NTFS master file table getting full?

[drag]

We have a w2k server we use for file sharing over appletalk and smb with a bunch of mac computers. Now it is giving us unholy fits, extremely slow and after a days of usage it begins to drop connections...

Now I defragged the harddrive and it was getting pretty bad in terms of fragmentation, but I have this question..

now the partition we use for sharing files is only about 53% full right now (currently 48% fragmented even after a defrag on saturday), but the Master File Table (MFT) is running at about 88% in use.

Some reason this doesn't seem to be right, does the mft table grow to meet the requirements of it's file system or is it finite size? If it is finite, could the numurous hidden files set up by the macs be a culptrate in filling up the mtf, therefore making the windows server struggling to find space when uploading files, even though there is plenty of space?

I set up a old (read ancient pentium 133) server with linux to play around with in my spare time. I put samba on it and tested that out and the macs seemed to like that alot so I know it ain't the network.

 

[drag]

Well I guess the mtf is dynamicly assigned... sort of.
It can get bigger, but not smaller, so 88% percent usage is normal I guess.

But I don't know what could be causing the problem. It's windows 2000 with upto sp2 and all the hotfixes, and the macs are all 10.2.4. They use appletalk and smb to file share. first they were using appletalk, but we thought that that was causing to much network overhead, so we tried to use smb and that seemed to help out for awhile.

It's getting pretty silly, a 1mb file shouldn't not take 5 minutes to upload on a 100mb ethernet network. The file server is not critical, it's more of a conveinence for students backing up files, but this is damn irritating for everybody.

 

[prosaic]

Are the Macs having any trouble seeing any of the files? How big is the volume, and what is the total file count on it? I seem to remember something about AppleTalk network integration supporting a file protocol that only allows 4 gigabyte volumes and somewhere around 60,000 files. Could your problem be related to this limitation?

Just a question from someone who has never had to support Macs...

- prosaic

 

[mikecel79]

I would first start by ditching Appletalk unless you have some legacy application that needs it. SMB is much faster than Appletalk will be. OSX 10.2 has native support for SMB doesn't it? That should help out some.

Now when someone is copying a file to the server what does the performance monitor look like on the server? Is something gobbling up the whole processor? Is the disk going crazy? Is it out of memory? Setup a Perfmon with CPU activity, Memory Pages/sec and Physical Disk uasge. See if any of them spike when copying files.

Second what are the specs on the server and how many Macs are attaching to it? Is this a RAID array? JBOD? Or just a single drive? Does the machine have trouble copying files from one part of the drive to the other?

I'm no expert by far but I think I can help you out some.

 

[Lord Evermore]

The MFT grows to whatever size is needed. However it can get fragmented. Many defrag utilities don't defragment the MFT, including the built-in Win2k defrag, because it has to be done during bootup before the OS is fully loaded.

The only one I've found that specifically defrags the MFT and directories is the full DiskKeeper, which Win2k/XP's defrag is based on. Unfortunately it does only do that type of defrag on reboot, so a server that's always on won't be able to make use of it unless you reboot. But defragging it MIGHT help with overall performance. I doubt that the MFT would result in slow throughput such as you're getting. You might want to set up a network monitor to see how much traffic the server is pushing through, perhaps there's something running on it you don't know about?

Just for general NTFS performance: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/scriptcenter/scrguide/sas_fsd_xdvz.asp

Note the one about reservation space. You probably don't need to bother with that, though many might think you do (it is often suggested). Reserving a quarter of a volume does mean 1/4 of the partition size, so that'd be 5GB of unusable space on a 20GB partition, even if the actual MFT is only using 35 to 40MB. My MFT at the moment is 35MB, and is 65% full. Even if you reserved only one-eighth of the volume, that'd still be 2.5GB of space reserved, and that's the lowest setting possible. I think Microsoft wrote that guideline ('relatively few files') way back when a 1GB drive was the latest thing, so 1/8 didn't seem like much; odd that they haven't changed the wording or modified the reserved space.

