wmiprvse high cpu usage

Hello, I have about 20 servers running Windows Server 2003 R2, but one in
particular, the print server, has an issue with wmiprvse.exe taking up
70-100% of the cpu time and causing MOM to throw a critical error. It does
not seem to have an effect on printing but I suppose problems could be
happening and I don't know about them. Besides, it's not right anyway. Has
anyone seen this activity before? It's just a print server with a bunch of
IP printers shared on it and the only software I have installed is the MOM
2005 agent (which is on every server I have).

There are no errors logged in the event viewer, not even a warning.

The offending process is wmiprvse.exe, which uses anywhere between 70-100%
cpu constantly (until I terminate the process) and uses about 19,340 KB of
memory. The memory doesn't fluctuate. The process runs as a network
service. If I terminate the process the system is fine for a day or so and
then it happens again. The MOM event is recorded at different times of the
day so it doesn't happen at the same time.

Here is the MOM event:
Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
Severity: Critical Error
Description:
Extremely high processor activity detected. Processor: % Interrupt Time:
_Total value = 10.5060457064669. The average over last 6 samples is 10.506.

Any insight on why this is happening would be appreciated. I don't feel
like reformatting the server. If wmiprvse.exe is the problem, could it be a
hardware issue?

Thanks a lot!
Josh

We see the same problem here on ONE of our Windows 2003 R2 servers that MOM
(2005) has identified as a print server.

The issue could be with a MOM script called "Microsoft Windows Print Server
Detection". It is initiated in the MOM Print Server MP under "Windows (All
Versions)".

According to a log file located in C:\WINDOWS\Temp\Microsoft Operations
Manager, the script works a couple times then stops working.

Here is the error message I see ...

--- RESPONSE: 'script: Microsoft Windows Print Server Detection' failed. The
remote procedure call failed. (0x800706BE). STARTTIME: 3/24/2006 09:51:00
ENDTIME: 3/24/2006 09:56:09

The frequency that this script runs is every 30 minutes. I am changing it to
run once a day to see if the problem continues.

Robert

"Joshua Ellis" wrote:

> Hello, I have about 20 servers running Windows Server 2003 R2, but one in
> particular, the print server, has an issue with wmiprvse.exe taking up
> 70-100% of the cpu time and causing MOM to throw a critical error. It does
> not seem to have an effect on printing but I suppose problems could be
> happening and I don't know about them. Besides, it's not right anyway. Has
> anyone seen this activity before? It's just a print server with a bunch of
> IP printers shared on it and the only software I have installed is the MOM
> 2005 agent (which is on every server I have).
>
> There are no errors logged in the event viewer, not even a warning.
>
> The offending process is wmiprvse.exe, which uses anywhere between 70-100%
> cpu constantly (until I terminate the process) and uses about 19,340 KB of
> memory. The memory doesn't fluctuate. The process runs as a network
> service. If I terminate the process the system is fine for a day or so and
> then it happens again. The MOM event is recorded at different times of the
> day so it doesn't happen at the same time.
>
> Here is the MOM event:
> Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
> Severity: Critical Error
> Description:
> Extremely high processor activity detected. Processor: % Interrupt Time:
> _Total value = 10.5060457064669. The average over last 6 samples is 10.506.
>
> Any insight on why this is happening would be appreciated. I don't feel
> like reformatting the server. If wmiprvse.exe is the problem, could it be a
> hardware issue?
>
> Thanks a lot!
> Josh
>

Josh,

Is your server configured with the role as a R2 PRINT SERVER?

I ask because we have two R2 Print Servers. One is configured with the R2
PRINT SERVER role. That computer had the high CPU consumption with
wmiprvse.exe. Our other R2 server is not defined with the R2 PRINT SERVER
role and does not have the problem.

Robert

"Joshua Ellis" wrote:

> Hey Robert,
>
> Great idea. I was getting a couple other MOM errors as well, I assumed they
> were the result of the problem at the server but maybe MOM is the cause...
>
> Let me know what happens, I'm going to tweak MOM myself...
>
> Josh
>
>
> "rszkolni" wrote:
>
> > We see the same problem here on ONE of our Windows 2003 R2 servers that MOM
> > (2005) has identified as a print server.
> >
> > The issue could be with a MOM script called "Microsoft Windows Print Server
> > Detection". It is initiated in the MOM Print Server MP under "Windows (All
> > Versions)".
> >
> > According to a log file located in C:\WINDOWS\Temp\Microsoft Operations
> > Manager, the script works a couple times then stops working.
> >
> > Here is the error message I see ...
> >
> > --- RESPONSE: 'script: Microsoft Windows Print Server Detection' failed. The
> > remote procedure call failed. (0x800706BE). STARTTIME: 3/24/2006 09:51:00
> > ENDTIME: 3/24/2006 09:56:09
> >
> > The frequency that this script runs is every 30 minutes. I am changing it to
> > run once a day to see if the problem continues.
> >
> > Robert
> >
> > "Joshua Ellis" wrote:
> >
> > > Hello, I have about 20 servers running Windows Server 2003 R2, but one in
> > > particular, the print server, has an issue with wmiprvse.exe taking up
> > > 70-100% of the cpu time and causing MOM to throw a critical error. It does
> > > not seem to have an effect on printing but I suppose problems could be
> > > happening and I don't know about them. Besides, it's not right anyway. Has
> > > anyone seen this activity before? It's just a print server with a bunch of
> > > IP printers shared on it and the only software I have installed is the MOM
> > > 2005 agent (which is on every server I have).
> > >
> > > There are no errors logged in the event viewer, not even a warning.
> > >
> > > The offending process is wmiprvse.exe, which uses anywhere between 70-100%
> > > cpu constantly (until I terminate the process) and uses about 19,340 KB of
> > > memory. The memory doesn't fluctuate. The process runs as a network
> > > service. If I terminate the process the system is fine for a day or so and
> > > then it happens again. The MOM event is recorded at different times of the
> > > day so it doesn't happen at the same time.
> > >
> > > Here is the MOM event:
> > > Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
> > > Severity: Critical Error
> > > Description:
> > > Extremely high processor activity detected. Processor: % Interrupt Time:
> > > _Total value = 10.5060457064669. The average over last 6 samples is 10.506.
> > >
> > > Any insight on why this is happening would be appreciated. I don't feel
> > > like reformatting the server. If wmiprvse.exe is the problem, could it be a
> > > hardware issue?
> > >
> > > Thanks a lot!
> > > Josh
> > >

Hey Robert,

Great idea. I was getting a couple other MOM errors as well, I assumed they
were the result of the problem at the server but maybe MOM is the cause...

