Mind stumping web traffic issue...

Evening All,

I'll give the Cliff Notes version just to see if anyone has seen
something similar, and if not I'll post more detail about our full
configuration, etc. and we can dig into it deeper.

We have a handful of web servers behind a load balancer (NetScaler).

During our busy times (morning and midday) we are having this "event"
where our mainframe is complaining about getting to many requests at
once from the web servers. Now the mainframe complaining isn't the
issue, it's actually doing what it's supposed to be doing.

The question is why the uneven load of traffic from the web servers.

If you take a look at the IIS logs, and graph out the records per
second, you'll see steady traffic, then a drop to almost nothing (like
the web servers are being starved of traffic), and then a rebound
spike, and everything returns to that normal baseline.

We know it's not additional traffic because the volume of the drop is
equal to the volume of the spike.

It's like the chicken or the egg...we're trying to use the IIS logs to
help us figure out if the Load Balancer is holding back traffic, or if
the mainframe is not responding to traffic.

So I guess my question may be more about IIS logging and how it
works...what components of the log record are time stamped as the http
process starts, and what parts are as the record finished?

Thoughts?

Sorry about the babbling!

Thanks,

Steve

Re: Mind stumping web traffic issue...

The time is when the processing starts, and time taken indicates the time
taken to process the request. The actual logfile entry is only actually
generated late in the request processing cycle (to allow for generation of
the "time taken" value). http.sys buffers log file entries in memory, and
then writes them in chunks (I believe, about 64kb) to the logfile on disk.

You may need to get packet captures of the network traffic between your load
balancer and your IIS boxes to see what the issue is. If there is no obvious
issue in the IIS logfiles, it's probably lower in the TCP/IP stack (e.g.
some problem negotiating TCP connection or similar).

Cheers
Ken

--
My IIS Blog: www.adOpenStatic.com/cs/blogs/ken

wrote in message
news:b7dbf90f-c91d-426e-8434-46a869deb389@w34g2000hsg.google groups.com...
> Evening All,
>
> I'll give the Cliff Notes version just to see if anyone has seen
> something similar, and if not I'll post more detail about our full
> configuration, etc. and we can dig into it deeper.
>
> We have a handful of web servers behind a load balancer (NetScaler).
>
> During our busy times (morning and midday) we are having this "event"
> where our mainframe is complaining about getting to many requests at
> once from the web servers. Now the mainframe complaining isn't the
> issue, it's actually doing what it's supposed to be doing.
>
> The question is why the uneven load of traffic from the web servers.
>
> If you take a look at the IIS logs, and graph out the records per
> second, you'll see steady traffic, then a drop to almost nothing (like
> the web servers are being starved of traffic), and then a rebound
> spike, and everything returns to that normal baseline.
>
> We know it's not additional traffic because the volume of the drop is
> equal to the volume of the spike.
>
> It's like the chicken or the egg...we're trying to use the IIS logs to
> help us figure out if the Load Balancer is holding back traffic, or if
> the mainframe is not responding to traffic.
>
> So I guess my question may be more about IIS logging and how it
> works...what components of the log record are time stamped as the http
> process starts, and what parts are as the record finished?
>
> Thoughts?
>
> Sorry about the babbling!
>
> Thanks,
>
> Steve