slow server

[z4ydi]

Our server performs very slow sometimes takes ages to do any thing at all. When you open the task manager there are only 8 processes running and the CPU shows 10 to 20% as soon as you launch internet explorer it jumps to 95 to 99% and works very slowly. in task manger on the performance tab the PF (page File Usage is showing 415 MB to 420MB but the PF graph does not show anything it is completely blank). We have Sophos running and I installed Spybot to check for worms, there are no viruses or anything. The spec of the server is as follows:

• Intel(R)Xeon CPU 3.00GHz,
• 2GB of RAM
• 80GB hard drive partitioned to 2 with (30GB For the C drive where server 2003 is installed)

There are only 4 software packages installed on this server:

1. Speed Step
2. Edixcel Online Testing software (which came to a halt last Thur because the server was performing slowly)
3. Office
4. Sophos

Please let me know if you have a clue why this may be happening as you can see the spec of the server is not too bad.

thanks

[Ric_]

Firstly... was this server configured using Learning Network Manager? (If not it is in the wrong thread and I will move!)

Secondly, why do you have Office installed on a server? (seems a bit pointless unless it is a terminal server).

Finally, is Sophos set to just run as a scheduled task? You shouldn't need to run an on-access AV app on a server since any files travelling to it should be scanned on your clients before they are copied.

It is also worth checking things like file indexing (if you don't need it, turn it off!)

That server should be more than capable... I run the Edexcel stuff on a PIII with 1GB RAM!

[dhicks]

the CPU shows 10 to 20% as soon as you launch internet explorer it jumps to 95 to 99% and works very slowly.

What does do disk and network usage readouts look like when this is happening? Is Internet Explorer doing something odd with its cache, perhaps (tried emptying it?)? If you install wireshark or similar to monitor network traffic, do you see anything odd when you start IE (try setting its homepage to blank page, then see if you get any network traffic when you start it up)?

80GB hard drive partitioned to 2 with (30GB For the C drive where server 2003 is installed)

This won't produce great performance - your single harddrive will constantly be seeking back and forth between partitions to deal with requests from the OS and requests for files. Again, look at the drive usage stats.

Edixcel Online Testing software (which came to a halt last Thur because the server was performing slowly)

Sophos

Sophos has an on-access scanner, so whenever something is loaded off the harddrive it is scanned... What happens if you turn the on-access scanner off? Just have a scheduled scan once a day or something.

--
David Hicks

[z4ydi]

The server is built by Learning Network Manager. I have disabled the Sophos on access scanning but the problem is still there. it is not only internet explorer that causes the CPU usage to shoot up it launching any application or windows explorer causes the CPU to reach 90 to 100% used

[dhicks]

Is it feasible to take the server down for a while - can you wipe it and reinstall Windows and your software? Switch out the harddrive with your data on for a new one - 80GB drives are cheap (maybe replace with a small fast harddrive for OS and bigger for data?).

Could the problem be the processor - is it overheating? Anything on your system tell you the CPU temperature?

--
David Hicks

[z4ydi]

i have 20GB free on c drive and 30GB free space on D drive, so the hard drive usage is not that much. i havent got anythign install to indicate the CPU temprature, can you suggest one.

[Ric_]

Do none of the processes show high CPU/memory usage in Task Manager (make sure you select 'processes from all users')?

[z4ydi]

attached is the cpu and memory usage on task manager[ATTACH]graph.JPG[/ATTACH]

[Ric_]

IMHO it looks like a combination of Sophos going off on one (as it sometimes does) and a leaky service (see services.exe).

I'd recommend removing and re-installing the Sophos client to make sure it is bang up to date. Also have a quick scan through the services running on your machine and see if anything is running that shouldn't - perhaps a remnant from an uninstalled program?

[vikpaw]

I've found that the Sophos Router service can sometimes go haywire, and disabling it eases things. Not sure what the long term solution is.

also, recently, the savservice though not taking up too much time was crippling a users logon time, killing the process resolved the issue, but it turned out to be a mixture of that and a dodgy network card.

are there any links on the server that are now redundant, i've found that even desktop shortcuts that link to old servers can often cause the system to slow down if they are clicked or called latently.

please repost a better image of process list, with columns widened, there seem to be a shed load of page faults which implies the disk is being hammered. i can't read it well, but something is getting 176 million!

[dhicks]

i have 20GB free on c drive and 30GB free space on D drive, so the hard drive usage is not that much.

No, I meant is the easiest option simply to nuke the machine and re-install Windows rather than use the subtle find-the-problem approach :-)

i havent got anythign install to indicate the CPU temprature, can you suggest one.

A Google search for "cpu temperature monitor" turns up "Core Temp", a freeware application.

What do you use Winlock Pro for on your server? Its process (WLApply.exe) seems to be generating a lot of page faults.

Do you have any idea what the overall disk activity is like at the same time as all that processor activity? Are all those page faults thrashing the harddrive?

--
David Hicks

[z4ydi]

I have uninstalled Sophos and the performance of the server picked up it is 10 times better but the CPU performance still shoots up to 90 to 100%. I believe the svchost.exe process corresponds to sophos, since i have uninstalled sophos why is the process in the process list of task manager furthermore taskmanager.JPG i opened Services and noticed that the Sophos Anti-Virus and Sophos Anti-virus status reporter services are still running and shows started why is that? sophos does not exist on this server.

[Geoff]

Svchost is actually a container for many DLL based services. So it isn't the problem, it is more likely that one of the DLLs being run is the problem. You can get a breakdown of what SvcHost is running by using the following command:

tasklist /svc /fi "imagename eq svchost.exe"

[z4ydi]

I have run the comand and this is what it shows, I dont know what to look in to from here.svchost.JPG

[Geoff]

You need to run process explorer as this will tell you the PIDs of the various svchost processes.

http://www.microsoft.com/technet/sys...sExplorer.mspx

Then you can match these up with the relevant services svchost is running. After that, it's just a case of disabling services until the problem goes away. I'd start with third party non-Microsoft services first as they are obvious culprits.