Slow files access during 9:00-9:30AM every day

[Michael Tse]

How can i trace out who user access a server shared files on network ?

Some IT co-ordinator disclosed some users who copied a 900MB access file on to server share folder. I can not trace out who access, what time access, and which file on server.

Please advice,

Thanks a lot.

Michael

[Stephen Grimmer]

Auditing might help...

How To Set, View, Change, or Remove Auditing for a File or Folder in Windows 2000

http://support.microsoft.com/default.aspx?scid=kb;en-us;301640&sd=tech

[Michael Tse]

Because i have to trace out who are using that large files in the morning, i don't know where is that large files. If i turn on the auditing on the whole drive C. I'm worry it will affect the server performance.

Do you know any network sniffer program, which can monitor the source and destination, the result is include the network layer and other higher layer (e.g. check out what folder or file is in use.)

[Ivan Ferreira]

One of the best network packet analyzer is ethereal, but you won't know the files of folders accesed.

You should check the performance counters for:

Memory Memory\Pages/sec < 20

Disk Physical Disk\Disk Time < 90 percent


Server Server\Bytes Total/sec If all your serversâ Bytes the network Total/ sec is the same and similar to the maximum network speed, you might need to increase the network bandwidth.

[Antoniov.]

I can just suppose at 09:00-09:30 it's the time when your 1500-2000 user starting their work. Do you have 10Mb network? If true, evaluate 10Mb divided by 1000 user is 10Kb bandwidth. I'm not amazed by performance.
Because your users take about 5-10 second to load 200Kb file, they have 20-40Kb of bandwidth; you can understand there are 250-500 user concurrently.
After initial read, I guess they don't need of read continously this file, so concurrently user are less.

Antonio Vigliotti

[Michael Tse]

The situation is around 250 users access the file and print server files at 9:00 to 9:30am, sometimes is normal, sometimes is not. I would like to find out the root cause and try to fix it. I have installed Network analyzer the frame and packet transmit / receive between the source and destination, even i located one workstation is copy or access a large TCP packet from server, but i don't know what he is accessing. If the problem is a large file access, i can suggest to move it to other BOX (e.g. NAS), but i have no idea now!!

Please advice.
Michael

[Antoniov.]

Michael,
do you confirm your network is 10Mbs ?

Antonio Vigliotti

[Michael Tse]

Yes, access layer is 10Mbs, Dist. and Core is 100Mbs

Thanks,
Michael

[Antoniov.]

Michael,
if you have 10Mbs bandwidth, read my 1.st post. Mathematic is not an opinion.

Antonio Vigliotti