Armed with the above information, the next step was to perform some packet
traces to see what I could find. Thankfully (?) the problem is continuous,
so I could time my traces to only capture the spikes and I could wait until
late in the night to limit the extraneous packets as much as possible.
Doing this a bunch of times I was able to isolate what seems to be the
problem. However, correlation does not imply causation, it merely points a
finger in its direction. I won't really know until Monday when I'm able to
stop the process to see if the spikes disappear.
Because the traffic flows over a vif, I can only capture the entire vif and
not an individual interface. I also do not know how our 6509 was
configured, so I can't attempt to calculate over which port the traffic
from this client would be directed, but the amount and type of traffic
leads me to believe that I have found the culprit. This particular
application server runs a program within a DOS on a Windows 98 PC. It
sends hundreds of search requests at exactly the same time as the CPU
spikes. Researching this shows some related bugs - 35047 or 40348.
If this is the problem, then I'll see what can be done about the
application. If nothing, then I'll be opening a case.
Thanks to the personal replies I received from NetApps.
traces to see what I could find. Thankfully (?) the problem is continuous,
so I could time my traces to only capture the spikes and I could wait until
late in the night to limit the extraneous packets as much as possible.
Doing this a bunch of times I was able to isolate what seems to be the
problem. However, correlation does not imply causation, it merely points a
finger in its direction. I won't really know until Monday when I'm able to
stop the process to see if the spikes disappear.
Because the traffic flows over a vif, I can only capture the entire vif and
not an individual interface. I also do not know how our 6509 was
configured, so I can't attempt to calculate over which port the traffic
from this client would be directed, but the amount and type of traffic
leads me to believe that I have found the culprit. This particular
application server runs a program within a DOS on a Windows 98 PC. It
sends hundreds of search requests at exactly the same time as the CPU
spikes. Researching this shows some related bugs - 35047 or 40348.
If this is the problem, then I'll see what can be done about the
application. If nothing, then I'll be opening a case.
Thanks to the personal replies I received from NetApps.