Let me know what happens, I'm going to tweak MOM myself...

Josh


"rszkolni" wrote:

> We see the same problem here on ONE of our Windows 2003 R2 servers that MOM
> (2005) has identified as a print server.
>
> The issue could be with a MOM script called "Microsoft Windows Print Server
> Detection". It is initiated in the MOM Print Server MP under "Windows (All
> Versions)".
>
> According to a log file located in C:\WINDOWS\Temp\Microsoft Operations
> Manager, the script works a couple times then stops working.
>
> Here is the error message I see ...
>
> --- RESPONSE: 'script: Microsoft Windows Print Server Detection' failed. The
> remote procedure call failed. (0x800706BE). STARTTIME: 3/24/2006 09:51:00
> ENDTIME: 3/24/2006 09:56:09
>
> The frequency that this script runs is every 30 minutes. I am changing it to
> run once a day to see if the problem continues.
>
> Robert
>
> "Joshua Ellis" wrote:
>
> > Hello, I have about 20 servers running Windows Server 2003 R2, but one in
> > particular, the print server, has an issue with wmiprvse.exe taking up
> > 70-100% of the cpu time and causing MOM to throw a critical error. It does
> > not seem to have an effect on printing but I suppose problems could be
> > happening and I don't know about them. Besides, it's not right anyway. Has
> > anyone seen this activity before? It's just a print server with a bunch of
> > IP printers shared on it and the only software I have installed is the MOM
> > 2005 agent (which is on every server I have).
> >
> > There are no errors logged in the event viewer, not even a warning.
> >
> > The offending process is wmiprvse.exe, which uses anywhere between 70-100%
> > cpu constantly (until I terminate the process) and uses about 19,340 KB of
> > memory. The memory doesn't fluctuate. The process runs as a network
> > service. If I terminate the process the system is fine for a day or so and
> > then it happens again. The MOM event is recorded at different times of the
> > day so it doesn't happen at the same time.
> >
> > Here is the MOM event:
> > Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
> > Severity: Critical Error
> > Description:
> > Extremely high processor activity detected. Processor: % Interrupt Time:
> > _Total value = 10.5060457064669. The average over last 6 samples is 10.506.
> >
> > Any insight on why this is happening would be appreciated. I don't feel
> > like reformatting the server. If wmiprvse.exe is the problem, could it be a
> > hardware issue?
> >
> > Thanks a lot!
> > Josh
> >

Robert,

Yes it is configured with the print server role. I don't have any other
servers with that role and none of them are showing the problem either.

I want to figure out what wmiprvse.exe is doing when it is so busy. I
wonder if it has anything to do with the performance measuring. There are 7
counters that run every 15 minutes and one (thread count) that runs every 5
minutes.

Did you notice any change when you changed the frequency of that alert?

Josh


"rszkolni" wrote:

> Josh,
>
> Is your server configured with the role as a R2 PRINT SERVER?
>
> I ask because we have two R2 Print Servers. One is configured with the R2
> PRINT SERVER role. That computer had the high CPU consumption with
> wmiprvse.exe. Our other R2 server is not defined with the R2 PRINT SERVER
> role and does not have the problem.
>
> Robert
>
> "Joshua Ellis" wrote:
>
> > Hey Robert,
> >
> > Great idea. I was getting a couple other MOM errors as well, I assumed they
> > were the result of the problem at the server but maybe MOM is the cause...
> >
> > Let me know what happens, I'm going to tweak MOM myself...
> >
> > Josh
> >
> >
> > "rszkolni" wrote:
> >
> > > We see the same problem here on ONE of our Windows 2003 R2 servers that MOM
> > > (2005) has identified as a print server.
> > >
> > > The issue could be with a MOM script called "Microsoft Windows Print Server
> > > Detection". It is initiated in the MOM Print Server MP under "Windows (All
> > > Versions)".
> > >
> > > According to a log file located in C:\WINDOWS\Temp\Microsoft Operations
> > > Manager, the script works a couple times then stops working.
> > >
> > > Here is the error message I see ...
> > >
> > > --- RESPONSE: 'script: Microsoft Windows Print Server Detection' failed. The
> > > remote procedure call failed. (0x800706BE). STARTTIME: 3/24/2006 09:51:00
> > > ENDTIME: 3/24/2006 09:56:09
> > >
> > > The frequency that this script runs is every 30 minutes. I am changing it to
> > > run once a day to see if the problem continues.
> > >
> > > Robert
> > >
> > > "Joshua Ellis" wrote:
> > >
> > > > Hello, I have about 20 servers running Windows Server 2003 R2, but one in
> > > > particular, the print server, has an issue with wmiprvse.exe taking up
> > > > 70-100% of the cpu time and causing MOM to throw a critical error. It does
> > > > not seem to have an effect on printing but I suppose problems could be
> > > > happening and I don't know about them. Besides, it's not right anyway. Has
> > > > anyone seen this activity before? It's just a print server with a bunch of
> > > > IP printers shared on it and the only software I have installed is the MOM
> > > > 2005 agent (which is on every server I have).
> > > >
> > > > There are no errors logged in the event viewer, not even a warning.
> > > >
> > > > The offending process is wmiprvse.exe, which uses anywhere between 70-100%
> > > > cpu constantly (until I terminate the process) and uses about 19,340 KB of
> > > > memory. The memory doesn't fluctuate. The process runs as a network
> > > > service. If I terminate the process the system is fine for a day or so and
> > > > then it happens again. The MOM event is recorded at different times of the
> > > > day so it doesn't happen at the same time.
> > > >
> > > > Here is the MOM event:
> > > > Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
> > > > Severity: Critical Error
> > > > Description:
> > > > Extremely high processor activity detected. Processor: % Interrupt Time:
> > > > _Total value = 10.5060457064669. The average over last 6 samples is 10.506.
> > > >
> > > > Any insight on why this is happening would be appreciated. I don't feel
> > > > like reformatting the server. If wmiprvse.exe is the problem, could it be a
> > > > hardware issue?
> > > >
> > > > Thanks a lot!
> > > > Josh
> > > >

