topic Re: Suspect Network Choking in Operating System - HP-UX

Suspect Network Choking

Richard Ace — Tue, 31 Aug 2004 10:25:05 GMT

Hi

Can anybody sugguest how I go about checking the load on the network.

My problem is that every Sat at 10:15 ish users get slow responses retrieving images and Docs over the network and then they stop completley. About 30 mins later they are fine and it rectifies it self. I beleive the network is being chocked at that time. I need to prove that it is the network and whos , our network or the clients network. I have check for any jobs running our end and have sanity check the servers in question.

What can I run at that time to check.

nettl ???

Any sugguestions

Cheers

Rich

Want some points

Re: Suspect Network Choking

Sundar_7 — Tue, 31 Aug 2004 10:27:26 GMT

Yes you are right on. run nettl with full logging or you can download ethereal from the net and install in the system.

Re: Suspect Network Choking

Richard Ace — Tue, 31 Aug 2004 10:38:03 GMT

How do I get the nettl monitoring the correct thing. If I do a full it will produce a large file. Also I think you can predefine the size of file you want so you do not blow the file system?

How do a full monitor ? Do I select the lan card on the associated server I am on.

I presume this will monitor all traffic to and from the server?

I am not to sure once I have the log file, how to weed out the info I need.

I think nettlfrmt or something like that.

Rich

Re: Suspect Network Choking

Sridhar Bhaskarla — Tue, 31 Aug 2004 10:58:23 GMT

Hi Rich,

Interesting thing about this type of issues is that the network bottleneck could be anywhere starting from within the system, it's interfaces and all the way in the network pipe to the end user.

To eliminate the system problem, I would try setting up a test station within the same network and then try downloading the images and Docs. If the response is slow, then I would look at the local switch and the interface. If the response is normal, then obviously the problem is beyond your local switch.

If it is a patched 11.0 or a 11i, then you can use 'nettladm' to configure nettl. ethereal can be downloaded from our HP's porting center. Both can only give a snapshot of what's happening. Ethereal can also give you the bandwidth utilization. If you have measureware/glance installed, you c an see the network stats like InputPkts/OutputPkts per interface.

-Sri

Re: Suspect Network Choking

Sundar_7 — Tue, 31 Aug 2004 14:13:05 GMT

Rich,

You dont want to keep nettl running at all time with full logging.

Start the nettl via cron about 1 hour before the time you are interested in and stop the logging about 1 hour after.

You can define the maximum size of the log file in /etc/nettlgen.conf file.

man nettlgen.conf file for more info

nettl -traceon pduin pduout -entity all -file /var/adm/trace

The above nettl command will enable the trace for the in and out PDUs and log the trace in /var/adm/trace.TRCX file

You can use netfmt to view these log files.

-- Sundar

Re: Suspect Network Choking

Jeff Schussele — Tue, 31 Aug 2004 14:34:39 GMT

Hi Richard,

As others have noted trying to collect stats on the system can be problematic at best & detrimental at worst. Plus it doesn't really show what's happening on the entire segment anyway.

Best place to collect the network performance stats would be on the first-hop router from this system. If you have a network team request they set up the router to collect these stats on demand - i.e. when the users see the slowdown, the network team should enable the stats collection until a little while after the performance returns to normal. Stats should also be collected - if possible - from the switch the system is directly attached to. This could point out a network config problem that only rears it's head under load. Or even a marginal port/cable/NIC that's fine until the load goes up.

My $0.02,
Jeff

Re: Suspect Network Choking

Ron Kinner — Tue, 31 Aug 2004 20:23:39 GMT

Turn on SNMP and then run MRTG. It won't eat up all of your memory and it will give you pretty graphs of the traffic on each interface and it will also gladly talk to any routers you have in the network so you can see where the bottleneck is. Runs on UNIX and on Windows.

http://mrtg.hdl.com/mrtg.html

Ron

PS. Sounds like some computer is probably doing an automatic backup to a tape drive every Sat at the same time.

Re: Suspect Network Choking

Richard Ace — Wed, 01 Sep 2004 02:18:23 GMT

Thanks Peeps for your time.

It does sound like someone may be doing a backup aty the same time. Hmmmmmmmmmm. Not on the Unix servers though. Might by the clients NT Team.

Cheers

Rich

Have some point for you trouble ;-)