wmiprvse and svchost both take 100% of the cpu for about 4 minutes per hour

Hi,

this is a repeated post originally by prem on 02/12/05.

We are using the POP3 connector and already running the KB83392 hotfix, but
with no effect on the cpu load. Still 100% once per hour for about 4
minutes...

Kind regards,
Lars Kappenberg

 

Hi Lars,

Glad to hear from you in the SBS public newsgroup.

According to your description, I understand that you encountered a
performance issue in SBS 2003. If I misunderstood your concerns, please let
me know.

In order to isolate the problem, please help gather the information:

1. Is there any error message in the event view or only high CPU load after
applied the hotfix?
2. What kinds of SBS you use, SBS 2000 or SBS 2003?
3. Is there any hardware router installed on your SBS?
4. Is there any third part anti-virus software installed on your SBS,
please temporally stop the anti-virus software to see if the problem can be
resolved:
5. Please also check the scheduler task to see if there is any task running
at the same time.
6. Please also check the POP3 components to see if it worked well or not.


More info:

835734 Many unexpected outbound e-mail messages appear in the SMTP queue in
http://support.microsoft.com/?id=835734

I appreciate your taking the time to perform the time, if you have any
further issue. Please let me know. I am standing by to be any further help.

Best regards,

Charles Yang (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

 

Dear Charles,

I will try to answer as closely as possible:

Yes, it's SBS2k3.

There is no entry in the event log, neither in application, nor in security
or system log. But a lot of entries will be written to the framework.log
throughout the day. Here is the log for one day:
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
00:45:03.373 thread:3964
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
00:45:06.668 thread:6732
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
01:45:03.456 thread:4852
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
01:45:06.060 thread:6344
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
02:45:03.311 thread:7088
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
02:45:06.475 thread:4852
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
03:45:03.208 thread:6652
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
03:45:05.662 thread:6780
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
04:45:02.401 thread:6780
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
04:45:04.704 thread:6780
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
05:45:02.601 thread:5796
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
05:45:04.924 thread:2580
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
06:45:02.069 thread:5120
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
06:45:04.903 thread:6932
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
07:45:03.966 thread:6832
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
07:45:07.590 thread:6832
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
08:45:03.282 thread:3620
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
08:45:05.955 thread:3620
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
09:45:04.275 thread:5812
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
09:45:07.379 thread:4852
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
10:45:03.537 thread:4852
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
10:45:06.501 thread:4852
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
11:45:03.403 thread:1952
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
11:45:07.117 thread:1952
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
12:45:03.423 thread:1944
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
12:45:06.207 thread:4852
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
13:45:05.137 thread:8052
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
13:45:08.010 thread:8052
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
14:45:03.722 thread:6932
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
14:45:06.616 thread:6932
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
15:45:03.110 thread:6692
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
15:45:06.064 thread:4852
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
16:45:03.622 thread:6992
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
16:45:06.756 thread:4852
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
17:45:02.188 thread:7188
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
17:45:04.471 thread:7188
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
18:45:02.158 thread:1560
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
18:45:04.531 thread:6060
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
19:45:02.339 thread:1560
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
19:45:04.462 thread:4576
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
20:45:05.749 thread:8072
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
20:45:09.224 thread:7100
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
21:45:04.161 thread:2316
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
21:45:07.225 thread:2316
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
22:45:03.738 thread:5888
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
22:45:06.902 thread:5888
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
23:45:04.230 thread:7960
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]
Device IO control returned unexpected error for Check verify: (1) 03/28/2005
23:45:07.464 thread:7656
[d:\srv03rtm\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cp
p.754]

From today I can't tell for sure if the symptom is caused by a hotfix. I set
up the server in December 2003 (I upgraded from SBS2k, which was not as
seamless as I expected, because I had to consult MSKB for many issues).

SBS 2k3 german with all the latested service packs and hotfixes.

Yes, a DreyTek Vigor 2200E, which all PCs are using for internet access. We
don't use ISA and therefor only have one NIC in our server (which is
connected to a switch which connects all (PCs, Printers and the Internet
Router).

Yes, we are running NAI Total Virus Defense (VirusScan Enterprise 7.1).
Disableing did not resolve our problem.

No tasks scheduled at the same time. But a lot of tasks running...