Just to confirm Josh, that is the "R2 print server role" and not just the
regular print server role?

Changing the frequency of the alert/script looks like it has just delayed
the period of high CPU consumption. I've had perfmon running all weekend, and
I see the CPU utilization go up each time (once a day) the MOM script runs.

The FAQ for R2 has a small note about WMI ...

http://www.microsoft.com/windowsserv.../R2/R2FAQ.mspx

.... so there is likely some change in Windows that I am suspecting the R2
print server role brings in and that the Management Pack script doesn't work
well with. This is just a theory. We are going to try a test with a new R2
server - install MOM, watch the CPU, add the R2 print server role, and see
what happens.

Robert

"Joshua Ellis" wrote:

> Robert,
>
> Yes it is configured with the print server role. I don't have any other
> servers with that role and none of them are showing the problem either.
>
> I want to figure out what wmiprvse.exe is doing when it is so busy. I
> wonder if it has anything to do with the performance measuring. There are 7
> counters that run every 15 minutes and one (thread count) that runs every 5
> minutes.
>
> Did you notice any change when you changed the frequency of that alert?
>
> Josh
>
>
> "rszkolni" wrote:
>
> > Josh,
> >
> > Is your server configured with the role as a R2 PRINT SERVER?
> >
> > I ask because we have two R2 Print Servers. One is configured with the R2
> > PRINT SERVER role. That computer had the high CPU consumption with
> > wmiprvse.exe. Our other R2 server is not defined with the R2 PRINT SERVER
> > role and does not have the problem.
> >
> > Robert
> >
> > "Joshua Ellis" wrote:
> >
> > > Hey Robert,
> > >
> > > Great idea. I was getting a couple other MOM errors as well, I assumed they
> > > were the result of the problem at the server but maybe MOM is the cause...
> > >
> > > Let me know what happens, I'm going to tweak MOM myself...
> > >
> > > Josh
> > >
> > >
> > > "rszkolni" wrote:
> > >
> > > > We see the same problem here on ONE of our Windows 2003 R2 servers that MOM
> > > > (2005) has identified as a print server.
> > > >
> > > > The issue could be with a MOM script called "Microsoft Windows Print Server
> > > > Detection". It is initiated in the MOM Print Server MP under "Windows (All
> > > > Versions)".
> > > >
> > > > According to a log file located in C:\WINDOWS\Temp\Microsoft Operations
> > > > Manager, the script works a couple times then stops working.
> > > >
> > > > Here is the error message I see ...
> > > >
> > > > --- RESPONSE: 'script: Microsoft Windows Print Server Detection' failed. The
> > > > remote procedure call failed. (0x800706BE). STARTTIME: 3/24/2006 09:51:00
> > > > ENDTIME: 3/24/2006 09:56:09
> > > >
> > > > The frequency that this script runs is every 30 minutes. I am changing it to
> > > > run once a day to see if the problem continues.
> > > >
> > > > Robert
> > > >
> > > > "Joshua Ellis" wrote:
> > > >
> > > > > Hello, I have about 20 servers running Windows Server 2003 R2, but one in
> > > > > particular, the print server, has an issue with wmiprvse.exe taking up
> > > > > 70-100% of the cpu time and causing MOM to throw a critical error. It does
> > > > > not seem to have an effect on printing but I suppose problems could be
> > > > > happening and I don't know about them. Besides, it's not right anyway. Has
> > > > > anyone seen this activity before? It's just a print server with a bunch of
> > > > > IP printers shared on it and the only software I have installed is the MOM
> > > > > 2005 agent (which is on every server I have).
> > > > >
> > > > > There are no errors logged in the event viewer, not even a warning.
> > > > >
> > > > > The offending process is wmiprvse.exe, which uses anywhere between 70-100%
> > > > > cpu constantly (until I terminate the process) and uses about 19,340 KB of
> > > > > memory. The memory doesn't fluctuate. The process runs as a network
> > > > > service. If I terminate the process the system is fine for a day or so and
> > > > > then it happens again. The MOM event is recorded at different times of the
> > > > > day so it doesn't happen at the same time.
> > > > >
> > > > > Here is the MOM event:
> > > > > Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
> > > > > Severity: Critical Error
> > > > > Description:
> > > > > Extremely high processor activity detected. Processor: % Interrupt Time:
> > > > > _Total value = 10.5060457064669. The average over last 6 samples is 10.506.
> > > > >
> > > > > Any insight on why this is happening would be appreciated. I don't feel
> > > > > like reformatting the server. If wmiprvse.exe is the problem, could it be a
> > > > > hardware issue?
> > > > >
> > > > > Thanks a lot!
> > > > > Josh
> > > > >

Yes it is R2, however I was having this issue before I went to R2 as well.
As a matter of fact I was having this issue before SP1. I was hoping through
a combination of upgrading to SP1/R2 that this would go away, but it hasn't.

