Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server using 10-25% of the CPU time on Hardware Interrupts according to Process Explorer.

How would I go about logging/diagnosing the cause of all these IRQ calls?

The machine is virtual, so I know the physical hardware is not the problem (although could be drivers, etc).

UPDATE: Tried the information from this article:

Regarding using tracelog.exe and tracerpt.exe to capture DPC and ISR events, but when I run the trace it doesn't have any of that information, even with the -dpcisr switch. I get disk and process info in the report but no interrupts... I know interrupts are happening because Process Explorer is still showing them using 6-15% CPU

share|improve this question
up vote 3 down vote accepted


Start a command promt -> go to the KRView folder

C:\Program Files\KrView\Kernrates>Kernrate_i386_XP.exe

And you get something like

Time   51354 hits, 25000 events per hit

Module                                 Hits       msec    %Tot  Events/Sec
--------                              -----      -----    ----  ----------  
intelppm                              36726      64582    71 %    14216809
ntoskrnl                               6681      64582    13 %     2586246
hal                                    5246      64582    10 %     2030751
Ntfs                                    637      64582     1 %      246585

After you press CTRL + C ( but leave it running for a while ) and this should give you a indication of where to look.

Now to track down more information regarding these drives, if you cannot guess who made the drives based on its name you can find it in your windows system folder ( tcpip would be the file tcpip.sys, right click on the file and you can see who signed it).
When searching on your favorite search engine for other people that might have simular problems i would start searching for the none microsoft once.
Be aware that the intelppm can be can be the root of your problem, but it will show very high in the list because it sends the sleep command to the cpu so its position in the output will be very high ( If you have a AMD CPU replace intelppm with a amd driver ).
As you may have noticed this does not point a nice arrow to your problem, it will still require some work from you to track down what to do with the problem is, but it should give your a help in what direction to focus you searching.

share|improve this answer
Alright how do I break down intelppm, ntkrnlpa, hal, etc into something I can match to a driver or other issue? – Garrett Jul 31 '09 at 23:41
Updated reply with some more information – EKS Aug 2 '09 at 11:55
My highest user is intelppm, how do I go about determining if the problem lies within? – Garrett Aug 3 '09 at 21:55
Like i updated my reply, there is a chance thats is because its sending sleep commands to the CPU. But you have to search yourself a bit, i know when i did this on my server i knew there could be issues with intelppm and virtual machine 2k5 i belive. – EKS Aug 4 '09 at 8:55

Try this:

The XP version of KrView works on Vista, but you need to run it as Administrator. Start a cmd shell as Administrator and run c:\program files\krview\kernrates\kernrate_i386_xp.exe while the hardware interrupt problem is occurring. Compare the results to when the problem is not occurring. This will tell you which hardware drivers are hogging the CPU.

share|improve this answer
I used the kernview.exe from the Server 2003 resource toolkit (the machine is running '03), but I didn't understand how to get the information I needed from the wealth kernview offers. Could you provide a few more steps to narrow it down to finding out what's calling the IRQs? – Garrett Jul 29 '09 at 17:37
SOmtimes it happens that a broken device (HDD, IDE cable, even motherboard) makes lots of IRQ interrupts. KrView shows you which drivers use CPU the most, so you're able to determine the possible hardware issue. – kolypto Jul 30 '09 at 2:13
Again, "The machine is virtual, so I know the physical hardware is not the problem" – Garrett Jul 31 '09 at 15:50

Try this: Start, Settings, Control Panel, System, Device Manager, IDE, Primary IDE Channel Properties, Advanced Settings, Set both Transfer Modes to "DMA if available".

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.