wmiprvse.exe using an average 95% CPU

Discussion in 'Windows Small Business Server' started by nick_oss, Jan 14, 2007.

  1. nick_oss

    nick_oss Guest

    Hi Folks

    I have been trying to resolve a problem with a customers SBS 2003 SP1 Server
    for the last couple of weeks. The wmiprvse.exe process is constantly using
    95% processor time on both processor instances (hyperthreading). I have
    searched the KB's extensively for a fix for this and shut down as many
    services as possible to try and isolate the cause of this problem but the
    only thing I have been able to find is that nothing changes the CPU
    utilisation.

    The problem has only appeared in the last couple of weeks (note the extract
    from the Server performance report below showing that the average processor
    utilisation has increased between 4,000% and 5,000% from last month with
    wmiprvse.exe using an average 95%)

    I would greatly appreciate any assistance with this. The server has only a
    maximum of 6 users and has performed well until this problem appeared. Apart
    from automatic updates I do not believe there have been any other changes
    made to the server in the last month. Server details and performance report
    are:

    Server Specifications

    Operating System: Microsoft(R) Windows(R) Server 2003 for Small Business
    Server Service Pack 1
    Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz, Intel(R) Pentium(R) 4 CPU
    3.00GHz
    Frequency: 3.0 GHz, 3.0 GHz
    Amount of RAM: 2048 MB

    Performance Summary

    Performance Counters Today Last Month Rate of Growth
    Memory in use 1,721 MB 1,880 MB -8 %
    Free disk space (C:) 27,040 MB 27,134 MB 0 %
    Free disk space (D:) 17,368 MB 17,418 MB 0 %
    Free disk space (F:) 37,814 MB 37,816 MB 0 %
    Free disk space (G:) 33,461 MB 33,480 MB 0 %
    Free disk space (H:) 32,061 MB 28,932 MB 11 %
    Busy disk time (0 C:) 15 % 5 % 218 %
    Busy disk time (1 H: F:) 4 % 0 % 10,610 %
    Busy disk time (2 D: G:) 7 % 3 % 160 %

    CPU Use (0) 85 % 2 % 4,460 %
    CPU Use (1) 86 % 2 % 5,555 %


    Top 5 Processes by Memory Usage

    Process Name - ID Memory Usage

    sqlservr - 472 682 MB

    store - 3804 586 MB

    sqlservr - 256 53 MB

    svchost - 1484 39 MB

    inetinfo - 316 38 MB


    Top 5 Processes by CPU Usage

    Process Name - ID CPU Time
    wmiprvse - 4076 95.5 %

    wmiprvse - 5040 95.0 %

    services - 756 45.3 %

    services - 760 44.8 %

    lsass - 780 18.4 %

    Once again any assistance would be much appreciated.

    --
    Regards

    Nick
    MCSE, Small Business Specialist
     
    nick_oss, Jan 14, 2007
    #1
    1. Advertising

  2. nick_oss

    Anna Clark Guest

    Hi Nick:

    No personal experience, but from some references that I find I suspect that
    you are seeing the symptom and not the cause. Here is a post from another
    message board:

    Recommendation :
    Essential - leave alone. Note that, as with SVCHOST, there may be more than
    one instance of WMIPRVSE running in your Task List : this is normal. Also,
    some users will never have witnessed the WMIPRVSE service running on their
    Windows XP/2003 PC, and then notice it running one day and every day
    thereafter : this is also normal and will in most cases be the result of
    some software having been installed (and installing WMI provider services)
    or the result of a Windows Update. Finally, as with SVCHOST, if you
    experience errors or excess CPU usage with WMIPRVSE, the problem will in
    almost all cases be with the WMI provider process that WMIPRVSE is hosting,
    not with WMIPRVSE itself, or you may have a hardware problem or
    incompatibility which is not yet at the "serious" stage - see if Microsoft's
    Windows Update has WMI related fixes for your PC/Server; also, on a
    network, we have empirical evidence that poor network card drivers or
    chipsets on any part of the network may result in excessive CPU usage by
    WMIPRVSE.