 

[Panther505]

What type of HDD are you using? Have you looked at the Event log to see if you are getting DMA or File locking error? If you can watch the server and upload a test file you could try bringin up the taskmanager and look at the CPU/System overhead when copying a file to the server and that may tell you something.

Are you using hubs or switches? Also is this a recent development and if so hopefully you keep a log of the updates that you do(you could back off of the most recent updates and see what happens)?

Have you installed this Patch as it may be causing the problem per the performance issue that is being seen on XP...


Edit to fix the link from the quick reply

 

[Lord Evermore]

Grrr. Ignore most of the stuff I mentioned about the MFT zone reservation. It only applies to partitions you create after the setting is changed. The default is already the lowest setting. But some people still make recommendations to increase that on "tweak" sites.

 

[drag]

So you guys think that the harddrive could cause such slow performance to cause smb and appletalk to drop connections when uploading files bigger then 7 megs or so. It's getting realy bad. We had had sime file corruptions but after studing it for awhile we realised most of came from student disconnecting from the network before the painfully slow copying process would finish.

Ya unfortuanatly we have to use appletalk for some legacy crap. At first i thought it could be appletalk crapping out the network since we have something like 30 or macs on this lan and appletalk was never realy designed to handle that and it was filling it up with to many collisions and stuff. It couldn't just be appletalk since smb is slow as all get out too.

But it can't be network performance due to no bandwidth. Since samba on a test linux server works just great.


Here is some stats:
server:
windows 2000
5.0.2195 service pack 2 build 2195
dell power edge 5200sc
dual 1.4 gig pentiums
gig or ram, currently 781 megs avaible
I am currently defragging and cpu is around 30 percent usage.
It's got a seperate 3 gig partition set aside just for the page file, and has another 7 gig for the system files
the drive in question is a 70 gig scsi harddrive...
the partition for students is a 26 gig partition at 47% usage and 18% fragmentation (currently defragging)
The server was never ment for full-scale file server, just a place to backup and make it conveinent for file transfers, but has been used heavily until it started crapping out

Network:
a 100meg ethernet twisted pair cat 5+ (not quite sure what is the exact number, one of those im-between generic cat 5 and cat 6 things) Running thru a couple switches I am not allowed to mess with. All private addresses.

Client computers:
Mac 10.2.4 (not going to 10.2.5 until we figure out what's going on) on some nice G4's (gig ram, dual 800mhz, super drives, high quality definition 17 inch crt's)
Also 9.22 for classic mode for legacy (mostly quark express) But classic is kept turned of until needed.
We use microsoft's MUAM for authentification with the domain.


Any Ideas?

 

[glugglug]

Make sure the switches actually are switches

If they are hubs, the performance will go in the shitter particularly if any of your NICs are configured to use full duplex. Check the properties on your network card and confirm you have it set to half duplex if using a hub. Full duplex is fine if your switch actually is a switch... in fact its better.

 

[mikecel79]

Ok so you have 30 Macs connected to this one server. Are they all hitting the server at the same time? Or does this even happen when just a single machine is copying to the server. If this is occuring when multiple clients hit the server I can see one of 2 things are happening. Either the hard drive can't keep up with all the requests or you are saturating the NIC. Since it's only 100Mbit it'll only take a few machines hitting it at once to overwhelm that NIC. Since your saying it is dropping connections I'm willing to bet this is what is happening. Setup Perfmon and the Win2k Network monitor and log it all to a file. Check to see if your saturating the NIC or not.

 

[Lord Evermore]

No matter what the NICs are set to, they'll only work at the setting of the slowest device on a hub, and only at half duplex, hubs don't support full duplex. If you manually set it to anything else, the NIC just won't work. If one is in 100Mbps mode, they all are.

Network bandwidth may not be an issue, but that particular server's bandwidth might be. If something is killing the Win2k install's networking, that might be the issue.

