CSRSS.exe consumes 50% CPU Utilization

[105179]

Hi

I have few servers in the loadbalance and around 8 applications is published. Often it happens I find that the CPU 50% is utilized by CSRSS.exe constantly, I can;t kill it.
I need to reboot to get CSTSS.exe stopped.
The servers are with Win2k-MetaframeXP -FR3.

 

[CitrixEngineer]

csrss.exe is Microsoft's Client Server Runtime SubSystem, and an instance will run for each session, so it can't be killed until the session logs off. It is the user-mode portion of the Win32 subsystem (with Win32.sys being the kernel-mode portion).

The more applications are run inside a session, the more resources it needs to keep open - it keeps tabs on where everything is inside the session's memory space, manages windows, the creation and deletion of threads and so forth.

I have seen this process utilize 100% before - but usually only as an odd "spike" - it's rare to see constant high CPU usage.

Are you seeing spikes or constant 50% usage? Does the CPU go up when particular apps are run?


Hope this helps

 

[105179]

yes its constant 50% usage, there are different applications running on these systems. I am not sure which exactly creates this problem. Also all user logsoff, the CSRSS process cannot be killed. I need to reboot.

 

[DDILL]

When all users log off does the CPU usage decrease for CSRSS?

 

[CitrixEngineer]

If csrss.exe is still using 50% after all users have logged off, then - assuming Admin is the only user left logged in - there must be something Admin is running that is causing this. Csrss.exe runs for every user as a system process (user-mode portion of the subsystem...).

Could be anti-virus software.

Hope this helps

 

[mitchero]

I am researching this problem for an ASP. It looks like this problem started appearing after MS SP3. I'm leaning toward a MS Hotfix that deals with session logoffs. Will post if I find.

 

[105179]

Please let me know if you find a solution.

 

[leegregory]

We had the same problem on our server farm. We upgraded to SP3 and this made it worse. Our problem seemed to be caused by Excel 97 when certain spreadsheets were loaded by our accounts department.

We have since upgraded to office XP and so far the problem has not returned.

When it happened to us we used a dos program called pssuspend that you can use to suspend the rouge process and this lets other users carry on working. If you need it let me know and i will mail it to you.

 

[105179]

I will be thankful if u can send me by mail.
Thanks u very much.
However we have office97 and not sure if we can upgrade to officeXP.
If anyone have any soln for the same , please let me know.

 

[DDILL]

Another good free utility is threadmaster. This gives you some good management of CPU cycles.

http://threadmaster.tripod.com/

 

[leegregory]

No problem, go here and download it, it's only a small app that runs from a dos prompt. There's also all the switches you will need as well.

Good luck

http://www.sysinternals.com/ntw2k/freeware/pssuspend.shtml

 

[DDILL]

It looks like this pssuspend is a manual solution that you use when you see the problem and it completely suspends the process. This looks like it could be a nice tool for troubleshooting, etc but applications like threadmaster (free), and Aurema's Armtech (not free) offer a real time resource allocation. These will allow the process to keep running but not consume as much resource.