    So, based on that, what to do? Well, I guess the first thing I would do is
    make sure the NIC drivers on the server were updated and not one of the
    known problems, such as Dell Broadcom. Since the message indicated that the
    error might be from a nic on a connected system, I might turn off the switch
    for while, then turn off the server (power off), then restart the server.
    If the problem ceases, then bring the switch back up with only one
    workstation plugged in, then add them one at a time.

    Lastly, are there any events in the logs that might show problems with any
    other hardware? I saw one post that involved a long since deleted printer
    where the system still had a un printed print job. When the print job was
    deleted and the queue deleted, the CPU usage went back to normal.


    Regards:

    Anna Clark
    -----
    Please do post the conclusion or solution
    to your issue so that others may benefit.


    "nick_oss" <> wrote in message
    news:...
    > Hi Folks
    >
    > I have been trying to resolve a problem with a customers SBS 2003 SP1

    Server
    > for the last couple of weeks. The wmiprvse.exe process is constantly using
    > 95% processor time on both processor instances (hyperthreading). I have
    > searched the KB's extensively for a fix for this and shut down as many
    > services as possible to try and isolate the cause of this problem but the
    > only thing I have been able to find is that nothing changes the CPU
    > utilisation.
    >
    > The problem has only appeared in the last couple of weeks (note the

    extract
    > from the Server performance report below showing that the average

    processor
    > utilisation has increased between 4,000% and 5,000% from last month with
    > wmiprvse.exe using an average 95%)
    >
    > I would greatly appreciate any assistance with this. The server has only a
    > maximum of 6 users and has performed well until this problem appeared.

    Apart
    > from automatic updates I do not believe there have been any other changes
    > made to the server in the last month. Server details and performance

    report
    > are:
    >
    > Server Specifications
    >
    > Operating System: Microsoft(R) Windows(R) Server 2003 for Small Business
    > Server Service Pack 1
    > Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz, Intel(R) Pentium(R) 4 CPU
    > 3.00GHz
    > Frequency: 3.0 GHz, 3.0 GHz
    > Amount of RAM: 2048 MB
    >
    > Performance Summary
    >
    > Performance Counters Today Last Month Rate of Growth
    > Memory in use 1,721 MB 1,880 MB -8 %
    > Free disk space (C:) 27,040 MB 27,134 MB 0 %
    > Free disk space (D:) 17,368 MB 17,418 MB 0 %
    > Free disk space (F:) 37,814 MB 37,816 MB 0 %
    > Free disk space (G:) 33,461 MB 33,480 MB 0 %
    > Free disk space (H:) 32,061 MB 28,932 MB 11 %
    > Busy disk time (0 C:) 15 % 5 % 218 %
    > Busy disk time (1 H: F:) 4 % 0 % 10,610 %
    > Busy disk time (2 D: G:) 7 % 3 % 160 %
    >
    > CPU Use (0) 85 % 2 % 4,460 %
    > CPU Use (1) 86 % 2 % 5,555 %
    >
    >
    > Top 5 Processes by Memory Usage
    >
    > Process Name - ID Memory Usage
    >
    > sqlservr - 472 682 MB
    >
    > store - 3804 586 MB
    >
    > sqlservr - 256 53 MB
    >
    > svchost - 1484 39 MB
    >
    > inetinfo - 316 38 MB
    >
    >
    > Top 5 Processes by CPU Usage
    >
    > Process Name - ID CPU Time
    > wmiprvse - 4076 95.5 %
    >
    > wmiprvse - 5040 95.0 %
    >
    > services - 756 45.3 %
    >
    > services - 760 44.8 %
    >
    > lsass - 780 18.4 %
    >
    > Once again any assistance would be much appreciated.
    >
    > --
    > Regards
    >
    > Nick
    > MCSE, Small Business Specialist
     
    Anna Clark, Jan 14, 2007
    #2
    1. Advertising

  3. nick_oss

    Rob C Guest

    This may help:
    It happened to one of my SBS servers too last year and in my case was
    related to monitoring and reporting.
    My CPU levels would spike at 100% for about 15-20 minutes every hour. Whilst
    folks assured me this was 'normal'. I disagreed.
    I bumped into a thread somewhere that said 'try resetting monitoring and
    reporting through MMC'. I did and sure enough, when the server did it's
    hourly report generating it only took the CPU to about 80% for a minute or
    two.
    Seemed to fix the problem...

