3

I have a server using 10-25% of the CPU time on Hardware Interrupts according to Process Explorer.

How would I go about logging/diagnosing the cause of all these IRQ calls?

The machine is virtual, so I know the physical hardware is not the problem (although could be drivers, etc).

UPDATE: Tried the information from this article: http://msdn.microsoft.com/en-us/library/ms797921.aspx

Regarding using tracelog.exe and tracerpt.exe to capture DPC and ISR events, but when I run the trace it doesn't have any of that information, even with the -dpcisr switch. I get disk and process info in the report but no interrupts... I know interrupts are happening because Process Explorer is still showing them using 6-15% CPU

3 Answers 3

3

KrView

Start a command promt -> go to the KRView folder

C:\Program Files\KrView\Kernrates>Kernrate_i386_XP.exe

And you get something like

Time   51354 hits, 25000 events per hit

Module                                 Hits       msec    %Tot  Events/Sec
--------                              -----      -----    ----  ----------  
intelppm                              36726      64582    71 %    14216809
ntoskrnl                               6681      64582    13 %     2586246
hal                                    5246      64582    10 %     2030751
Ntfs                                    637      64582     1 %      246585
tcpip                                 

After you press CTRL + C ( but leave it running for a while ) and this should give you a indication of where to look.

Now to track down more information regarding these drives, if you cannot guess who made the drives based on its name you can find it in your windows system folder ( tcpip would be the file tcpip.sys, right click on the file and you can see who signed it).
When searching on your favorite search engine for other people that might have simular problems i would start searching for the none microsoft once.
Be aware that the intelppm can be can be the root of your problem, but it will show very high in the list because it sends the sleep command to the cpu so its position in the output will be very high ( If you have a AMD CPU replace intelppm with a amd driver ).
As you may have noticed this does not point a nice arrow to your problem, it will still require some work from you to track down what to do with the problem is, but it should give your a help in what direction to focus you searching.

4
  • Alright how do I break down intelppm, ntkrnlpa, hal, etc into something I can match to a driver or other issue?
    – Garrett
    Jul 31, 2009 at 23:41
  • Updated reply with some more information
    – EKS
    Aug 2, 2009 at 11:55
  • My highest user is intelppm, how do I go about determining if the problem lies within?
    – Garrett
    Aug 3, 2009 at 21:55
  • Like i updated my reply, there is a chance thats is because its sending sleep commands to the CPU. But you have to search yourself a bit, i know when i did this on my server i knew there could be issues with intelppm and virtual machine 2k5 i belive.
    – EKS
    Aug 4, 2009 at 8:55
1

Try this:
KrView

The XP version of KrView works on Vista, but you need to run it as Administrator. Start a cmd shell as Administrator and run c:\program files\krview\kernrates\kernrate_i386_xp.exe while the hardware interrupt problem is occurring. Compare the results to when the problem is not occurring. This will tell you which hardware drivers are hogging the CPU.

3
  • I used the kernview.exe from the Server 2003 resource toolkit (the machine is running '03), but I didn't understand how to get the information I needed from the wealth kernview offers. Could you provide a few more steps to narrow it down to finding out what's calling the IRQs?
    – Garrett
    Jul 29, 2009 at 17:37
  • SOmtimes it happens that a broken device (HDD, IDE cable, even motherboard) makes lots of IRQ interrupts. KrView shows you which drivers use CPU the most, so you're able to determine the possible hardware issue.
    – kolypto
    Jul 30, 2009 at 2:13
  • Again, "The machine is virtual, so I know the physical hardware is not the problem"
    – Garrett
    Jul 31, 2009 at 15:50
-1

Try this: Start, Settings, Control Panel, System, Device Manager, IDE, Primary IDE Channel Properties, Advanced Settings, Set both Transfer Modes to "DMA if available".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .