File server : where does the IO come from ?

I need to know which users are writing/reading much data on the shares on my file server (windows 2003).  My server is really slow from time to time and I need to know who is copiing or synchronizing his files on the server when the server experiences some slowness (CPU and memory are OK).  Disk reads and writes are high (so is disk queue length), but I just don't know who are causing it.
Would like to use perfmon for that but didn't find the performance counters for that.  If another tool is necessary, which one and how ?
mfecteauAsked:
Who is Participating?
 
JapyDoogeCommented:
Maybe you can try to install and run Internet Traffic Agent on your fileserver (or a testserver first).
Don't let the name mislead you, it also logs LAN traffic by IP and Hostname.
Download a 14 day trial here (should be enough to just find the cause): http://www.flexbyte.com/internet-traffic-agent/
Also check out the screenshots.

Eventually you can use psloggedon from the SysInternals PsTools package to see what user is logged on at what machine. Run it as domain administrator using the following syntax:
psloggedon -m \\computername_or_ip

Good luck!
0
 
wellholeCommented:
Maybe this will help?

start > control panel > administrative tools > computer management > system tools > shared folders > open files
0
 
mfecteauAuthor Commented:
There`s so much files opened that I could not see who doing the most IOs.  Besides, if a file is open, it doesn`t tell if that particular file is doing a lot of IO.
0
 
JapyDoogeCommented:
You can use Sysinternals' File Monitor for that, or the newer replacement called Process Monitor.
Also see: http://74.125.77.132/search?q=cache:SgDgi24Bz7gJ:technet.microsoft.com/en-us/sysinternals/bb896642.aspx+File+Monitor+by+Sysinternals&cd=1&hl=nl&ct=clnk&gl=nl (Google Cache URL because the page at Microsoft was no longer available).
0
 
mfecteauAuthor Commented:
Thanks JapyDooge,
Unfortunately, it`s a mess to use this tool for the purpose that I have.  On my file server, there`s so much reads and writes.  Filemon (or Process Monitor) shows each reads and writes individually and there`s hundreds and hundreds showing each seconds.  I cannot get a big picture of who is using the IO the most.  I have hundreds of users using the file server at the same time  ...
I need to have a tool showing the number of IO (reads/writes) per second each user is doing in real time (perfmon doesn`t seem to do that, or maybe I'm mistaken).
If it`s not possible to do it because there`s no way a file server could tell IO by users, then another way could be to detect the IO by directories on the share.  For exemple, I have the My Documents of users redirected to the Documents share :
\\filesrv01\Documents$\john.doe   -> number of IO/s on this directory and sub-directories
\\filesrv01\Documents$\jane.doe -> number of IO/s on this directory and sub-directories
Does someone have an idea on how to do this ?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.