 

[drag]

Na. hehe I KNOW they are switches. They are running in full duplex mode with each MAC and server getting their own connection to the switch. All the Macs are nice G4's and are capable of 1Gb operation, even with a few set at 10 Megs the rest will run at 100 due the the switches and having there own private line, they are set to detect automaticly.

i know that the network is not getting saturated. (my first guess due to appletalk, but it's actually behaving itself) I set up my little secret (well only sort-a secret) Linux server to serve smb (not appletalk) and even though with it's ancient 10mb card it was able to transfer files with only a momentary pause while the w2k server was dropping connections in the other room.

I already did netmon.exe thing and did a few captures, one of the first things I did. Although strangly the majority of the packets got lost in netmon's buffer! I don't know what to think about that, out of 8000-9000 packets it only captured 1000-2000 or so. This was during a test were I logged on from a mac and uploaded about 20 megs into the server. after about halfway thru the upload I killed it. I was not noticing any unusuall activities or collisions or dropped packets. (exept of course with the netmon buffer) It was just REALLL slow today, not dropping connections. Defragging the partition seemed to help somewhat.

And unfortunatly before closing up and shutting off all the Mac's I tried just uploading from the last mac before shutting it off. No dice. Still slow as all get out.

It amazes me. At the beginning of the semester everything was working great, we just upgraded to 10.2.4 on the macs and it was working dandy for a long time. Now it just gone to s**t in the past 2 weeks. We were having some problems before that, but we seemed to have resolved that by switching as much as possible from appletalk to smb. The other campus were we have a lot of macs is working 100% wonderful with there windows servers. THey were having issues similar to us here, but they seemed to have fixed it by upgrading the crappy switched with nice new ones (we got them too) and upgrading the server/sharing the load with the old server. They figured the old server was giving fits due to being only quad 233's with 3 mismatched (from different eras almost) scsi raid (raid 5) controllers.

It has to be bad mojo between the w2k and the MACs. That's my guess. Linux to Mac worked fine, Linux to w2k crapped out. W2k to W2k seemed ok, but that was over a wan link and that's always kinda slow. I'll have to try it from a windows box to the server and see if that works fine.

Does it sound like a misconfigured switch maybe, bad ethernet cord? They are probably gonna give the network a good once-over as soon as we get a break.

I was wondering if w2k has had any big advisories about smb or appletalk stuff that I missed or has been convenently deleted out it's knowledge base like many other mac-related stuff, could installing sp3 help out alot in this situation?

 

[Panther505]

If this is recent and only affects this system and you have the 811493 patch on the system.. Try removing this patch. It was originally post on the 16th of April. Supposedly it only has caused an issue with XP's performance but you could remove it and see what happens.

 

[mikecel79]

Alright so you tried all that stuff. But if Netmon isn't catching all the packets then they are dropping somewhere. Now that I think about it we had a similiar problem with a Compaq Proliant ML530.

We needed a second NIC in it so we threw in a 3C905C that was brand new. It worked great for about a month but then it would have trouble finding a DC and file transfers were ungodly slow but Terminal Services seemed to work great on it. I ran Netmon and it couldn't capture all the packets but when I would constantly ping the machine it NEVER dropped a packet. We dealt with it for about a year (we hardly transfered files to it) and then I tried replacing the NIC. As soon as I did that it was very fast. No more slow file transfers and it could always contact a DC.

Since you say it's dropping connections try changing out the NIC. I still think it's hardware related.

 

[prosaic]

I didn't see any place where it was said that the server was dropping connections. It was my impression that the students were disconnecting after getting tired of waiting for file copying processes to finish.

drag:

I was wondering if w2k has had any big advisories about smb or appletalk stuff that I missed or has been convenently deleted out it's knowledge base like many other mac-related stuff, could installing sp3 help out alot in this situation?

