Origin of spikes on a Perfmon graph

[MarkR800]

Hi,

I have some Perfmon data which I am displaying in graph format, and I am getting some unusual traces on the graph.

Three Perfmon counters have been used, which are:

Memory - Available Mbytes
Network - Bytes Total/sec
Processor - %Processor Time

The sampling interval is 15 seconds, and the data was taken from a Counter Log stored locally on the machine. The Counter Log was created by a scheduled Perfmon job. The systems in question are multi-CPU Windows 2000-based Citrix servers. The two onboard NICs are teamed.

The Memory counter is displayed as a single line, which fluctuates across the length of the graph (as expected). However, both the Network counter and Processor counter appear in two forms - as a fluctuating line AND a series of regularly spaces spikes, overlaid on each other, along the length of the graph.

The spikes are 'instantaneous', i.e. there is no slope for an increase or decrease, just a vertical line. Also, the Network and CPU spikes always occur together (although the values for each differ each time).

I have ruled these spike out as being due to the sampling interval, as there are approximately 100 of them on the graph, the Y-axis for which represents a 12-hour period (meaning the spikes appear approximately every 430 seconds, or roughly 7 minutes).

Does anyone have any idea what these spikes may be, as I have not seen this on a Perfmon Counter Log graph before?

Many thanks,

Mark

 

[nerdzilla]

Might try eliminating possible malware causes.

 

[MarkR800]

Thanks for replying.

I'm not really in a position to check for malware, as these are live environment servers and the introduction of any hardware/software/configuration changes (such as malware/spyware checkers) requires a change approval process to be completed. (I also shouldn't strictly be doing this work as I am not an admin, but that's another matter!)

As background, the servers that produced the traces are not used for Internet access, are Citrix servers where the users have restricted access, and are based behind a firewall, so I would have thought that chances of malware being present would be minimal.