slow server

[z4ydi]

Our server performs very slow sometimes takes ages to do any thing at all. When you open the task manager there are only 8 processes running and the CPU shows 10 to 20% as soon as you launch internet explorer it jumps to 95 to 99% and works very slowly. in task manger on the performance tab the PF (page File Usage is showing 415 MB to 420MB but the PF graph does not show anything it is completely blank). We have Sophos running and I installed Spybot to check for worms, there are no viruses or anything. The spec of the server is as follows:

• Intel®Xeon CPU 3.00GHz,
  
• 2GB of RAM
  
• 80GB hard drive partitioned to 2 with (30GB For the C drive where server 2003 is installed)
  

 

There are only 4 software packages installed on this server:

1. Speed Step
   
2. Edixcel Online Testing software (which came to a halt last Thur because the server was performing slowly)
   
3. Office
   
4. Sophos
   

 

Please let me know if you have a clue why this may be happening as you can see the spec of the server is not too bad.

 

thanks

Edited January 28, 2008 by Ric_
Nasty formatting removed!

[Ric_]

Firstly... was this server configured using Learning Network Manager? (If not it is in the wrong thread and I will move!)

 

Secondly, why do you have Office installed on a server? (seems a bit pointless unless it is a terminal server).

 

Finally, is Sophos set to just run as a scheduled task? You shouldn't need to run an on-access AV app on a server since any files travelling to it should be scanned on your clients before they are copied.

 

It is also worth checking things like file indexing (if you don't need it, turn it off!)

 

That server should be more than capable... I run the Edexcel stuff on a PIII with 1GB RAM!

[dhicks]

the CPU shows 10 to 20% as soon as you launch internet explorer it jumps to 95 to 99% and works very slowly.

 

What does do disk and network usage readouts look like when this is happening? Is Internet Explorer doing something odd with its cache, perhaps (tried emptying it?)? If you install wireshark or similar to monitor network traffic, do you see anything odd when you start IE (try setting its homepage to blank page, then see if you get any network traffic when you start it up)?

 

80GB hard drive partitioned to 2 with (30GB For the C drive where server 2003 is installed)

 

This won't produce great performance - your single harddrive will constantly be seeking back and forth between partitions to deal with requests from the OS and requests for files. Again, look at the drive usage stats.

 

Edixcel Online Testing software (which came to a halt last Thur because the server was performing slowly)

Sophos

 

Sophos has an on-access scanner, so whenever something is loaded off the harddrive it is scanned... What happens if you turn the on-access scanner off? Just have a scheduled scan once a day or something.

 

--

David Hicks

Edited January 28, 2008 by Ric_
Broken formatting

[z4ydi]

The server is built by Learning Network Manager. I have disabled the Sophos on access scanning but the problem is still there. it is not only internet explorer that causes the CPU usage to shoot up it launching any application or windows explorer causes the CPU to reach 90 to 100% used

[dhicks]

Is it feasible to take the server down for a while - can you wipe it and reinstall Windows and your software? Switch out the harddrive with your data on for a new one - 80GB drives are cheap (maybe replace with a small fast harddrive for OS and bigger for data?).

 

Could the problem be the processor - is it overheating? Anything on your system tell you the CPU temperature?

 

--

David Hicks

[z4ydi]

i have 20GB free on c drive and 30GB free space on D drive, so the hard drive usage is not that much. i havent got anythign install to indicate the CPU temprature, can you suggest one.

[Ric_]

Do none of the processes show high CPU/memory usage in Task Manager (make sure you select 'processes from all users')?

[z4ydi]

attached is the cpu and memory usage on task manager[ATTACH][/ATTACH]

[Ric_]

IMHO it looks like a combination of Sophos going off on one (as it sometimes does) and a leaky service (see services.exe).

 

I'd recommend removing and re-installing the Sophos client to make sure it is bang up to date. Also have a quick scan through the services running on your machine and see if anything is running that shouldn't - perhaps a remnant from an uninstalled program?

[vikpaw]

I've found that the Sophos Router service can sometimes go haywire, and disabling it eases things. Not sure what the long term solution is.

 

also, recently, the savservice though not taking up too much time was crippling a users logon time, killing the process resolved the issue, but it turned out to be a mixture of that and a dodgy network card.