As I said early on, I definitely remember that Appletalk network integration has problems with large volumes (over 4 gigabytes) and over 60-something thousand files. I'm not dreaming that. I'll try to look it up when I get a chance. The fault has something to do with the Apple File Protocol version that is supported. The 26 gigabyte partition you are using already exceeds the volume maximum. If the number of files located on the partition grew past the file number limit imposed by the protocol I suppose it might cause the symptoms you report, though the main symptom of this problem is supposed to be that various files on the volume can't be seen by Mac clients. That's why I asked about that in my first message.

Regarding the SP level, not only does SP3 itself contain a lot of performance enhancements for server operations, but there are several post-SP3 hotfixes that pertain to both disk and network performance issues. Among those hotfixes are 263939 and 265396. And there are a LOT of post-SP3 hotfixes.

- prosaic

 

[mikecel79]

So you guys think that the harddrive could cause such slow performance to cause smb and appletalk to drop connections when uploading files bigger then 7 megs or so

You've got some good suggestions to try there also. The Microsoft Q article you are referring to is 814211.

 

[drag]

Originally posted by: prosaic
I didn't see any place where it was said As I said early on, I definitely remember that Appletalk network integration has problems with large volumes (over 4 gigabytes) and over 60-something thousand files. I'm not dreaming that. I'll try to look it up when I get a chance. The fault has something to do with the Apple File Protocol version that is supported. The 26 gigabyte partition you are using already exceeds the volume maximum. If the number of files located on the partition grew past the file number limit imposed by the protocol I suppose it might cause the symptoms you report, though the main symptom of this problem is supposed to be that various files on the volume can't be seen by Mac clients. That's why I asked about that in my first message.

I owe you a apology. I don't know how I missed that, I guess since I was tired I just glanced over your post..

That may be causing part of the problem, but since smb is affected in a bad way it can't be all of it. Maybe I'll ask if I can try a different nic in it (I am pretty low on the food chain). Next weekend I'll have a chance to test transfers between two windows machines and hopefully that will narrow down the problem. Right now I am steering towards a network issue, maybe a misconfigured switch or a faulty nic. I don't think netmon should drop several most of the packets it's trying to capture.

That's the tough thing about this sort of stuff, could be several things taking a crap at once

 

[drag]

btw thanks for your help/suggestions

 

[prosaic]

I owe you a apology. I don't know how I missed that, I guess since I was tired I just glanced over your post..

That may be causing part of the problem, but since smb is affected in a bad way it can't be all of it. Maybe I'll ask if I can try a different nic in it (I am pretty low on the food chain). Next weekend I'll have a chance to test transfers between two windows machines and hopefully that will narrow down the problem. Right now I am steering towards a network issue, maybe a misconfigured switch or a faulty nic. I don't think netmon should drop several most of the packets it's trying to capture.

That's the tough thing about this sort of stuff, could be several things taking a crap at once

Heh-heh. Every time I hear about someone owing someone an apology I think of the movie Popeye.

But you don't owe me an apology. Sorry if I sounded testy. I just wanted to be sure that you considered this because I knew that it could cause serious problems. A friend of mine was supporting a newly added enclave of Macs in his university department and ran into the same problem because of the size of the partition he shared for them. The problem got worse as the number of files on the partition grew. The symptom was that some files weren't seen by some Mac clients some of the time. Someone would start a file copy from or to the partiton and the copy process would just wander off into oblivion, kind of like the slow download speed degradation you might see on a wonky dial-up connection during a doomed http download. He also had an issue with the CatSearch parameter, I believe.

I did some research for him and found a reference somewhere (which I still haven't been able to find this time around) about the Apple File Protocol (Is that the right name?) version that was supported by Appletalk integration in Win 2000 Server. I don't think the Microsoft documentation covered it -- that we found the reference in Apple literature. If so, that would explain why I can't find it now. I don't have any such information available to me here.

That netmon issue is interesting. I'd like to try to figure that out, but I'm an archaeologist, not an IT guy. I'm going to stick with rocks, bones, and sticks today.

Good luck!

- prosaic