Abbildname PID Dienste
========================= =====
=============================================
System Idle Process 0 Nicht zutreffend
System 4 Nicht zutreffend
smss.exe 696 Nicht zutreffend
csrss.exe 796 Nicht zutreffend
winlogon.exe 820 Nicht zutreffend
services.exe 864 Eventlog, PlugPlay
lsass.exe 876 HTTPFilter, kdc, Netlogon, NtLmSsp,
PolicyAgent, ProtectedStorage, SamSs
svchost.exe 1036 RpcSs
svchost.exe 1112 TermService
svchost.exe 1336 Dhcp, Dnscache
svchost.exe 1400 LmHosts, WebClient
svchost.exe 1412 AppMgmt, BITS, Browser, CryptSvc, dmserver,
EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Messenger, Netman, Nla,
RasMan, RemoteAccess, Schedule, seclogon,
SENS, ShellHWDetection, TrkSvr, TrkWks,
W32Time, winmgmt, wuauserv, WZCSVC
lexbces.exE 1784 LexBceS
spoolsv.exe 1820 Spooler
msdtc.exe 1876 MSDTC
amgrsrvc.exe 2000 AlertManager
updsvc.exe 2020 AVUPDService
log_qtine.exe 348 Nicht zutreffend
beremote.exe 380 BackupExecAgentAccelerator
benetns.exe 432 BackupExecAgentBrowser
benser.exe 444 BackupExecNamingService
dfssvc.exe 508 Dfs
dns.exe 584 DNS
svchost.exe 604 ERSvc
inetinfo.exe 664 IISADMIN, IMAP4Svc, POP3Svc, RESvc, SMTPSVC
llssrv.exe 728 LicenseService
FrameworkService.exe 472 McAfeeFramework
Mcshield.exe 788 McShield
VsTskMgr.exe 1080 McTaskManager
naPrdMgr.exe 1200 Nicht zutreffend
sqlservr.exe 1376 MSSQL$BKUPEXEC
sqlservr.exe 1488 MSSQL$SBSMONITORING
sqlservr.exe 1600 MSSQL$SHAREPOINT
sqlservr.exe 2096 MSSQLSERVER
NAIlgpip.exe 2164 Network Associates Log Service
ntfrs.exe 2176 NtFrs
Outbreak.exe 2368 Outbreak Manager
svchost.exe 2456 RemoteRegistry
sbscrexe.exe 2472 SBCore
OWSTIMER.EXE 2564 SPTimer
svchost.exe 2588 TapiSrv
ups.exe 2612 UPS
wins.exe 2772 WINS
WMServer.exe 2984 WMServer
pvlsvr.exe 3052 BackupExecDeviceMediaService
certsrv.exe 3164 CertSvc
tcpsvcs.exe 3316 DHCPServer
fxssvc.exe 3368 Fax
exmgmt.exe 3624 MSExchangeMGMT
mad.exe 3880 MSExchangeSA
mssearch.exe 4008 MSSEARCH
sqlagent.EXE 1764 SQLAgent$SBSMONITORING
wmiprvse.exe 3704 Nicht zutreffend
sqlagent.exe 3484 SQLSERVERAGENT
wmiprvse.exe 3648 Nicht zutreffend
svchost.exe 4140 W3SVC
beserver.exe 4152 BackupExecRPCService
store.exe 4512 MSExchangeIS
emsmta.exe 4588 MSExchangeMTA
bengine.exe 4844 BackupExecJobEngine
AVExch32.exe 5348 AVExch32Service
odcmd.exe 6116 Nicht zutreffend
explorer.exe 3724 Nicht zutreffend
shstat.exe 5600 Nicht zutreffend
UpdaterUI.exe 5596 Nicht zutreffend
VxTaskbarMgr.exe 5540 Nicht zutreffend
internat.exe 5648 Nicht zutreffend
sqlmangr.exe 5668 Nicht zutreffend
SyslogRd.exe 5408 Nicht zutreffend
taskmgr.exe 5748 Nicht zutreffend
w3wp.exe 3340 Nicht zutreffend
mdm.exe 7416 Nicht zutreffend
lserver.exe 2760 TermServLicensing
imbservice.exe 7648 MSPOP3Connector
w3wp.exe 6328 Nicht zutreffend
MSIMN.EXE 7052 Nicht zutreffend
mmc.exe 7224 Nicht zutreffend
cmd.exe 5356 Nicht zutreffend
tasklist.exe 5960 Nicht zutreffend

No other task, which is not visible in scheduler, e. g. Tape Backup Job (Mo
to Fr 10pm), AV Update (daily 8pm), ExchangeAVUpdate (every 6 hours) is
scheduled to run a quarter to every full hour.