Tonight I'm going to try debugging the MOM scripts. I found documentation
that allows debugging by modifying HKLM\Software\Mission Critical
Software\OnePoint\EnableActiveDebugging and HKLM\Software\Mission Critical
Software\OnePoint\DebugEnabledScripts... we'll see if that turns up anything.

I also now realize that the high cpu usage warning is not occuring until
about 24 hours after the first script fails... here is a little log I put
together:

3-26-06 12:56 AM - Print server - State Monitoring script has been running
for 300 seconds
(13 hours elapsed with no events)
3-26-06 1:56 PM - Same as above
(4 hours elapsed with no events)
3-26-06 5:56 PM - Microsoft Windows Print Server Detection script has been
running for 300 seconds
(7 hours elapsed with no events)
3-27-06 12:56 AM - Both scripts have been running for 300 seconds
3-27-06 1:21 AM - HIGH CPU USAGE CRITICAL ERROR REPORTED BY MOM
3-27-06 1:26 AM - Print server detection script has been running for 300
seconds
3-27-06 1:56 AM - Both scripts have been running for 300 seconds
3-27-06 2:26 AM - Print server detection script has been running for 300
seconds
3-27-06 2:56 AM - Both scripts have been running for 300 seconds
3-27-06 3:26 AM - Print server detection script has been running for 300
seconds

This went on for a few more hours (though becoming less frequent) until I
shut down wmiprvse.exe this morning when I came in.

Again hopefully the script debugging will point out some errors that are
occuring, but I will have to wait because, like you know, this problem
doesn't reproduce right away...

Josh


"rszkolni" wrote:

> Just to confirm Josh, that is the "R2 print server role" and not just the
> regular print server role?
>
> Changing the frequency of the alert/script looks like it has just delayed
> the period of high CPU consumption. I've had perfmon running all weekend, and
> I see the CPU utilization go up each time (once a day) the MOM script runs.
>
> The FAQ for R2 has a small note about WMI ...
>
> http://www.microsoft.com/windowsserv.../R2/R2FAQ.mspx
>
> ... so there is likely some change in Windows that I am suspecting the R2
> print server role brings in and that the Management Pack script doesn't work
> well with. This is just a theory. We are going to try a test with a new R2
> server - install MOM, watch the CPU, add the R2 print server role, and see
> what happens.
>
> Robert
>
> "Joshua Ellis" wrote:
>
> > Robert,
> >
> > Yes it is configured with the print server role. I don't have any other
> > servers with that role and none of them are showing the problem either.
> >
> > I want to figure out what wmiprvse.exe is doing when it is so busy. I
> > wonder if it has anything to do with the performance measuring. There are 7
> > counters that run every 15 minutes and one (thread count) that runs every 5
> > minutes.
> >
> > Did you notice any change when you changed the frequency of that alert?
> >
> > Josh
> >
> >
> > "rszkolni" wrote:
> >
> > > Josh,
> > >
> > > Is your server configured with the role as a R2 PRINT SERVER?
> > >
> > > I ask because we have two R2 Print Servers. One is configured with the R2
> > > PRINT SERVER role. That computer had the high CPU consumption with
> > > wmiprvse.exe. Our other R2 server is not defined with the R2 PRINT SERVER
> > > role and does not have the problem.
> > >
> > > Robert
> > >
> > > "Joshua Ellis" wrote:
> > >
> > > > Hey Robert,
> > > >
> > > > Great idea. I was getting a couple other MOM errors as well, I assumed they
> > > > were the result of the problem at the server but maybe MOM is the cause...
> > > >
> > > > Let me know what happens, I'm going to tweak MOM myself...
> > > >
> > > > Josh
> > > >
> > > >
> > > > "rszkolni" wrote:
> > > >
> > > > > We see the same problem here on ONE of our Windows 2003 R2 servers that MOM
> > > > > (2005) has identified as a print server.
> > > > >
> > > > > The issue could be with a MOM script called "Microsoft Windows Print Server
> > > > > Detection". It is initiated in the MOM Print Server MP under "Windows (All
> > > > > Versions)".
> > > > >
> > > > > According to a log file located in C:\WINDOWS\Temp\Microsoft Operations
> > > > > Manager, the script works a couple times then stops working.
> > > > >
> > > > > Here is the error message I see ...
> > > > >
> > > > > --- RESPONSE: 'script: Microsoft Windows Print Server Detection' failed. The
> > > > > remote procedure call failed. (0x800706BE). STARTTIME: 3/24/2006 09:51:00
> > > > > ENDTIME: 3/24/2006 09:56:09
> > > > >
> > > > > The frequency that this script runs is every 30 minutes. I am changing it to
> > > > > run once a day to see if the problem continues.
> > > > >
> > > > > Robert
> > > > >
> > > > > "Joshua Ellis" wrote:
> > > > >
> > > > > > Hello, I have about 20 servers running Windows Server 2003 R2, but one in
> > > > > > particular, the print server, has an issue with wmiprvse.exe taking up
> > > > > > 70-100% of the cpu time and causing MOM to throw a critical error. It does
> > > > > > not seem to have an effect on printing but I suppose problems could be
> > > > > > happening and I don't know about them. Besides, it's not right anyway. Has
> > > > > > anyone seen this activity before? It's just a print server with a bunch of
> > > > > > IP printers shared on it and the only software I have installed is the MOM
> > > > > > 2005 agent (which is on every server I have).
> > > > > >
> > > > > > There are no errors logged in the event viewer, not even a warning.
> > > > > >
> > > > > > The offending process is wmiprvse.exe, which uses anywhere between 70-100%
> > > > > > cpu constantly (until I terminate the process) and uses about 19,340 KB of
> > > > > > memory. The memory doesn't fluctuate. The process runs as a network
> > > > > > service. If I terminate the process the system is fine for a day or so and
> > > > > > then it happens again. The MOM event is recorded at different times of the
> > > > > > day so it doesn't happen at the same time.
> > > > > >
> > > > > > Here is the MOM event:
> > > > > > Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
> > > > > > Severity: Critical Error
> > > > > > Description:
> > > > > > Extremely high processor activity detected. Processor: % Interrupt Time:
> > > > > > _Total value = 10.5060457064669. The average over last 6 samples is 10.506.
> > > > > >
> > > > > > Any insight on why this is happening would be appreciated. I don't feel
> > > > > > like reformatting the server. If wmiprvse.exe is the problem, could it be a
> > > > > > hardware issue?
> > > > > >
> > > > > > Thanks a lot!
> > > > > > Josh
> > > > > >