    HTH

    "rrafiringa" wrote:

    >
    > I've seen it on many SBS servers.
    > It usually happens when the server is gathering statistical data on the
    > system to create reports usage and performance reports.
    >
    >
    > --
    > rrafiringa
    > ------------------------------------------------------------------------
    > rrafiringa's Profile: http://forums.techarena.in/member.php?userid=18734
    > View this thread: http://forums.techarena.in/showthread.php?t=659836
    >
    > http://forums.techarena.in
    >
    >
     
    Rob C, Jan 14, 2007
    #3
  4. nick_oss

    Rob C Guest

    And by 'resetting' I mean 'reinstalling monitoring features'
    FYI you will loose the stats already generated

    "Rob C" wrote:

    > This may help:
    > It happened to one of my SBS servers too last year and in my case was
    > related to monitoring and reporting.
    > My CPU levels would spike at 100% for about 15-20 minutes every hour. Whilst
    > folks assured me this was 'normal'. I disagreed.
    > I bumped into a thread somewhere that said 'try resetting monitoring and
    > reporting through MMC'. I did and sure enough, when the server did it's
    > hourly report generating it only took the CPU to about 80% for a minute or
    > two.
    > Seemed to fix the problem...
    >
    > HTH
    >
    > "rrafiringa" wrote:
    >
    > >
    > > I've seen it on many SBS servers.
    > > It usually happens when the server is gathering statistical data on the
    > > system to create reports usage and performance reports.
    > >
    > >
    > > --
    > > rrafiringa
    > > ------------------------------------------------------------------------
    > > rrafiringa's Profile: http://forums.techarena.in/member.php?userid=18734
    > > View this thread: http://forums.techarena.in/showthread.php?t=659836
    > >
    > > http://forums.techarena.in
    > >
    > >
     
    Rob C, Jan 14, 2007
    #4
  5. nick_oss

    nick_oss Guest

    Thanks for all your helpful replies.

    I have tried reinstalling the monitoring and this appeared to work for about
    30 seconds then the problem started again. Tried this twice. It appears to
    stop using the wmiprvse.exe process briefly while reseting the counters which
    may mean the problem is related to monitoring (or it just briefly resets the
    process!).

    Does anyone know how I can temporily stop monitoring completely to see if
    this is the root cause?

    I have tried stopping the MSSQL$SBSMONITORING service but this appears to
    make no difference (do I need to restart the server with this service set to
    disabled?).

    Once again any assistance is much appreciated.

    --
    Regards

    Nick
    MCSE, Small Business Specialist


    "Rob C" wrote:

    > And by 'resetting' I mean 'reinstalling monitoring features'
    > FYI you will loose the stats already generated
    >
    > "Rob C" wrote:
    >
    > > This may help:
    > > It happened to one of my SBS servers too last year and in my case was
    > > related to monitoring and reporting.
    > > My CPU levels would spike at 100% for about 15-20 minutes every hour. Whilst
    > > folks assured me this was 'normal'. I disagreed.
    > > I bumped into a thread somewhere that said 'try resetting monitoring and
    > > reporting through MMC'. I did and sure enough, when the server did it's
    > > hourly report generating it only took the CPU to about 80% for a minute or
    > > two.
    > > Seemed to fix the problem...
    > >
    > > HTH
    > >
    > > "rrafiringa" wrote:
    > >
    > > >
    > > > I've seen it on many SBS servers.
    > > > It usually happens when the server is gathering statistical data on the
    > > > system to create reports usage and performance reports.
    > > >
    > > >
    > > > --
    > > > rrafiringa
    > > > ------------------------------------------------------------------------
    > > > rrafiringa's Profile: http://forums.techarena.in/member.php?userid=18734
    > > > View this thread: http://forums.techarena.in/showthread.php?t=659836
    > > >
    > > > http://forums.techarena.in
    > > >
    > > >
     