We are using the Exchange POP3 Connector to weekly collect emails not
catched by our SBS2k3 (runs on sundays 3am). Works well.

I hope you can give me another hint. As you might guess, the server is not
really responsive during these peaks (5 minutes per hour).

If you need any further log files or something else, please do not hesitate
to contact me.

As I stated in my original posting, Prem Metje from the Netherlands is
reporting the same problem. I reached him by email, he is going to reinstall
the server.

Kind regards,
Lars

 

Hi Lars,

Thanks for updates.

According to your description, I found that the SBS 2003 is not the English
version, for the policy issue we do not support non-English version SBS,
because some of the event code and information in the non-English version
is different from the English version, so in order to troubleshoot your
issue more clear, I suggest you post the public.de.windows.server.sbs.

I appreciate your understanding on this issue.

Here I would like to give you some general suggestions, as we know the
issue might be caused by the hardware firewall, for we also encounter same
issue before.

If you have any further issue, I am glad to be any further help.

Best regards,

Charles Yang (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

 

According to your description, I found that the SBS 2003 is not the
English

"Thank you" very much for your support.

I did not expect a solution in the german newsgroup, therefore I did a post
here (based on my own experience with that newsgroup since SBS 4.0).

I will perhaps ask the people of MS Direct Access about support options for
the SBS2k3 (which I took from the Action Pack Subscription).

I'm in doubt dare asking another question here.

Regards,
Lars

 

Lars... keep asking..as long as you speak English that's good enough for
us MVPs and community around this place.

I'd first try reinstalling that patch.

 

Hi Charles,

Sorry, but your attitude about the non-English version is worrying to me.
First of all, the non English stuff Lars mentioned is only the 'Nicht
zutreffend' and if that doesn't give you any clue at all, then please don't
answer at all. You are putting off people with this and it is totally
unnecessary.
Never heard of a dictionary?

People post in the English groups and in specific THIS newsgroup because of
the fast response and the quality of it. If there is a language problem, we
just try to get it clear and ask for translation.

Lars, I am sorry I don't have a real answer for you, but please keep on
asking your questions here.

--
Regards,

Marina
Microsoft SBS-MVP
One of the Magical M&M's

 

slight point of order here.

The MS staffers are required to respond to registered email addresses.

I ask MS staff to keep in mind that if the registered email address is
incorrectly looking in the wrong language group and a correct group exists
which also has a 'guaranteed response' for registered entities then asking
the user to move along is fine, but if no such local language 'guaranteed
registered response' newsgroup exists then MS have volunteered you guys, it
ain't the the poster's fault.

I'll suggest that if a post is in a foreign language and not belonging to
someone who has registered for 'guaranteed response' MS should look at it
and help or possibly comment as they deem appropriate and ignore in the hope
someone familiar with the language in question notices it.

ME. I don't care about the language of the OS. If I can understand the
question and believe I can contribute I'll try it on.

 

Thank you. I will do that.

In the meantime I found the root of all evil in the german SBS Newsgroup:

The server is configured to collect server performance data (scheduled task)
every quarter to the full hour. Another guy has had problems with his older
hard disk drive, but that doesn't hit for me I think. The SCSI Host Adapter
is an Adaptec 7890 (U2W) on an Asus P2B-LS Motherboard w/ PIII-600 and 1GB
RAM, the HDD is an IBM U2W 32GB 7.2k (this meets the requirements for
SBS2k3).

I ran PC Certify the whole night, but no errors were found.

But as long as I will upgrade the server hardware (in a few weeks) I am
using a workaround: I rescheduled the task "Serverleistungsdaten sammeln"
(roughly translated: collect server performance data) to run only once a day
out of business hours.

Thanks a a lot!

Lars

 

I ask MS staff to keep in mind that if the registered email address is

To me it seems that microsoft.public.de.windows.servers.sbs is not moderated
by microsoft. I looked the top 50 actual postings. None of the responses was
written by MS staff.

I learned my part: The next time I will try to translate log file entries,
too. (I just overlooked them).

Thx,
Lars

 

I think you'd be better served stating plainly that it is a language
specific version and doing as you have been, giving your best shot English
translation.

I would hope that the MS guys would then offer suggestion, possibly with a
caveat. I accept however that at this point this would be at their
discretion.

Meanwhile, the rest of us will help out where we can and you seem to have
implemented a workaround you find acceptable.