Solved

File Server Hangs Multiple Shares/Files Open

Posted on 2007-11-29
13
1,456 Views
Last Modified: 2013-11-25
This is sort of a long shot but...

We recently built a new Windows 2003 R2 Standard server on an IBM server. Dual-Core Xeon 2.66 with 2 GB RAM, 2 x 1.0 Gbps Broadcom NICs teamed for NLB/Fault Tolerance, 2 x RAID 1 - 160 GB Hard Drives.

3 Drives - C:\ - System\OS, D:\ Data, E:\ - External SATA Storage Array (2.8 TB)

There are spread shares on both D:\ and E:\ that users (Windows XP Client workstations) access, about 50 users. The problems is the connectivity is intermittent and it occassionally drops so that when users are saving it takes forever and/or it sometimes "locks" the whole server so UNC browsing and file access is cut off for everyone. Only way to fix has been to reboot.

Contacted Microsoft and they could not find anything wrong. This is, obviously, a big problem as it is a file server. The server is completely updated with all MS patches. An iPerf test from the client workstations to the file server gives an average of 200 MBytes for Transfera nd 180 Mbits/sec.

Event log only shows Errors for the Symantec Tamper Alert (Anti-Virus) due to having the User Hive Profile installed (EID 45).

Any suggestions?
0
Comment
Question by:RTM2007
  • 7
  • 6
13 Comments
 
LVL 35

Expert Comment

by:ShineOn
ID: 20379251
Gee, I HOPE  you don't have NetBIOS/NetBEUI going on...
0
 
LVL 2

Author Comment

by:RTM2007
ID: 20383883
What do you mean? Everything that was configured was installed as default.
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 20384539
What I mean is this question was cross-posted to the "NetBIOS and NetBEUI" zone and nobody should be using NetBEUI any more - and shouldn't need NetBIOS over IP or WINS either, except for the couple of places they haven't taken that out of Exchange Server yet.

Anyway, I have had issues with Win2K3 R2 dropping connections, and have improved the situation by following a couple of KB docs which I don't happen to have quick-and-easy links to (sorry).

The gist, however, is to change the default autodisconnect timeout on both the server and the client.  It involves registry tweaks.   If you don't have a problem tweaking your registry on your servers and client PC's, let me know and I'll try to find those KB articles for you.

Depending on your application mix, you may also be experiencing problems caused by opportunistic locking, in conjunction with the auto disconnect.  You may want to consider disabling opportunistic locking as well, which also requires registry tweaks.
0
 
LVL 2

Author Comment

by:RTM2007
ID: 20384686
ShineOn,
I beleved it may had been related to NetBIOS.. or more correctly WINS as when the server was first setup and the NIC was assigned a static IP, it was not able to be hit by UNC name without the WINS server setting hard coded to the NIC.

If you can send me the links/docs for the autodisconnect/opportunistic locking that would be great, I'll try anything at this point as this is now happening daily where the file server "locks" and drops all connections, but also makes it so that it freezes the user workstations so they can't open anything (not even task manager).
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 20384889
Disable auto disconnect: http://support.microsoft.com/default.aspx?scid=kb;en-us;297684

Note that they confuse the issue by throwing the KeepConn setting for the client in the middle of the registry change for the server side...  The autodisconnect entry goes in the server's LANMANSERVER key and the keepconn setting goes in the workstations LANMANWORKSTATION key.

Configuring Opportunistic Locking: http://support.microsoft.com/kb/296264

Note that the workstation setting is opposite that of the server - the server is "EnableOplocks" and the workstation is "OplocksDisabled" so the workstation's setting should be 1 and the server's should be 0 to disable both requesting and allowing of opportunistic locking.

Hope this helps.

As to the other thing - you shouldn't need WINS and NetBT if you have your DNS configured right...  maybe a topic for another Question?

0
 
LVL 35

Expert Comment

by:ShineOn
ID: 20384962
Note that you MAY see a decrease in performance opening files across the LAN, by disabling oplocks.  Try the disconnect thing first and see how things go.

If the problems don't quite go away after changing the disconnect, but do after disabling oplocks, it may be some 3rd-party tools you might have installed, like an open-file manager  for a backup system, or an antivirus/firewall product masking the "break oplock" event causing it to be mishandled at the server.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 2

Author Comment

by:RTM2007
ID: 20384977
Yes, there is the BrightStor ARCserve Open File Agent (11.5) installed/configured.

As far as AV it is Symantec Anti-Virus 10.x
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 20385077
0
 
LVL 2

Author Comment

by:RTM2007
ID: 20385298
Thanks for the find.

But still does it not sound odd that when the file server "drops" connections it then freezes all network user workstations so they can't even navigate, open apps, even task manager?
0
 
LVL 35

Expert Comment

by:ShineOn
ID: 20385418
Never had that happen with NetWare on the back-end, but everyone seems to think Windows is a superior solution.  Go figure.

It's odd, but my gut says it's got something to do with either the timeout or the timeout in conjunction with oplocks.
0
 
LVL 2

Author Comment

by:RTM2007
ID: 20445168
Symantec Anti-Virus seems to have been the problem.

The AV engine was set to lock network connections rather than log them in regards to tamper alert protection.
0
 
LVL 35

Accepted Solution

by:
ShineOn earned 500 total points
ID: 20451071
In certain cases, it makes sense to do that, but it sounds like SAVCE's sensitivity is set a bit too high, and is "always on."  Don't know if that's true or not, but that's the impression I get from the problems you were troubleshooting, and what the fix was.

Trend will only slow things down network-traffic-wise when it goes into "outbreak prevention" mode, and it only does that when a new threat that hasn't yet been included in the signature/cleanup updates is detected "in the wild."  Seems Symantec should learn a few lessons from their competition.

I'm not the biggest fan of Trend Micro, but I'm certainly no fan at all of Symantec AV - at all.  My firm recommendation would be seriously to consider a different protection suite when license/subscription renewal time comes around.  You could put Trend on your short-list but I've heard good things about some of the other major players, like Kaspersky, AVG, F-Secure, Panda, ESET NOD32, and BitDefender - and don't rule out Computer Associates.  IMHO McAfee has had some issues lately that I don't know if they've overcome yet, to regain the confidence they used to enjoy, but they used to be bigger than Norton/Symantec AV once upon a time IIRC, so you might want to evaluate them too.  
0
 
LVL 2

Author Comment

by:RTM2007
ID: 20458377
Does anyone know where the SAV setting is to lower the sensitivity?

On other servers it seems to have the same problem with Tamper Protection blocking the User Hive Profile cleanup.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
Learn about cloud computing and its benefits for small business owners.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now