    nick_oss, Jan 15, 2007
    #5
  6. nick_oss

    nick_oss Guest

    Hi Rob

    Thanks for the advice. Process explorer helped me isolate the problem to the
    event log alerts (account lockout and sbs backup failure). Once turned of
    using the "changing alert notifications" wizard the CPU problem goes away.
    All other standard alerts do not cause the problem and can be left enabled. A
    restart is may be required once these alerts are turned off to stop the
    wmiprvse.exe process using high CPU (or you can end the wmiprvse.exe process,
    would still advise a restart to make sure the process is running in the
    correct user context).

    Have not resolved the problem completely as event log alerting needs to be
    turned off but it is a good start as now my customer is not experiencing slow
    server response. Any ideas on troubleshooting the event log alerting further
    would be much appreciated.

    Once again thanks very much for your assistance with this.
    --
    Regards

    Nick
    MCSE, Small Business Specialist


    "Rob C" wrote:

    > Have you used process explorer
    > (http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx)
    > to find what process is really being nasty under wmiprvse.exe? That may lead
    > you on the right path...
    >
    > "nick_oss" wrote:
    >
    > > Thanks for all your helpful replies.
    > >
    > > I have tried reinstalling the monitoring and this appeared to work for about
    > > 30 seconds then the problem started again. Tried this twice. It appears to
    > > stop using the wmiprvse.exe process briefly while reseting the counters which
    > > may mean the problem is related to monitoring (or it just briefly resets the
    > > process!).
    > >
    > > Does anyone know how I can temporily stop monitoring completely to see if
    > > this is the root cause?
    > >
    > > I have tried stopping the MSSQL$SBSMONITORING service but this appears to
    > > make no difference (do I need to restart the server with this service set to
    > > disabled?).
    > >
    > > Once again any assistance is much appreciated.
    > >
    > > --
    > > Regards
    > >
    > > Nick
    > > MCSE, Small Business Specialist
    > >
    > >
    > > "Rob C" wrote:
    > >
    > > > And by 'resetting' I mean 'reinstalling monitoring features'
    > > > FYI you will loose the stats already generated
    > > >
    > > > "Rob C" wrote:
    > > >
    > > > > This may help:
    > > > > It happened to one of my SBS servers too last year and in my case was
    > > > > related to monitoring and reporting.
    > > > > My CPU levels would spike at 100% for about 15-20 minutes every hour. Whilst
    > > > > folks assured me this was 'normal'. I disagreed.
    > > > > I bumped into a thread somewhere that said 'try resetting monitoring and
    > > > > reporting through MMC'. I did and sure enough, when the server did it's
    > > > > hourly report generating it only took the CPU to about 80% for a minute or
    > > > > two.
    > > > > Seemed to fix the problem...
    > > > >
    > > > > HTH
    > > > >
    > > > > "rrafiringa" wrote:
    > > > >
    > > > > >
    > > > > > I've seen it on many SBS servers.
    > > > > > It usually happens when the server is gathering statistical data on the
    > > > > > system to create reports usage and performance reports.
    > > > > >
    > > > > >
    > > > > > --
    > > > > > rrafiringa
    > > > > > ------------------------------------------------------------------------
    > > > > > rrafiringa's Profile: http://forums.techarena.in/member.php?userid=18734
    > > > > > View this thread: http://forums.techarena.in/showthread.php?t=659836
    > > > > >
    > > > > > http://forums.techarena.in
    > > > > >
    > > > > >
     
    nick_oss, Jan 16, 2007
    #6
  7. nick_oss

    nick_oss Guest

    Also tried the following steps outlined in KB 300956:

    To rebuild all Performance counters including extensible and third party
    counters in Windows Server 2003, type the following commands at a command
    prompt. Press ENTER after each command.
    cd \windows\system32
    lodctr /R
    Note /R is uppercase.

