Topic: I realy need help. All the traffic of my sme is slow.

[jmarcosm]

Hi,

I have an sme 7.1.3 ,Vectra VL400 , 1 MHz proccessor, ram 512K, 2 3com nics, 2 80 GB hard disk in raid (sme raid) , server and gateway decated, whith 1M cable modem conection, mail server with clamav and spamassassin, 30 users, web mail activated and a wildfire (jabber) server working and an IPSEC vpn connection to another server. Everything was working perfect for about 8 months, but now suddenly all the traffic of my server start to be very slow.

I checked the following:

I connect a windows box directly to my cable modem and all the traffic is very fast as usual. If I reconnect the server the traffic is slow again.

I have changed with no success the 2 nics and also the motherboard. Same situation.

If I use the server to send a file from the internal network to my home directory everything is ok , also If I use the server manager panel every is fast as usual.

If I ping to google I see in the response a delay of about 2500 ms and sometimes 3700 ms!!!! If I ping any site the ms are the same.

Also if I use the traceroute to any server I see long delays (2500 to 4500 )

I already have changed the nics and also the network cables just in case with no result.

I´m not a linux expert so I kindly ask for some help to findout wat is going
on.

Thanks in advance

Marcos Migliorini

[thomasch]

Hi,

One of the greatest sources of frustration for systems admin is to try to isolate whether poor server performance is due to a network issue or problems with hardware or application.

To me it seems like a smeserver network traffic hogs the outbound Cable Modem bandwidth (A Network Congestion)

Try to isolate the problem :

you need sme7admin installed. http://wiki.contribs.org/Sme7admin
See Local Network Load is it normal?

you may want to see the traffic of your lan  
login as root and type : iptraf  
(it's a IP Traffic Monitoring Utility)

Code: [Select]

[root@smeserver /]#iptraf

Check your NIC errors :

Code: [Select]

ifconfig -a
Check ethernet error :

Code: [Select]

ethtool -S eth0
or using netstat :

Code: [Select]

netstat -i
Is it a gateway/routing problem ? using My Traceroute :

Code: [Select]

mtr www.google.com

hope this help

[barame]

Hi thomasch

How do you know these command. I'm read admin manual but I can't see these command.
Any other source.

Barame

[CharlieBrady]

Everything was working perfect for about 8 months, but now suddenly all the traffic of my server start to be very slow.

That usually indicates that something on your network is just using a lot of bandwidth. Likely causes are a virus or trojan-infected PC, lots of use of file sharing applications, or your server being compromised (usually through poor choice of system password or installation of a vulnerable add-on application on the server).

[thomasch]

Hi thomasch

How do you know these command. I'm read admin manual but I can't see these command.
Any other source.

Barame

I like to try to run anything in /bin /usr/bin and /usr/sbin 

WARNING : before you try to run anything, do read the manual first!
and never ever run anything you don't know what it is as root

[mmccarn]

If your SME server is configured to use squid for transparent proxying you could install SARG (http://wiki.contribs.org/Sarg) which would produce nice reports for you after a day or so saying which computers were using the most bandwidth.

No one else has said it yet, so I will - you might want to update to SME 7.2 (http://wiki.contribs.org/Updating_to_SME_7.2#Yum_Update) and see if that fixes your problem.

Here's another post about slow internet; in this post the problem was that the LAN and WAN ips were on the same subnet: http://forums.contribs.org/index.php?topic=38647.0

[edb]

Hi,

I have an sme 7.1.3 ,Vectra VL400 , 1 MHz proccessor, ram 512K, 2 3com nics, 2 80 GB hard disk in raid (sme raid) , server and gateway decated, whith 1M cable modem conection, mail server with clamav and spamassassin, 30 users, web mail activated and a wildfire (jabber) server working and an IPSEC vpn connection to another server. Everything was working perfect for about 8 months, but now suddenly all the traffic of my server start to be very slow.


If I ping to google I see in the response a delay of about 2500 ms and sometimes 3700 ms!!!! If I ping any site the ms are the same.

Also if I use the traceroute to any server I see long delays (2500 to 4500 )

I already have changed the nics and also the network cables just in case with no result.

I have the same issue as above with my SME 7.2 server and it is very intermittent but can last for 20 minutes - 2 hours or any where in between before it returns to normal.
I have also found that when I shutdown the SME server the whole network returns to normal operation and Internet ping times return to the normal 45ms.
When the SME server comes up the ping times drop back down to anywhere from 1900-3200ms and the webserver is not even accessable from the Internet.
I do not have SA or CLAM running as my mail is filtered by a Barracuda Spam box and I cannot find any hints within my log files as to what is going on.

