Recurring Multi-Second Freezes on a Small Firm's Line-of-Business Server
A 12-person accounting practice runs its tax application on a Windows Server 2016 virtual machine hosted on a single four-year-old Hyper-V host with two 960 GB SATA SSDs in hardware RAID 1, 64 GB RAM and no battery-backed write cache module fitted. The domain controller runs as a second VM on the same host. Backups are a nightly image written to a USB 3.0 drive, rotated between two disks kept in a desk drawer. Users report 3-8 second freezes two to four times a day, mostly between 10:00 and 11:00 and shortly after lunch, plus two "file is locked" errors and one morning when the application would not start until the VM was rebooted. Over three weeks IT replaced a switch port, reinstalled the client and updated the NIC driver, with no change. Tickets are taken by phone, with no priority rules and no record of symptoms or timing.
1. Critique the support work so far and describe the method you would use instead.
Read the worked answer
Three components have been changed - switch port, client and NIC driver - with no measurement before or after, so the team is guessing and any improvement would be indistinguishable from luck. There is also no record: no ticket text describing symptoms, times or scope, and no distinction between the server stalling and one user's interface pausing. Use a defined sequence: state the problem in measurable terms (freezes per day, duration, which users, which operation); gather data from host and guest rather than from impressions; list hypotheses the data can separate - antivirus scan, backup job, RAID cache, orphaned checkpoint, storage latency, host memory pressure; choose the cheapest check that discriminates between them; fix the confirmed cause and verify with the same measurement. Treat the morning the application would not start as a separate incident that may share a root cause and deserves its own timeline.
2. List the specific evidence you would collect and say what each item would confirm or rule out.
Read the worked answer
PerfMon on both guest and host: Avg. Disk sec/Transfer above about 25 ms indicates storage is the stall, and Avg. Disk Queue Length shows saturation; Available MBytes and Pages/sec reveal host memory pressure with two VMs on 64 GB; processor queue length separates CPU contention. The RAID controller log and cache status: a failed or discharged cache battery forces write-through, which on SATA SSDs produces exactly these multi-second stalls and is the leading suspect here. SMART attributes and array media-error counts. Antivirus full-scan schedule, Windows Update and WSUS deadlines, and the backup job's start and finish times, compared against the 10:00-11:00 and post-lunch pattern. Hyper-V checkpoint age on both VMs - an orphaned checkpoint merging stalls I/O. Whether the USB backup disk is left attached and being scanned. Finally, timestamp-correlated event logs across host and guest.
3. Given a 12-person firm in tax season, what immediate mitigations and service-management changes do you recommend?
Read the worked answer
Mitigate without a rebuild: move the antivirus scan and backup outside 08:00-18:00, detach the USB drive after the job, and confirm the RAID cache module state with the hardware vendor - a replacement part is cheap and may end the freezes outright. With only one host, the pragmatic resilience step is a tested restore of the tax VM to a spare machine, which also answers whether the backups work. Service management: a simple ticket log with priority rules, where payroll and filing outages are P1 and individual freezes are P2; mandatory symptom fields; and a rule that no change is made without a before-and-after measurement. Report weekly to the partner: freezes per day, estimated time lost, and open risks. The absence of records, more than the hardware, is what has kept this open for three weeks.