【NetEyez Use Case #5】Analysis of Microsoft 365 Service Outage Using NetEyez
〈Incident Description〉
Upon receiving reports from employees about the unavailability of Microsoft services, the IT department at Company A initiated an investigation into the cause. However, just as they were about to begin the investigation, Microsoft issued an outage announcement. The incident information was also posted on various news sites. The responsible personnel promptly notified employees of the outage.
At that time, Microsoft 365 services were universally unavailable, with some users unable to access their emails. In addition to email notifications, announcements were made within the premises.
Simultaneously, an analysis of internal network traffic was initiated using NetEyez.
〈Incident Analysis〉
＜Step 1＞Roughly analyze the traffic during the target period using NetEyez
Figure 1 shows NetEyez’s performance analysis screen, showing response time statistics.
From this screen, the following phenomena were found:
- Around 4:00 PM, when the incident occurred, there is a significant increase in server response time.
- There is no noticeable change in network traffic (utilization) during the above time period.
＜Step 2＞Narrow down the target time and investigate in more detail
Further narrowing down the target time for a closer look:
- Zooming in on the period of high response time from 15:45 to 17:15.
- Identified that the applications with particularly high average response times are Microsoft 365 and Teams.
＜Step 3＞Analyze the target time based on the application status
Examine the status of Microsoft applications on the performance analysis screen:
- Check the average response time statistics for Microsoft applications during the same period (15:45 to 17:15).
- Observe an increase in delays across Microsoft applications in general during the above time frame.
*At NetEyez, the definitions for Microsoft applications are as follows:
【Micosoft365】Microsoft Office products (such as Word, Excel, PowerPoint) and file sharing functionalities.
【Microsoft】Services other than Microsoft365, including msn.com, microsoft.com, windows.net, bing.com, visualstudio.com, and others. However, items displayed independently like Teams or OneDrive are excluded.
【Skype Teams、Skype Call】While these are detailed based on the specific URL accessed within Skype services, they generally refer to the overall Skype services.
〈Summary〉
An analysis result showed that the cause was the server (service).
Through the communication traffic analysis of the Microsoft service outage period with NetEyez, the following findings have been identified:
- The outage was observed as an increase in server response time.
- During the outage period, there were no significant changes in client response time and network response time.
⇒The issue is likely on the server (service) side. - No correlation was found between response time delays and network traffic volume.
⇒The issue does not seem to be caused by network traffic. - Response time delays occurred across Microsoft applications in general.
NetEyez Use Case
Click here for details about NeEyez.