A small note about script debugging which I referenced earlier.

Here is some online doc on MOM script debugging...

http://msdn.microsoft.com/library/de...gDebugging.asp

Once you do this and restart the MOM agent service, a file appears in

C:\WINDOWS\Temp\Microsoft Operations Manager on the MOM client

called

AgentResponses-xxx.txt which shows the scripts that are running on the
monitored server. That is where I see the scripts working/not-working.

The downside of turning on debugging, is that you get a message in the
Windows Event Log saying that a script debugger is not installed. I installed
the one here ...

http://www.microsoft.com/downloads/d...DisplayLang=en

just to get rid of the message in the event log.

"rszkolni" wrote:

> Just to confirm Josh, that is the "R2 print server role" and not just the
> regular print server role?
>
> Changing the frequency of the alert/script looks like it has just delayed
> the period of high CPU consumption. I've had perfmon running all weekend, and
> I see the CPU utilization go up each time (once a day) the MOM script runs.
>
> The FAQ for R2 has a small note about WMI ...
>
> http://www.microsoft.com/windowsserv.../R2/R2FAQ.mspx
>
> ... so there is likely some change in Windows that I am suspecting the R2
> print server role brings in and that the Management Pack script doesn't work
> well with. This is just a theory. We are going to try a test with a new R2
> server - install MOM, watch the CPU, add the R2 print server role, and see
> what happens.
>
> Robert
>
> "Joshua Ellis" wrote:
>
> > Robert,
> >
> > Yes it is configured with the print server role. I don't have any other
> > servers with that role and none of them are showing the problem either.
> >
> > I want to figure out what wmiprvse.exe is doing when it is so busy. I
> > wonder if it has anything to do with the performance measuring. There are 7
> > counters that run every 15 minutes and one (thread count) that runs every 5
> > minutes.
> >
> > Did you notice any change when you changed the frequency of that alert?
> >
> > Josh
> >
> >
> > "rszkolni" wrote:
> >
> > > Josh,
> > >
> > > Is your server configured with the role as a R2 PRINT SERVER?
> > >
> > > I ask because we have two R2 Print Servers. One is configured with the R2
> > > PRINT SERVER role. That computer had the high CPU consumption with
> > > wmiprvse.exe. Our other R2 server is not defined with the R2 PRINT SERVER
> > > role and does not have the problem.
> > >
> > > Robert
> > >
> > > "Joshua Ellis" wrote:
> > >
> > > > Hey Robert,
> > > >
> > > > Great idea. I was getting a couple other MOM errors as well, I assumed they
> > > > were the result of the problem at the server but maybe MOM is the cause...
> > > >
> > > > Let me know what happens, I'm going to tweak MOM myself...
> > > >
> > > > Josh
> > > >
> > > >
> > > > "rszkolni" wrote:
> > > >
> > > > > We see the same problem here on ONE of our Windows 2003 R2 servers that MOM
> > > > > (2005) has identified as a print server.
> > > > >
> > > > > The issue could be with a MOM script called "Microsoft Windows Print Server
> > > > > Detection". It is initiated in the MOM Print Server MP under "Windows (All
> > > > > Versions)".
> > > > >
> > > > > According to a log file located in C:\WINDOWS\Temp\Microsoft Operations
> > > > > Manager, the script works a couple times then stops working.
> > > > >
> > > > > Here is the error message I see ...
> > > > >
> > > > > --- RESPONSE: 'script: Microsoft Windows Print Server Detection' failed. The
> > > > > remote procedure call failed. (0x800706BE). STARTTIME: 3/24/2006 09:51:00
> > > > > ENDTIME: 3/24/2006 09:56:09
> > > > >
> > > > > The frequency that this script runs is every 30 minutes. I am changing it to
> > > > > run once a day to see if the problem continues.
> > > > >
> > > > > Robert
> > > > >
> > > > > "Joshua Ellis" wrote:
> > > > >
> > > > > > Hello, I have about 20 servers running Windows Server 2003 R2, but one in
> > > > > > particular, the print server, has an issue with wmiprvse.exe taking up
> > > > > > 70-100% of the cpu time and causing MOM to throw a critical error. It does
> > > > > > not seem to have an effect on printing but I suppose problems could be
> > > > > > happening and I don't know about them. Besides, it's not right anyway. Has
> > > > > > anyone seen this activity before? It's just a print server with a bunch of
> > > > > > IP printers shared on it and the only software I have installed is the MOM
> > > > > > 2005 agent (which is on every server I have).
> > > > > >
> > > > > > There are no errors logged in the event viewer, not even a warning.
> > > > > >
> > > > > > The offending process is wmiprvse.exe, which uses anywhere between 70-100%
> > > > > > cpu constantly (until I terminate the process) and uses about 19,340 KB of
> > > > > > memory. The memory doesn't fluctuate. The process runs as a network
> > > > > > service. If I terminate the process the system is fine for a day or so and
> > > > > > then it happens again. The MOM event is recorded at different times of the
> > > > > > day so it doesn't happen at the same time.
> > > > > >
> > > > > > Here is the MOM event:
> > > > > > Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
> > > > > > Severity: Critical Error
> > > > > > Description:
> > > > > > Extremely high processor activity detected. Processor: % Interrupt Time:
> > > > > > _Total value = 10.5060457064669. The average over last 6 samples is 10.506.
> > > > > >
> > > > > > Any insight on why this is happening would be appreciated. I don't feel
> > > > > > like reformatting the server. If wmiprvse.exe is the problem, could it be a
> > > > > > hardware issue?
> > > > > >
> > > > > > Thanks a lot!
> > > > > > Josh
> > > > > >

Good info to know. So perhaps its not related to R2.

