently - sometimes things are fine. Main router locked up once over the weekend when nobody was there, locked up 3 more times yesterday morning, seems ok now.

I ran a virus scan on both servers (one server is doing the norton corporate thing) using 2 different programs, ran a virus scan on 4 random workstations (2 were complaining of issues, one was not, one was the ftp server). Found nothing. Virus checkers are on auto on all workstations.

I ran ethreal for a bit on one of the servers but don't really understand it enough...I was looking for tons of noise from one IP or something, I guess.

What should I be looking at? Nothing's changed on the network or any new devices introduced.

I thought maybe it was a corrupt group of files, but that's tested out as not being true.


My only theory is that there is a damaged NIC somewhere that is spewing noise, maybe a printer NIC, because problems seem to be print related. Unless there's some sort of printer virus? :roll:

OH - one thing - NO complaints about internet or network access or speed. Which to me, coupled with the negative virus results seems to make a virus unlikely - if it's spewing packets don't they usually disrupt internet access at least a bit?

Any help appreciated.

 

[OdiN]

This sounds more like it could be a driver or sharing problem.

What are the printers hooked up to? The server? If so that could be the source of the problem. I would suggest going and removing the drivers for all the printers and then reinstalling the latest drivers if they are on the server. You may have to do it on the workstations too...but I'm not sure how you are hooked up there.

Oh - any reason you are not using the DC for DHCP?

The first thing to do is go to a workstation that has just had the problem and open up the event log and find out what errors posted in there and that may give you a clue as to the problem. Also check the event log on the computer the printer is hooked up to.

Usually if you have a NIC just dumping packets around you will see a ton of activity on the indicator LED's on your switches or router.

Are the printers hooked directly to the network or through print servers? You could have a bad print server if that is the case.

 

[bluegreenturtle]

Thanks for the reply.

Printers are all stand alone TCP/IP but they are installed and in the directory of the DC.

I may try to reinstall the drivers - hitch is that I am remote to the office - I don't want to go reinstall all the drivers on the workstations because i can't get to some of them. Hopefully installing on the server alone might clear up a dodgy driver?

I am not using the DC for DHCP for any reason...is that better than the router? In general is it better to let the DC do the DHCP than a router? +/- ?

They are still having the problem...it mostly seems to be that they are using something like illustrator, or powerpoint, or cad, and open the print dialogue and it freezes and they have to close the program.

UPDATE: Users seem to think it is definately tied to printing. Bad behaiviour only starts after a print dialogue is opened. STUMPER: this includes printing to PDF, not just network printers.

 

[GreyMittens]

If you haven't already, try looking for new drivers. Also, just for the fun of it, try changing the print processer from RAW to EMF.

 

[OdiN]

Originally posted by: GreyMittens
If you haven't already, try looking for new drivers. Also, just for the fun of it, try changing the print processer from RAW to EMF.

Also what some printers may need is to be set to LPR with a queue name otherwise as RAW they will print erratically. Depends on the brand, etc.

 

[OdiN]

Originally posted by: bluegreenturtle
Thanks for the reply.

Printers are all stand alone TCP/IP but they are installed and in the directory of the DC.

I may try to reinstall the drivers - hitch is that I am remote to the office - I don't want to go reinstall all the drivers on the workstations because i can't get to some of them. Hopefully installing on the server alone might clear up a dodgy driver?

I am not using the DC for DHCP for any reason...is that better than the router? In general is it better to let the DC do the DHCP than a router? +/- ?

They are still having the problem...it mostly seems to be that they are using something like illustrator, or powerpoint, or cad, and open the print dialogue and it freezes and they have to close the program.

UPDATE: Users seem to think it is definately tied to printing. Bad behaiviour only starts after a print dialogue is opened. STUMPER: this includes printing to PDF, not just network printers.

As for DHCP...the DC is there to manage client PC's and well for me it's pretty much standard operating procedure to let it do DHCP. You can let the router do it...it doesn't really matter I was just curious if you had a specific reason for using the router to do so.

Note my post about LPR/Queue name.

Also try installing one to a workstation you can get to as a local printer (instead of going through the network) and see what happens then.

The printers are standalone meaning the print server is integrated? It's not a seperate box or one of the JetDirect addin cards? A suggestion is to run a cable tester on all the printer cables to see if there is any issue there. Also try unplugging all but one printer and try to print to the plugged in one and see if there is a problem. If no problem, plug one more in and try it until you plug one in and it causes the lockup.

Without more information I have no more ideas at this time.

 

[ScottMac]

It sounds like the print queue is on the System drive, and is expanding (plotters, CAD = fairly large print jobs) to the point of choking the disk.

I'm not sure if MS ever did anything about that "minor" flaw to their NOS ... Print queues on the system disk have got to be one of the stupidist design screw-ups of all time.

Check for available space on the system drive, check the size of the print jobs, and guess about how many jobs are likely to be enqueued concurrently .... keep in mind that it's a good thing to have at least 10% of the system drive available (as a *WORSE CASE*) at all times. If you're near, at, or less than 10%, you have a fairly critical situation.

If you run out of drive space (on the system drive), MS NOS will eat itself.

Good Luck

Scott

 

[bluegreenturtle]

All, thanks.

Scott, thanks - this is an excellent suggestion and one that I had overlooked. There are only 250mb left on the system drive of the domain controller, which is hosting the print que of some of the printers. (some of them do indeed have dedicated hardware rips and print servers) The thing is...it's been like that for years and there wasn't a problem...however it's a good suggestion and I will explore that first. I'm not sure it explains the crashing router though, or the fact that the user's computers become basically useless after this event (printing?) happens.

 

[OdiN]

250MB...wow. Small changes to the paging file and that will be used up easily....it really needs several GB free...not just for this printer problem but say if you were running exchange and the drive filled up? Bad things happen.

 

[ScottMac]

As previously mentioned, 250M is essentially a full drive, especially for a service platform.

That's less than the average thumb drive these days ... newer digital cameras have more storage that your server.

You can verify by running Ethereal on one of the workstations that's "doing some work" and start a capture when things start to slow down. What you are likely to see is traffic from the server that is essentially saying "I have your request and I'll process it, but I'm busy"

IMHO, it's time to weed out unecessary files and look to increase your capacity.


Good Luck

Scott

 

[bluegreenturtle]

The server has much much more but unfortunately when the RAID was originally set up they only gave the C partition 4 gb. Unfortunately there is not really anything on there that doesn't HAVE to be on there - I cleared out enough to get it up to 430mb (10%). Fortunately there is NOTHING running on that DC like exchange or anything that varies it's space. I will experiment with moving a partition that is on the same RAID array as the C:, then expanding the C into that space using a partition manager. Paging file is on another drive already.

 

[Zstream]

Originally posted by: bluegreenturtle
The server has much much more but unfortunately when the RAID was originally set up they only gave the C partition 4 gb. Unfortunately there is not really anything on there that doesn't HAVE to be on there - I cleared out enough to get it up to 430mb (10%). Fortunately there is NOTHING running on that DC like exchange or anything that varies it's space. I will experiment with moving a partition that is on the same RAID array as the C:, then expanding the C into that space using a partition manager. Paging file is on another drive already.

What is your printer setup like? Printer spooler etc...

 

[bluegreenturtle]

Thanks guys. I think the problem is fixed. I think it turned out to be a combo of the low system drive space on the DC and print drivers that somehow got corrupted. I did my best to increase space and replaced the driver and complaints are gone from staff.