Consistent Performance Issues on Win21

[dman]

Hello,

I have a couple of sites on Win21 and they are constantly (5-10 times daily) getting script timeout errors and seem to be experiencing performance issues. Checking the Jodopulse site several times a day I see ridiculous response times in the tens of thousands.

Is anyone else having these issues? Is there a known issue with Win21? Are DDOS attacks responsible? What is the Local Probe mentioned in the IpChecks below? It seems like every time there is a local probe the response times drop by a 1000 ms.

I submitted tickets but the usual response is in an hour or two when the site has recovered and they say it is working fine now. I am happy that it returns to normal but need it to work better on a consistent basis. Below are a few excerpts from Jodo's IpCheck monitoring and also some script timeouts that I get 5-20 of every day. I've increased the script timeouts and the sites are in their own application pools.

JodoPulse:
Win21
PING PING [Local Probe] OK 1 ms
HTTP ADV ASP Sensor [RemoteBackup] OK 137 ms
HTTP ADV ASP.NET Sensor [RemoteBackup] OK 17706 ms

Win21
PING PING [Local Probe] OK 0 ms
HTTP ADV ASP Sensor [Local Probe] OK 19377 ms
HTTP ADV ASP.NET Sensor [Local Probe] OK 16241 ms

Win21
PING PING [RemoteBackup] OK 1 ms
HTTP ADV ASP Sensor [Local Probe] OK 1429 ms
HTTP ADV ASP.NET Sensor [Local Probe] OK 286 ms

Script Timeouts:

Tue 6/17/2008 6:09 PM
Error Number: -2147467259
Error Description: Timeout expired

Tue 6/17/2008 9:23 AM
Error Number: -2147012894
Error Description: The operation timed out

Fri 6/13/2008 12:35 PM
Error Number: -2147012894
Error Description: The operation timed out

 

[Stephen]

local probe, remote probe, we have multiple monitoring locations

it is a different location that is all

Yes win21 is having some issues, it is still taking a DDOS beating

Customer only section I have provided some input on this that can't be made in open here. If you don't have access to that let me know.

Mostly have not seen much customer side problem but at times the DDOS is hitting extreme request levels and makes the CPU to jump to 90%+ for some minutes then back to normal 20% or less levels. Of note is that on the alerter we are actually monitoring the site that is directly being targetted(that is the default site on IIS) so it is most likely the slowest of all.

 

[dman]

Hey Stepen,

Thanks for the reply. Are these attacks on a particular site or the whole server? I'll jump into the customer only discussion as well. Is it possible to move two site off of WIN21? They are for one of my best clients and I need to be sure they are not losing money. Thanks!

 

[Stephen]

yes can move, I have not seen such a sustained attack as this before

We have worked to block it but literally coming from 1000's of IPs.

They are against a particular site, but coming in on the main server IP. That site has been turned off, and the main server site as well(as listed on update forum, its been off since just after the attack started)