I've noticed that my AWS server occasionally starts using a bunch of CPU for no particular reason, looking something like this:
Observe that it does not occur at specific times, but has a very definite pattern to it. It lasts just under an hour.
Remoting to the machine during this occurrence would invariably make it stop happening. Leaving the account permanently logged on allowed me to capture a more fine-grained CPU usage trace. It looked like this:
That's right; the processes that actually consume that CPU are not in the list. Instead, they appear and disappear all the time. ProcMon was obviously the tool for the job, so I captured a trace. This is what I found:
There's also Postgres involved:
However all the CPU usage is by the Winlogon/LogonUI/etc:
Here's a short excerpt of process start and stop events during this occurrence:
Note that postgres is not interleaved with each start/stop of smss/winlogon/etc, but only some of them.
Any ideas why this happens, and how to prevent it?