Intermittent Network Slowdowns

We have a standard Windows network. 11 servers, SQL, Domain Controllers, Remote Desk Server, SQL based MSI system, Symantec Endpoint Protection, Wireless access points for laptops and phones. Windows 7 pcs upgraded to Windows 10. 40 printers of one sort or another. 60PCs.

Today one user got a trying to connect error when saving an estimate in the SQL based MSI system and he  also stated his Outlook was trying to connect. We have a few MACs that connect to the RDS server to get to windows files.

I have Orion with NTA, NPM & SEM.

I have benn letting them run and not using them to diagnose what my be happening.

I have a time that this event took place today but need some help trying to find what may have caused it.

 <Createdatim>2021-10-14T08:17:44.447-07:00</Createdatim>

I have a SQL guru looking at SQL setting.

Parents
  • Without knowing the actual scope of where the "Trying to connect" error took place, there's nothing concrete we can help pinpoint.

    However, if you aren't already monitoring your servers with NPM (at least for CPU, Memory, and Interfaces) and collecting NetFlow for NTA between the various parts of your infrastructure, then you are doing yourself a disservice.

    Insofar as SEM goes, it would be worthwhile to send the Windows Event logs from your various servers to Security Event Manager.  It can help you understand what's happening with each of them by collecting all of the data in one place and seeing if there are any commonalities with the information.

    For NetFlow data, I'd pull information from the routers and build "NTA" Groups for the various IPs (SQL Servers, RDS Server, RDS VMs, Domain Controllers, etc.) to see if there's specific data types TOS, Ports, Applications, etc.) moving between them.

  • Thanks. I there are a lot of possibilities to sort through and it's hard  to these things. The first dart I'm going to throw at it is to

    set the application folder on all symptom workstation to exclude from Anti-Virus. The application manufacturer suggested it may be a drop of service which the antivirus may be causing. The error leaned that way. Next I will try your suggestions.

Reply
  • Thanks. I there are a lot of possibilities to sort through and it's hard  to these things. The first dart I'm going to throw at it is to

    set the application folder on all symptom workstation to exclude from Anti-Virus. The application manufacturer suggested it may be a drop of service which the antivirus may be causing. The error leaned that way. Next I will try your suggestions.

Children
No Data