Need to confirm-interpret some Performance Monitor counter values

We're doing some performance monitoring on our W2K Server because of an issue we have with our accounting software. We get i/o error messages in the application on a regular basis on some PC's, and the software manufacturer says it's probably a bottleneck on our server.  We rather think it's PC related (hardware, application). So we have setup performance monitoring on the server to hopefully find out if the server is the problem or not.

Quick description of the server: Dell PowerEdge 2900 with 2 Quad-core Xeon 2.0Ghz processors, 4Gb Ram, 2x73Gb Scsi 15k rpm Raid 0 for the OS, 4 x 160Gb Scsi 15k rpm in Raid 5 for the Data, 1 hot spare, 1Gb network card, SBS 2003 running Exchange, OWA, File Server, Symantec AV, servicing a total of 20 users, all connected using a 48 port Gigabit switch. We thought this configuration was much more than adequate, and were very surprised at the server bottleneck possibility !

So, following a very good document found in another EE post about troubleshooting performance bottlenecks (, we are tracking the primary performance objets as described in their manual, and there are some counters for which I would have a few questions:

1) Is an interval of 15 secs too small when performing monitoring with counter logs (default = 30?)

2) Network-Bytes Total/sec: shows an average around 240,000 and a max of 14,900,000 on a 1 day period from 07:00am to 07:00pm. The guide says that on a Gigabit nic card, this should not show sustained values over 70-80 MBps. Am I right in interpreting the average number of 240,000 as 0.24 MBps and the max 14,900,000 as 14.9 MBps ? Which would mean that it is way below the 70-80 MB limit ?

3) Do we use the average numbers produced in counter logs when checking if we are going over some recommended limits, or do we have to look at the numbers in real time monitoring on the server ?


Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

I wouldn't waste too much time on the server performance in general as it is very, very unlikely to be a hardware performance problem unless there is an issue with a component.  Verify that both your clients and server are connected at the duplex the switch is expecting.  I have seen machines connect at half duplex to a full duplex port and create similar issues due to the amount of collisions created.  Also, comb the event logs for things like array errors or other indications of hardware failure.  It would probably be good to verify that you are running the latest drivers and patches for both the software and your OS.  

If you do keep poking at the performance monitors look for maximum spikes and sustained maxs.  Averages are mostly useless as they don't show you when you cross thresholds, by how much, or for how long.  Good luck.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.