finally got back to the computer, long day.
First let me correct what I said last night. I'm using an SSH connection to manage/admin the ubuntu 8.1 folder, but the linux client monitoring is actually done via SMB, not SSH. I've got a drive mapped to a samba share on the linux box, add the clients in fahmon just like they are local. But, you probably already know this.
Now, in direct A-B-A test disabling the remote clients makes the secondary, 1 or 2 second spike go away. The 25 second spike is apparently caused by the Win client monitoring. Seems counter-intuitive since there's only one Win client and it's local but there it is. It is repeatable. Interesting, turning on the kernel time part of the display shows that less than half the spike is kernel time, most of the spike is from userland processes.
see if this image gizmo will work:
nope
how about this link to a pic:
http://picasaweb.google.com/lh/photo/1f ... tdgkF2NqtU
cute, pic disappears. hit the slide show button, it'll show up.