Our monitoring team has developed and rolled out scripts for monitoring our web farm.
And, we are getting alerts through email.
Quite a lot of emails are coming across and wanted to see if they are coming from same host or a combination of hosts.
Looked at the emails and they happen to be coming from same host.
And, so will have to engage our Network team and see how the Load Balancer is configured.
Is there a prospect that more traffic is being directed at the failing node?
Network Load Balancer
As we prepared to go to the Network Load Balancer team took the opportunity to take gather and query the IIS Logs, as well.
Log Parser Studio
SELECT To_String(date, 'yyyy-MM-dd') as dated , sc-status as status , sum ( case s-ip when '10.0.4.25' then 1 else 0 end ) as S1 , sum ( case s-ip when '10.0.4.26' then 1 else 0 end ) as S2 , sum ( case s-ip when '10.0.4.27' then 1 else 0 end ) as S3 , sum ( case s-ip when '10.0.4.28' then 1 else 0 end ) as S4 , min(TO_TIMESTAMP(date, time)) as tsRecordedMin , max(TO_TIMESTAMP(date, time)) as tsRecordedMax FROM '[LOGFILEPATH]' where ( ( TO_TIMESTAMP(date, time) between timestamp('2017/08/02 10:30:00', 'yyyy/MM/dd hh:mm:ss') and timestamp('2017/08/02 17:20:00', 'yyyy/MM/dd hh:mm:ss') ) ) /* and c-ip not in ('10.0.4.141') */ group by date , sc-status order by dated , status
Time Range – 1 ( August 2nd 10:30 AM – 5:20 PM )
- It is difficult to make case that traffic is exhaustively being waded into a specific host
Time Range – 2 ( August 8th 5:13 PM – 8:40 PM )
- In our second time slot, 4700 records bearing HTTP 200 is right around average
At this time it is likely that the sufferance we are seeing with this specific host is not due to outside pressure, but internal to the host itself.