 

are there any links on the server that are now redundant, i've found that even desktop shortcuts that link to old servers can often cause the system to slow down if they are clicked or called latently.

 

please repost a better image of process list, with columns widened, there seem to be a shed load of page faults which implies the disk is being hammered. i can't read it well, but something is getting 176 million!

[dhicks]

i have 20GB free on c drive and 30GB free space on D drive, so the hard drive usage is not that much.

 

No, I meant is the easiest option simply to nuke the machine and re-install Windows rather than use the subtle find-the-problem approach :-)

 

i havent got anythign install to indicate the CPU temprature, can you suggest one.

 

A Google search for "cpu temperature monitor" turns up "Core Temp", a freeware application.

 

What do you use Winlock Pro for on your server? Its process (WLApply.exe) seems to be generating a lot of page faults.

 

Do you have any idea what the overall disk activity is like at the same time as all that processor activity? Are all those page faults thrashing the harddrive?

 

--

David Hicks

[z4ydi]

I have uninstalled Sophos and the performance of the server picked up it is 10 times better but the CPU performance still shoots up to 90 to 100%. I believe the svchost.exe process corresponds to sophos, since i have uninstalled sophos why is the process in the process list of task manager furthermore i opened Services and noticed that the Sophos Anti-Virus and Sophos Anti-virus status reporter services are still running and shows started why is that? sophos does not exist on this server.

[Geoff]

Svchost is actually a container for many DLL based services. So it isn't the problem, it is more likely that one of the DLLs being run is the problem. You can get a breakdown of what SvcHost is running by using the following command:

 

tasklist /svc /fi "imagename eq svchost.exe"

[z4ydi]

I have run the comand and this is what it shows, I dont know what to look in to from here.

[Geoff]

You need to run process explorer as this will tell you the PIDs of the various svchost processes.

 

http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

 

Then you can match these up with the relevant services svchost is running. After that, it's just a case of disabling services until the problem goes away. I'd start with third party non-Microsoft services first as they are obvious culprits.

[z4ydi]

But why do you think the 2 services

 

1. Sophos Anti-Virus

2. Sophos Anti-virus status reporter services

are still running and shows started in Services. the reason i am asking is i removed Sophos from the server, sophos does not exist on this server any more yet the services are running

[Geoff]

Have you restarted the server since you 'uninstalled' Sophos?

[z4ydi]

yes I have restarted the server twice. I will do it again now. But once everything comes back to normal shall I go a head with the Sophos installation, if yes should i do anything different, as Sophos was the reason for bringing the server almost to a halt until i un-installed it.

[Freedom]

Just to give you a scenarion with a recent problem of mine.

 

The machine just plain out-rigth was useless - server was completely bogged down with requests and it appeared Sophos was to blame after it half installed an auto-update.

 

After removing Sophos - like yourself it went much better and yes there were still services running to do with Sophos, but seeing as I was reinstalling Sophos I didn't mind.

 

After re-installation I made absolutely sure, as suggested previously, that the on-access scanner was disabled and that a daily scan was run during the night.

 

I also recently had a problem with no access to the server as it was being flooded with network packets

- the culprit - a network cable looped from one port into another

- the worst bit - it was a teacher trying to be tidy!

[z4ydi]

I have reinstall Sophos and the server became very slow again. I have disabled the on access scanning it is still very slow.

[mattx]

Like Geoff already stated, run process explorer - that should narrow down whats causing your problem.....

 

P.S. Its part of the Admin's Admin Bar, see below......

[damienharrison]

Hi, it may be worth having a ready throughThe Case of the Slow System talks you through Process Explorer and the use of it etc.

 

Hope this helps

 

Damien

[mattx]

Hi, it may be worth having a ready throughThe Case of the Slow System talks you through Process Explorer and the use of it etc.

 

Hope this helps

 

Damien

 

Thats one for me to print off and read whilst sitting on the lav......

[damienharrison]

I have had a good read of Marks blogs some quite interesting stuff in their about trouble shooting and the use of the sysinternals tools (helps that he wrote most of them)

 

And Windows Sysinternals: Documentation, downloads and additional resources is always worth checking to make sure you have the latest toys to play with.

[wesleyw]

You might want to look at this script from Sophos another memebr posted it up a while ago this'll get rid of your sophos installs on the server with nothing sticking around

Sophos Offical.txt