I'm really thinking about disabling the problem script since in theory, MOM
has already detected my print server. Why does it have to continue detect
something it already knows about. Its not like we are adding print servers
every day around here. Now this may not work for anyone else, but it should
work for us.

If you want to speed up the occurrence of seeing this problem, you could
always modify the MOM event that triggers the script to run more frequently.
Every 30 minutes perhaps.


"Joshua Ellis" wrote:

> Yes it is R2, however I was having this issue before I went to R2 as well.
> As a matter of fact I was having this issue before SP1. I was hoping through
> a combination of upgrading to SP1/R2 that this would go away, but it hasn't.
>
> Tonight I'm going to try debugging the MOM scripts. I found documentation
> that allows debugging by modifying HKLM\Software\Mission Critical
> Software\OnePoint\EnableActiveDebugging and HKLM\Software\Mission Critical
> Software\OnePoint\DebugEnabledScripts... we'll see if that turns up anything.
>
> I also now realize that the high cpu usage warning is not occuring until
> about 24 hours after the first script fails... here is a little log I put
> together:
>
> 3-26-06 12:56 AM - Print server - State Monitoring script has been running
> for 300 seconds
> (13 hours elapsed with no events)
> 3-26-06 1:56 PM - Same as above
> (4 hours elapsed with no events)
> 3-26-06 5:56 PM - Microsoft Windows Print Server Detection script has been
> running for 300 seconds
> (7 hours elapsed with no events)
> 3-27-06 12:56 AM - Both scripts have been running for 300 seconds
> 3-27-06 1:21 AM - HIGH CPU USAGE CRITICAL ERROR REPORTED BY MOM
> 3-27-06 1:26 AM - Print server detection script has been running for 300
> seconds
> 3-27-06 1:56 AM - Both scripts have been running for 300 seconds
> 3-27-06 2:26 AM - Print server detection script has been running for 300
> seconds
> 3-27-06 2:56 AM - Both scripts have been running for 300 seconds
> 3-27-06 3:26 AM - Print server detection script has been running for 300
> seconds
>
> This went on for a few more hours (though becoming less frequent) until I
> shut down wmiprvse.exe this morning when I came in.
>
> Again hopefully the script debugging will point out some errors that are
> occuring, but I will have to wait because, like you know, this problem
> doesn't reproduce right away...
>
> Josh
>
>
> "rszkolni" wrote:
>
> > Just to confirm Josh, that is the "R2 print server role" and not just the
> > regular print server role?
> >
> > Changing the frequency of the alert/script looks like it has just delayed
> > the period of high CPU consumption. I've had perfmon running all weekend, and
> > I see the CPU utilization go up each time (once a day) the MOM script runs.
> >
> > The FAQ for R2 has a small note about WMI ...
> >
> > http://www.microsoft.com/windowsserv.../R2/R2FAQ.mspx
> >
> > ... so there is likely some change in Windows that I am suspecting the R2
> > print server role brings in and that the Management Pack script doesn't work
> > well with. This is just a theory. We are going to try a test with a new R2
> > server - install MOM, watch the CPU, add the R2 print server role, and see
> > what happens.
> >
> > Robert
> >
> > "Joshua Ellis" wrote:
> >
> > > Robert,
> > >
> > > Yes it is configured with the print server role. I don't have any other
> > > servers with that role and none of them are showing the problem either.
> > >
> > > I want to figure out what wmiprvse.exe is doing when it is so busy. I
> > > wonder if it has anything to do with the performance measuring. There are 7
> > > counters that run every 15 minutes and one (thread count) that runs every 5
> > > minutes.
> > >
> > > Did you notice any change when you changed the frequency of that alert?
> > >
> > > Josh
> > >
> > >
> > > "rszkolni" wrote:
> > >
> > > > Josh,
> > > >
> > > > Is your server configured with the role as a R2 PRINT SERVER?
> > > >
> > > > I ask because we have two R2 Print Servers. One is configured with the R2
> > > > PRINT SERVER role. That computer had the high CPU consumption with
> > > > wmiprvse.exe. Our other R2 server is not defined with the R2 PRINT SERVER
> > > > role and does not have the problem.
> > > >
> > > > Robert
> > > >
> > > > "Joshua Ellis" wrote:
> > > >
> > > > > Hey Robert,
> > > > >
> > > > > Great idea. I was getting a couple other MOM errors as well, I assumed they
> > > > > were the result of the problem at the server but maybe MOM is the cause...
> > > > >
> > > > > Let me know what happens, I'm going to tweak MOM myself...
> > > > >
> > > > > Josh
> > > > >
> > > > >
> > > > > "rszkolni" wrote:
> > > > >
> > > > > > We see the same problem here on ONE of our Windows 2003 R2 servers that MOM
> > > > > > (2005) has identified as a print server.
> > > > > >
> > > > > > The issue could be with a MOM script called "Microsoft Windows Print Server
> > > > > > Detection". It is initiated in the MOM Print Server MP under "Windows (All
> > > > > > Versions)".
> > > > > >
> > > > > > According to a log file located in C:\WINDOWS\Temp\Microsoft Operations
> > > > > > Manager, the script works a couple times then stops working.
> > > > > >
> > > > > > Here is the error message I see ...
> > > > > >
> > > > > > --- RESPONSE: 'script: Microsoft Windows Print Server Detection' failed. The
> > > > > > remote procedure call failed. (0x800706BE). STARTTIME: 3/24/2006 09:51:00
> > > > > > ENDTIME: 3/24/2006 09:56:09
> > > > > >
> > > > > > The frequency that this script runs is every 30 minutes. I am changing it to
> > > > > > run once a day to see if the problem continues.
> > > > > >
> > > > > > Robert
> > > > > >
> > > > > > "Joshua Ellis" wrote:
> > > > > >
> > > > > > > Hello, I have about 20 servers running Windows Server 2003 R2, but one in
> > > > > > > particular, the print server, has an issue with wmiprvse.exe taking up
> > > > > > > 70-100% of the cpu time and causing MOM to throw a critical error. It does
> > > > > > > not seem to have an effect on printing but I suppose problems could be
> > > > > > > happening and I don't know about them. Besides, it's not right anyway. Has
> > > > > > > anyone seen this activity before? It's just a print server with a bunch of
> > > > > > > IP printers shared on it and the only software I have installed is the MOM
> > > > > > > 2005 agent (which is on every server I have).
> > > > > > >
> > > > > > > There are no errors logged in the event viewer, not even a warning.
> > > > > > >
> > > > > > > The offending process is wmiprvse.exe, which uses anywhere between 70-100%
> > > > > > > cpu constantly (until I terminate the process) and uses about 19,340 KB of
> > > > > > > memory. The memory doesn't fluctuate. The process runs as a network
> > > > > > > service. If I terminate the process the system is fine for a day or so and
> > > > > > > then it happens again. The MOM event is recorded at different times of the
> > > > > > > day so it doesn't happen at the same time.
> > > > > > >
> > > > > > > Here is the MOM event:
> > > > > > > Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
> > > > > > > Severity: Critical Error
> > > > > > > Description:
> > > > > > > Extremely high processor activity detected. Processor: % Interrupt Time:
> > > > > > > _Total value = 10.5060457064669. The average over last 6 samples is 10.506.
> > > > > > >
> > > > > > > Any insight on why this is happening would be appreciated. I don't feel
> > > > > > > like reformatting the server. If wmiprvse.exe is the problem, could it be a
> > > > > > > hardware issue?
> > > > > > >
> > > > > > > Thanks a lot!
> > > > > > > Josh
> > > > > > >

