Network Slow in the Morning ???? Any Ideas?

[burgemaster]

I have for quite some time had reports that the network is very slow in the morning?
They report that logins are slow and browsing mail etc is slower than normal.

I have checked:
there are no backups still running
There arent a huge amount of staff / students all loggin in at the same time
None of the network cards on the servers are hitting anything over about 3%
Sophos / WSUS is not downloading updates

Pretty open question but does anyone have any ideas why "The Network" would be slower in the morning?

[tmcd35]

Is Sophos running a scheduled scan? We get something similar here with Kaspersky and teachers laptops. They don't run the scan at the scheduled time because they weren't turned on. They are turned on for the first time for Lesson 1 and boom the AV kick in and starts it's scan. Of course the teacher doesn't know/realise what is going on and just complains that the computer and/or network is running slow.

Either that or the Russians have installed some spyware on your network. Maybe a spambot or two hard at work or half the worlds porn content being P2P'd through.

[nephilim]

have you got a loop back in a switch somewhere? that can cause a broadcast storm and slow the network considerably.

[burgemaster]

Is Sophos running a scheduled scan? We get something similar here with Kaspersky and teachers laptops. They don't run the scan at the scheduled time because they weren't turned on. They are turned on for the first time for Lesson 1 and boom the AV kick in and starts it's scan. Of course the teacher doesn't know/realise what is going on and just complains that the computer and/or network is running slow.

Either that or the Russians have installed some spyware on your network. Maybe a spambot or two hard at work or half the worlds porn content being P2P'd through.

Thanks, will double check when it next reported. Maybe its because they have forgotten how slow the school machines are after using there nice new home computers.....

[burgemaster]

have you got a loop back in a switch somewhere? that can cause a broadcast storm and slow the network considerably.

Thanks, All our switches are managed procurves, Procurve manager and error logs dont suggest a loopback, but wouldnt rule out a teacher plugging a network cable in during there morning routine!!

[Dos_Box]

Perhaps it is just the perception of being slow. There is also the possiblity that whilst the netwrok may be reported as being fine the disks on the servers are actually working quite hard reading\writing which also may be the cause of a slowdown.

[pete]

Is it every teacher?
Or just some?
Is there a common denominator?
Is there a dodgy .msi pushed out that can't install correctly and keeps trying to reinstall on boot?

[Rydra]

Also consider, it's just what happens with a computer when you turn it on.

Consider a standard/normal computer.

When you first turn it on....
-Usual hardware startups etc, check any USB devices that might be plugged in.
-Fire up windows systems it's running, including messenger
-Windows checks for updates
-Adobe, Messenger, Real player, google toolbars, Itunes/quicktime, and often others startup their 'quick loaders' or tray icons.
-Above programs goto the internet to check for updates
-Most AV have scans that check the startup objects that are checking all of these one by one as they start up
-AV goes to talk to the world to check for updates

In the meantime, the impatient user is opening outlook, SMART software, a web browser to check their personal mail or facebook quickly before the kids get in, Word or excel for the first lesson, and for some, your registers program.

Add into that, 1-200 people all trying to access something from the server, be it their login profile, or their documents/emails. Each request might only bew a few bytes, but each one is a request on the hard drive(s) that it can only access 1 item at a time per drive.

And users wonder why the computer responds slowly in the first part of the day?