The answer to question 01: Before the problems affected the performance the identification of the usage problems must be done. The answer to question 02: The interface that receives the most incoming traffic. The answer to question 03: Monitoring errors would help to prove the cause of the problem. The answer to question 04: History->Security->Audit Log