Okay well the debugging revealed nothing. Here is all the was put in
the log:

--- RESPONSE: 'script: Print Server - State Monitoring' failed. The
remote procedure call failed. (0x800706BE). STARTTIME: 3/28/2006
04:51:00 ENDTIME: 3/28/2006 04:56:10

I looked up that failure code on support.microsoft.com and turned up
nothing right away, though admittedly I didn't look too long.

I was thinking about disabling the script as well but I'm actually
having a problem with two scripts: the print server detection, which I
agree, seems to serve no purpose to me anymore; but, also the state
monitoring script. If I disable that it seems that it would effectively
disable one of the main reasons for monitoring a print server.

I'm going to continue logging because even though these scripts have
both failed already, wmiprvse.exe hasn't gone into its loop yet. Maybe
I'll get more information then.

Josh


rszkolni wrote:
> Good info to know. So perhaps its not related to R2.
>
> I'm really thinking about disabling the problem script since in theory, MOM
> has already detected my print server. Why does it have to continue detect
> something it already knows about. Its not like we are adding print servers
> every day around here. Now this may not work for anyone else, but it should
> work for us.
>
> If you want to speed up the occurrence of seeing this problem, you could
> always modify the MOM event that triggers the script to run more frequently.
> Every 30 minutes perhaps.
>
>
> "Joshua Ellis" wrote:
>
>> Yes it is R2, however I was having this issue before I went to R2 as well.
>> As a matter of fact I was having this issue before SP1. I was hoping through
>> a combination of upgrading to SP1/R2 that this would go away, but it hasn't.
>>
>> Tonight I'm going to try debugging the MOM scripts. I found documentation
>> that allows debugging by modifying HKLM\Software\Mission Critical
>> Software\OnePoint\EnableActiveDebugging and HKLM\Software\Mission Critical
>> Software\OnePoint\DebugEnabledScripts... we'll see if that turns up anything.
>>
>> I also now realize that the high cpu usage warning is not occuring until
>> about 24 hours after the first script fails... here is a little log I put
>> together:
>>
>> 3-26-06 12:56 AM - Print server - State Monitoring script has been running
>> for 300 seconds
>> (13 hours elapsed with no events)
>> 3-26-06 1:56 PM - Same as above
>> (4 hours elapsed with no events)
>> 3-26-06 5:56 PM - Microsoft Windows Print Server Detection script has been
>> running for 300 seconds
>> (7 hours elapsed with no events)
>> 3-27-06 12:56 AM - Both scripts have been running for 300 seconds
>> 3-27-06 1:21 AM - HIGH CPU USAGE CRITICAL ERROR REPORTED BY MOM
>> 3-27-06 1:26 AM - Print server detection script has been running for 300
>> seconds
>> 3-27-06 1:56 AM - Both scripts have been running for 300 seconds
>> 3-27-06 2:26 AM - Print server detection script has been running for 300
>> seconds
>> 3-27-06 2:56 AM - Both scripts have been running for 300 seconds
>> 3-27-06 3:26 AM - Print server detection script has been running for 300
>> seconds
>>
>> This went on for a few more hours (though becoming less frequent) until I
>> shut down wmiprvse.exe this morning when I came in.
>>
>> Again hopefully the script debugging will point out some errors that are
>> occuring, but I will have to wait because, like you know, this problem
>> doesn't reproduce right away...
>>
>> Josh
>>
>>
>> "rszkolni" wrote:
>>
>>> Just to confirm Josh, that is the "R2 print server role" and not just the
>>> regular print server role?
>>>
>>> Changing the frequency of the alert/script looks like it has just delayed
>>> the period of high CPU consumption. I've had perfmon running all weekend, and
>>> I see the CPU utilization go up each time (once a day) the MOM script runs.
>>>
>>> The FAQ for R2 has a small note about WMI ...
>>>
>>> http://www.microsoft.com/windowsserv.../R2/R2FAQ.mspx
>>>
>>> ... so there is likely some change in Windows that I am suspecting the R2
>>> print server role brings in and that the Management Pack script doesn't work
>>> well with. This is just a theory. We are going to try a test with a new R2
