Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a remotely hosted (virtual, VMware) dedicated server (Windows 2008 Server Web edition w/ SP1) that I can only connect to over Remote Desktop. Lately, a process hogs CPU for ~40 minutes most every day (at a random hour) and brings all web sites on the server down. While this is going on I also cannot connect using Remote Desktop to investigate on what is that process... Promptly after 40 min I can RD and the first thing I see on the Perf Monitor is that there was something topping the CPU at 100% and stops just before I'm able to RD... I'm aware of the beginning and end of this for I have monitors setup that email me up/down status of the web sites but I'm locked out while this is happening - can't RD to the server until it's over (and too late to see the Task Manager/Process Explorer picture).

What is the best way/tool to setup on the server to continuously monitor all processes so when this happens I login and "replay" it to find the process causing this trouble?

(I have no control over the virtual/VMware setup for it is hosted by a 3rd-party but I have most full control over my dedicated machine)

Thanks in advance!

share|improve this question
A bit nit-picky perhaps but that's a VPS, not a dedicated server. – John Gardeniers May 4 '10 at 18:26
Yes, I'm considering VMware server itself as one of the potential sources, but since I have no control over it I would need to be able to prove that it is not the dedicated server's fault. – sergeb May 4 '10 at 21:27
To follow up on this - I finally figured the source of the trouble. It was the Performance Monitor that was causing the irregular 40min server downtimes ... How ironic is that? The way I found this, I logged right after one of the downtimes and found the process in question in the Process Explorer which I configured for the slowest update speed. Hope this helps someone. – sergeb Jun 7 '10 at 5:10
up vote 2 down vote accepted

If this is happening every day, could you not start up proc explorer and leave it running and disconnect from the RD session instead of logging out, that way once you are able to get logged back in you can see the immediate history?

share|improve this answer
Thank you for the suggestion. Yes, I never log out of the RD session - it is always running on the server. This has been happening almost every day recently, the trouble is that most often between 2am and 5am, so if I can't login immediately after it comes back online. I will keep the Process Explorer running although if the process in question shuts down when it stops hogging the CPU I don't think I will see in even when I login as soon as it lets the CPU go... SO I was hoping if there was a tool that'd keep the all processes activity into a log file I could "replay"... Thanks again! – sergeb May 4 '10 at 21:39
well, I think there are a couple options then, if you can log on close to the time the problem ends, if you have system information up in process explorer hovering over the cpu usage graph tells you the process that was using the most CPU. – BlackICE May 5 '10 at 12:18
Another option would be to set up perf mon to monitor cpu usage of all processes on the machine. I think this would only work though if the process that ends up hogging the cpu was running when you started perf mon. – BlackICE May 5 '10 at 12:19

Have you the ability to open up the ports to allow perfmon to run remotely?

share|improve this answer
Not likely, opening ports is always a struggle with a hosting company... Besides, PerfMon would only give me the summary picture - I'd need to know exact process name - and that's what I'm trying to find out. Am I not correct? Thanks again! – sergeb May 4 '10 at 17:14
You're right about the ports (you could tunnel it over 80 perhaps?) but it will allow you to log all activity on an ongoing basis - i.e. it's not all about instantaneous data but can store historic data too. – Chopper3 May 4 '10 at 18:42
Pardon my ignorance, how do I I connect to PerfMon on a remote computer over Internet? – sergeb May 4 '10 at 21:33

maybe you could try adding a batch file with tasklist storing the output in a file to the scheduled jobs

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.