CPU 100% - by System

[KRPGroup]

This server is a basic file server that started to run 90-100 CPU. After checking the task manager it is the System process that is doing it.

The CPU does settle down in the evenings when staff go home but the System process is still a bit high but the server is atleast manageable. It runs in the 25-35% spiking in the 70-80 for short bursts.

After extensive testing, changing out hardware EG Raid Controller, NIC, we think have narrowed the issue down to the Network.
We have found out if we disable the NIC or unistall it, the server runs normally. As soon as we install or enable the NIC the System process CPU usage jumps way up.

 

[itsp1965]

This could be considered normal behaviour depending on things like how many users you have accessing the server, is there a lot of I/O being generated on the disk subsystem, network interface, memory/cache.

Does this server also run as a print server? Do you have any other software running on it.

Start by doing some performance monitoring to see if you have a bottleneck, by disabling the NIC all you're doing is stopping the server from serving it's role that of a file server.

Hope this helps.

 

[Yardyy]

what you could try is downloading a tool from

http://www.nirsoft.com

called currports, that should tell you what if anything is using the carious ports on your system, to connect to the internet. it will also show the executable fle that is active.

it sounds like you could have a trojan of some sort.

hope that helps.

Many Thanks
Yurov Ardyy

 

[KRPGroup]

We unshared 2 shared folders
1 - Users, All user folders, approx 90-95 staff
2 - Apps, Application folder (had less than 10 staff in at the time)

As soon as we got everyone disconneted from the server the CPU dropped to normal. The server is still on the network but seems as soon as a large number of clients connect even if they do not have files open the server System spikes.

 

[Yardyy]

could be a malware program on your clients computers..



Many Thanks
Yurov Ardyy

 

[KRPGroup]

Also the server is doing the following
1 - 2 File Shares, Apps and Home folders
2 - Payroll database (which I have turned off)

It did have Shadow copy running but I have disabled this as well.

Itsp1965, can you recommend a few PM Counters to run?

 

[itsp1965]

The key metrics you should check (as per MS)

Physical/Logical disk
---------------------
Disk transfer/sec
Avg Disk Queue Length (should not > 2)
(note you will need to enable disk counters by typing diskperf -ye at the command prompt)

Memory
------
Pages/Sec (should not be > 20 for a period of 5 mins or more)
Avail Bytes (should never go < 4MB

Paging File
-----------
% Usage (lookout for growth)

Network Interface
-----------------
Bytes Total/Sec (should not be greater than 50%)

Now you didn't mention as to whether the CPU spikes were at 90-100% for what period of time. If it's constantly running like this then I would also check what the other posts have indicated otherwise it's quite possible your server has a bottleneck

Hope this helps.

 

[KRPGroup]

When we are experiencing the problem the System is 90% + constantly and with a few of the other processes taking 1-2% the server is running 100% or close to it.

I have ran a full virus scan using Trend Server Protect. I went to the

http://www.nirsoft.com

site but couldn't find Currports?

Now that the sever is running normally I have started to remapped staff back to it for their Applicaiton drive. I figured I could slowly increase it to see if anything happens. I will keep staff from mapping their user folders for now to see if that has anything to do with it.

 

[Cstorms]

This server doesnt have an smtp server on it that could be used as a relay does it?

 

[KRPGroup]

No just File Server under Server roles.

 

[KRPGroup]

I did a P2V Vmware conversion to see if it was hardware related and even in the VM it is still running with a Hgih CPU only when staff are connected. After hours it drops way down.

The NIC in the vm is solid all the time.
I looked at the properties of the card and it was displaying 86,xxx,xxx,xxx bytes sent in 3 days while the hosts of the VM is only at 600,xxx,xxx bytes sent.

The network utilization on the VM in under 1% on the task mgr

 

[Roadki11]

Have you tried running a packet sniffer on it like ethereal and analyzing the kind of traffic coming out of it?

RoadKi11

 

[Roadki11]

I would use Process Explorer also to narrow in on the offending process or processes running within process.

http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

RoadKi11

 

[KRPGroup]

I have ran the Process Explorer and System shows 90%+ and all the sub process register blank (I am assuming too low to count) and another one registers 1-2%max.