>>> server - install MOM, watch the CPU, add the R2 print server role, and see
>>> what happens.
>>>
>>> Robert
>>>
>>> "Joshua Ellis" wrote:
>>>
>>>> Robert,
>>>>
>>>> Yes it is configured with the print server role. I don't have any other
>>>> servers with that role and none of them are showing the problem either.
>>>>
>>>> I want to figure out what wmiprvse.exe is doing when it is so busy. I
>>>> wonder if it has anything to do with the performance measuring. There are 7
>>>> counters that run every 15 minutes and one (thread count) that runs every 5
>>>> minutes.
>>>>
>>>> Did you notice any change when you changed the frequency of that alert?
>>>>
>>>> Josh
>>>>
>>>>
>>>> "rszkolni" wrote:
>>>>
>>>>> Josh,
>>>>>
>>>>> Is your server configured with the role as a R2 PRINT SERVER?
>>>>>
>>>>> I ask because we have two R2 Print Servers. One is configured with the R2
>>>>> PRINT SERVER role. That computer had the high CPU consumption with
>>>>> wmiprvse.exe. Our other R2 server is not defined with the R2 PRINT SERVER
>>>>> role and does not have the problem.
>>>>>
>>>>> Robert
>>>>>
>>>>> "Joshua Ellis" wrote:
>>>>>
>>>>>> Hey Robert,
>>>>>>
>>>>>> Great idea. I was getting a couple other MOM errors as well, I assumed they
>>>>>> were the result of the problem at the server but maybe MOM is the cause...
>>>>>>
>>>>>> Let me know what happens, I'm going to tweak MOM myself...
>>>>>>
>>>>>> Josh
>>>>>>
>>>>>>
>>>>>> "rszkolni" wrote:
>>>>>>
>>>>>>> We see the same problem here on ONE of our Windows 2003 R2 servers that MOM
>>>>>>> (2005) has identified as a print server.
>>>>>>>
>>>>>>> The issue could be with a MOM script called "Microsoft Windows Print Server
>>>>>>> Detection". It is initiated in the MOM Print Server MP under "Windows (All
>>>>>>> Versions)".
>>>>>>>
>>>>>>> According to a log file located in C:\WINDOWS\Temp\Microsoft Operations
>>>>>>> Manager, the script works a couple times then stops working.
>>>>>>>
>>>>>>> Here is the error message I see ...
>>>>>>>
>>>>>>> --- RESPONSE: 'script: Microsoft Windows Print Server Detection' failed. The
>>>>>>> remote procedure call failed. (0x800706BE). STARTTIME: 3/24/2006 09:51:00
>>>>>>> ENDTIME: 3/24/2006 09:56:09
>>>>>>>
>>>>>>> The frequency that this script runs is every 30 minutes. I am changing it to
>>>>>>> run once a day to see if the problem continues.
>>>>>>>
>>>>>>> Robert
>>>>>>>
>>>>>>> "Joshua Ellis" wrote:
>>>>>>>
>>>>>>>> Hello, I have about 20 servers running Windows Server 2003 R2, but one in
>>>>>>>> particular, the print server, has an issue with wmiprvse.exe taking up
>>>>>>>> 70-100% of the cpu time and causing MOM to throw a critical error. It does
>>>>>>>> not seem to have an effect on printing but I suppose problems could be
>>>>>>>> happening and I don't know about them. Besides, it's not right anyway. Has
>>>>>>>> anyone seen this activity before? It's just a print server with a bunch of
>>>>>>>> IP printers shared on it and the only software I have installed is the MOM
>>>>>>>> 2005 agent (which is on every server I have).
>>>>>>>>
>>>>>>>> There are no errors logged in the event viewer, not even a warning.
>>>>>>>>
>>>>>>>> The offending process is wmiprvse.exe, which uses anywhere between 70-100%
>>>>>>>> cpu constantly (until I terminate the process) and uses about 19,340 KB of
>>>>>>>> memory. The memory doesn't fluctuate. The process runs as a network
>>>>>>>> service. If I terminate the process the system is fine for a day or so and
>>>>>>>> then it happens again. The MOM event is recorded at different times of the
>>>>>>>> day so it doesn't happen at the same time.
>>>>>>>>
>>>>>>>> Here is the MOM event:
>>>>>>>> Name: Performance Threshold: Processor\% Interrupt Time threshold exceeded.
>>>>>>>> Severity: Critical Error
>>>>>>>> Description:
>>>>>>>> Extremely high processor activity detected. Processor: % Interrupt Time:
>>>>>>>> _Total value = 10.5060457064669. The average over last 6 samples is 10.506.
>>>>>>>>
>>>>>>>> Any insight on why this is happening would be appreciated. I don't feel
>>>>>>>> like reformatting the server. If wmiprvse.exe is the problem, could it be a
>>>>>>>> hardware issue?
>>>>>>>>
>>>>>>>> Thanks a lot!
>>>>>>>> Josh
>>>>>>>>