This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Intermittent Network Slowdowns

andy_roth over 2 years ago

We have a standard Windows network. 11 servers, SQL, Domain Controllers, Remote Desk Server, SQL based MSI system, Symantec Endpoint Protection, Wireless access points for laptops and phones. Windows 7 pcs upgraded to Windows 10. 40 printers of one sort or another. 60PCs.

Today one user got a trying to connect error when saving an estimate in the SQL based MSI system and he also stated his Outlook was trying to connect. We have a few MACs that connect to the RDS server to get to windows files.

I have Orion with NTA, NPM & SEM.

I have benn letting them run and not using them to diagnose what my be happening.

I have a time that this event took place today but need some help trying to find what may have caused it.

I have a SQL guru looking at SQL setting.

Parents

0 KMSigma.SWI over 2 years ago

Without knowing the actual scope of where the "Trying to connect" error took place, there's nothing concrete we can help pinpoint.

However, if you aren't already monitoring your servers with NPM (at least for CPU, Memory, and Interfaces) and collecting NetFlow for NTA between the various parts of your infrastructure, then you are doing yourself a disservice.

Insofar as SEM goes, it would be worthwhile to send the Windows Event logs from your various servers to Security Event Manager. It can help you understand what's happening with each of them by collecting all of the data in one place and seeing if there are any commonalities with the information.

For NetFlow data, I'd pull information from the routers and build "NTA" Groups for the various IPs (SQL Servers, RDS Server, RDS VMs, Domain Controllers, etc.) to see if there's specific data types TOS, Ports, Applications, etc.) moving between them.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 KMSigma.SWI over 2 years ago

Without knowing the actual scope of where the "Trying to connect" error took place, there's nothing concrete we can help pinpoint.

However, if you aren't already monitoring your servers with NPM (at least for CPU, Memory, and Interfaces) and collecting NetFlow for NTA between the various parts of your infrastructure, then you are doing yourself a disservice.

Insofar as SEM goes, it would be worthwhile to send the Windows Event logs from your various servers to Security Event Manager. It can help you understand what's happening with each of them by collecting all of the data in one place and seeing if there are any commonalities with the information.

For NetFlow data, I'd pull information from the routers and build "NTA" Groups for the various IPs (SQL Servers, RDS Server, RDS VMs, Domain Controllers, etc.) to see if there's specific data types TOS, Ports, Applications, etc.) moving between them.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 andy_roth over 2 years ago in reply to KMSigma.SWI

Thanks. I there are a lot of possibilities to sort through and it's hard to these things. The first dart I'm going to throw at it is to

set the application folder on all symptom workstation to exclude from Anti-Virus. The application manufacturer suggested it may be a drop of service which the antivirus may be causing. The error leaned that way. Next I will try your suggestions.
Cancel
Vote Up 0 Vote Down

Cancel