    Windows Server 2003 rebuilds all the counters because it reads all the .ini
    files in the C:\Windows\inf\009 folder for the English operating system.

    Also tried reinstalling all monitoring from the configure monitoring wizard.

    However these steps did not work. Only unselecting event log alerts stopped
    the problem.

    --
    Regards

    Nick
    MCSE, Small Business Specialist


    "Rob C" wrote:

    > Have you used process explorer
    > (http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx)
    > to find what process is really being nasty under wmiprvse.exe? That may lead
    > you on the right path...
    >
    > "nick_oss" wrote:
    >
    > > Thanks for all your helpful replies.
    > >
    > > I have tried reinstalling the monitoring and this appeared to work for about
    > > 30 seconds then the problem started again. Tried this twice. It appears to
    > > stop using the wmiprvse.exe process briefly while reseting the counters which
    > > may mean the problem is related to monitoring (or it just briefly resets the
    > > process!).
    > >
    > > Does anyone know how I can temporily stop monitoring completely to see if
    > > this is the root cause?
    > >
    > > I have tried stopping the MSSQL$SBSMONITORING service but this appears to
    > > make no difference (do I need to restart the server with this service set to
    > > disabled?).
    > >
    > > Once again any assistance is much appreciated.
    > >
    > > --
    > > Regards
    > >
    > > Nick
    > > MCSE, Small Business Specialist
    > >
    > >
    > > "Rob C" wrote:
    > >
    > > > And by 'resetting' I mean 'reinstalling monitoring features'
    > > > FYI you will loose the stats already generated
    > > >
    > > > "Rob C" wrote:
    > > >
    > > > > This may help:
    > > > > It happened to one of my SBS servers too last year and in my case was
    > > > > related to monitoring and reporting.
    > > > > My CPU levels would spike at 100% for about 15-20 minutes every hour. Whilst
    > > > > folks assured me this was 'normal'. I disagreed.
    > > > > I bumped into a thread somewhere that said 'try resetting monitoring and
    > > > > reporting through MMC'. I did and sure enough, when the server did it's
    > > > > hourly report generating it only took the CPU to about 80% for a minute or
    > > > > two.
    > > > > Seemed to fix the problem...
    > > > >
    > > > > HTH
    > > > >
    > > > > "rrafiringa" wrote:
    > > > >
    > > > > >
    > > > > > I've seen it on many SBS servers.
    > > > > > It usually happens when the server is gathering statistical data on the
    > > > > > system to create reports usage and performance reports.
    > > > > >
    > > > > >
    > > > > > --
    > > > > > rrafiringa
    > > > > > ------------------------------------------------------------------------
    > > > > > rrafiringa's Profile: http://forums.techarena.in/member.php?userid=18734
    > > > > > View this thread: http://forums.techarena.in/showthread.php?t=659836
    > > > > >
    > > > > > http://forums.techarena.in
    > > > > >
    > > > > >
     
    nick_oss, Jan 16, 2007
    #7
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Arch Willingham
    Replies:
    0
    Views:
    951
    Arch Willingham
    Oct 26, 2005
  2. Mike M
    Replies:
    0
    Views:
    1,378
    Mike M
    Mar 28, 2008
  3. Prem

    svchost.exe and wmiprvse.exe haunt cpu

    Prem, Nov 18, 2004, in forum: Windows Small Business Server
    Replies:
    0
    Views:
    456
  4. Philb
    Replies:
    3
    Views:
    469
    Robert
    Mar 9, 2007
  5. Jason

    wmiprvse.exe and svchost eating 100% cpu

    Jason, Mar 21, 2008, in forum: Windows Small Business Server
    Replies:
    1
    Views:
    2,504
    Russ \(SBITS.Biz\)
    Mar 22, 2008
Loading...

Share This Page