Poor Active Directory QoE

We have a domain controller that has two QoE Application Avg Response time measures that look like a disaster, SSL and Active Directory. The domain controller is just a domain controller, it's not pulling double duty as a file server or anything like that. From a resource stand point it sits pretty low usage averaging almost zero cpu and 20% memory usage and pretty much zero latency and low network usage. Any thoughts on how to get to the bottom of this one?

Here's some shots of the QoE breakdown for it.

Find more posts tagged with

microsoft active directory

qoe applications

npm qoe

Accepted answers

All comments

sean.martinez

From the chart, it appears the Active Directory is reporting a spike every hour, with a significant spike of 146.99 seconds just after midnight.

You will want to click on the Active Directory to take a look at just this one protocol in detail. In the detail view I would take a look at the Transaction resource (Connections to the system) as well as data volume.

If you see a lot of transaction attempts after midnight, I would check the AD logs for Authentication access & authentication failures; This would require looking at the logs directly, or using your Security Event appliance to check. In Server & Application Monitor you can also setup Application Monitor to check for specific Event Logs based on message or ID.

If Transactions are low, & the domain controller is Virtualized, I would go into the Virtualization and look at the VM, specifically as to VM Latency to the datastore, or the Datastore latency to the host. Windows Updates or other tasks occurring all at one time could be overloading the storage causing delays.

SSL on the Domain controller is more than likely the Certificate Authority for Certificate Enrollment Web Services.

It appears to be pretty constant, so you can just change the thresholds of this protocol to be higher. Go into Settings> QOE Settings> Manage QoE Applications. Select SSL and select Edit, then select Next 2x, & at the Summary, expand out Thresholds and you can Override the default to individually set the Warning & Critical thresholds, or use the Latest Baseline details to set a recommended Warning & Critical based on past polled data.

benny32

I took a look at Active Directory specifically for this machine and here's some more info. I looked at the transactions and they are pretty steady, no spikes at odd times but there is a spike every two hours in application response time. I took a look at disk latency and it's very low. This is an all flash array that this vm lives on so that's not surprising. Here's some more graphs! I'll dig into some system logs as well to see if anything strange pops up there but it doesn't really look like a disk bottleneck at this point.

dfairles

Is something running that pulls the user database every 2 hours? Are you running UDT?

designerfx

my fairly uneducated guess along with this is, could this be AD replication?

benny32

I do have UDT running but I have changed the poll timer to 8 hours. I still see it spike at almost 2 hours on the dot though. As to the replication comment, I don't see this behavior on the other dc which runs the same replication schedule.