I was thinking that it was the ISP (SHAW cable) that was the issue but have since realized that it is the SME server and I recall having this same issue from time to time with my SME 6x server which was why I thought that going to a fresh 7.2 install would correct but apparently not.

I use a Sonicwall 2040 firewall with the SME server on the DMZ port with it's own public IP.
If I look at my Sonicwall firewall stats I don't see any spikes in CPU usage or anything else for that matter yet when the SME server is disconnected traffic returns to normal so it is for sure the SME server with the problem just don't know what the problem is.
The Sonicwall is being used as the default gateway for the internal PCs not the SME server so if there was a virus on a workstation it would cause a lot of TCP connections on the Sonicwall but this is not the case.

Did you ever get anywhere with your issue Marcos?

[cactus]

I have also found that when I shutdown the SME server the whole network returns to normal operation and Internet ping times return to the normal 45ms.
When the SME server comes up the ping times drop back down to anywhere from 1900-3200ms and the webserver is not even accessable from the Internet.
I do not have SA or CLAM running as my mail is filtered by a Barracuda Spam box and I cannot find any hints within my log files as to what is going on.

[cut]

I use a Sonicwall 2040 firewall with the SME server on the DMZ port with it's own public IP.
If I look at my Sonicwall firewall stats I don't see any spikes in CPU usage or anything else for that matter yet when the SME server is disconnected traffic returns to normal so it is for sure the SME server with the problem just don't know what the problem is.

Perhaps you can try and describe the layout of your network including ip-number (ranges) and subnets as I think you might have configured some conflicting IP-ranges and subnets...

[edb]

Hi Cactus

This is crazy .... was working fine no updates, etc then this situation.
24.xxx.xxx.251 is the IP of my SME server.
Pinging 24.xxx.xxx.251 with 32 bytes of data:

Reply from 24.xxx.xxx.251: bytes=32 time=3465ms TTL=60
Reply from 24.xxx.xxx.251: bytes=32 time=3203ms TTL=60
Reply from 24.xxx.xxx.251: bytes=32 time=3251ms TTL=60
Reply from 24.xxx.xxx.251: bytes=32 time=3047ms TTL=60

Ping statistics for 24.xxx.xxx.251:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 3047ms, Maximum = 3465ms, Average = 3241ms

24.xxx.xxx.249 is the IP of my Sonicwall and 24.xxx.xxx.250 is the IP of my Barracuda SPAM firewall.

The Barracuda & SME are both on the DMZ of the Sonicwall. The Sonicwall is in Transparent NAT mode.
I varified configuration info such as WAN IP, subnet mask, etc and all is fine ... nothing changed.

If I ping either of the above addresses I get the same results of 3000+ms or basically a dead connection.
If I shutdown the SME7.2 server or just disconnect the external nic cable everything else speeds backup to 35-45ms again including my VPN connections and the Barracuda.
The Barracuda though on the Sonicwall DMZ just like the SME server, runs perfectly fine when the SME is disconnected.
I don't think this is a coincidence as I have repeated this several times to make sure it was the SME server.

The SME server is sucking up all available bandwidth from the cable connection just as the other poster indicated and for some reason Sme7admin shows nothing unusual.

I have spent all day trying but have got no where with it so far.
The big question is what changed? The answer is nothing changed as I still have sme updates waiting to be installed but have not done so because I have not had time to look through the packages as I have a system with PHP 4x not the standard version.

Any way I'm all ears if anyone has any suggestions.

edb

[edb]

Ok ...

I think I finally figured out what my problem was after all and it wasn't necessarily an SME issue.
I have BackupPC running on another offsite server that does a nightly backup of my SME server. You know ... the kinda thing you set and forget.
Anyway, I think that BackupPC had a hicup and in turn caused it to try backing up the SME server during business hours which of course caused the bandwidth starvation issue. That's why when I turned off the SME server things seemed to resolve and when I turned it back on thing bogged down again.

The BackupPC server is at an offsite location which is why it never dawned on me until now.

Anyway, I believe that things are resolved now and I also re-scheduled the backup to come on after midnight again to avoid this situation again but most likely I will sometime later down the road and I will forget about it again.

Guess there is always a reason for everything isn't there.

Too many things goin on ...

edb