up vote 1 down vote favorite
share [g+] share [fb]

In win2k3sp2, I've never seen this before and have not installed anything recently, but seemingly out of nowhere, the System process (not the idle process) is taking a lot of CPU whenever anything else is. That is, sitting idle, it's at 0. If I go and start a program like Thunderbird, while loading, thunderbird.exe and System will be competing for CPU usage, sometimes with System getting more than 50% (it's a dual-core system). I look at the total CPU time column, and System ranks sixth, just below SQL Server! This has never been the case before.

1) This is bad, right? 2) What's causing it?

I thought it might be the RAID, but that's a separate process, and the config util isn't reporting anything wrong.

I'm tempted to reset the server, but it's in production, so I'd rather not at the moment unless I'm sure it will do more good than harm. Also, I don't feel like it's "due for a reset," since it's only had thirteen days' uptime.

link|improve this question
100% accept rate
feedback

2 Answers

up vote 4 down vote accepted

Download and run Process Explorer. When you launch it you should see quite a bit of information, but what you should look at are two processes just under the System Idle Process node.

You should see one called Interrupts and DPCs. If those are spiking along with the System process, the problem is being caused by drivers. Generally you'll see this caused by things like the hard drive running in PIO mode (for direct attached storage using the ATA interface) or network cards that are offloading their work to the CPU.

If you only see the System process node taking up the CPU you know that it's Windows taking up the resources and not a faulty driver/hardware.

Keep in mind that this won't tell you exactly what's happening but it'll give you a place to start looking.

link|improve this answer
Sort of: they go up when System does, but not as high as the System node itself. The highest I saw either of them hit was <5%, and they (Interrupts and DPCs) tended not to both go up at the same time as one another. – Kev Oct 13 '09 at 15:04
Also I didn't change anything over the weekend...would something kick the drive into PIO dynamically? Same with network cards... – Kev Oct 13 '09 at 15:05
Hmm, if they were staying low then your problem isn't likely hardware. When the system has to go nuts handling interrupts and the like it'll usually be 50% of system or more. Windows will reduce the functionality of the drive if there are enough read errors within a given point in time. You can check in the Device Management console and look under the IDE ATA/ATAPI controllers section (look at the properties of each, it should be under the advanced settings tab). Transfer mode should be DMA if available and the mode should be some form of Ultra DMA. – Joshua Oct 13 '09 at 15:19
It says, "DMA if available" and Current Transfer Mode is "Not Applicable". – Kev Oct 13 '09 at 16:19
Oh, secondary channel has one disk set to PIO only. But I feel like these aren't used, because we have SCSI RAID... – Kev Oct 13 '09 at 16:20
show 1 more comment
feedback
up vote 2 down vote

One thing I'd be tempted to try are the tools in sysinternals like procmon and filemon and regmon. These might give a hint whether something in particular is being continually hit and by what particular process. Wouldn't hurt to try it.

link|improve this answer
I tried procmon, but I'm not really sure what I'm looking for (there are many, many options) when it comes to my particular problem. – Kev Oct 13 '09 at 15:11
1  
If you see a large stream of access to a particular registry key or file by the same process then you might be able to narrow down what is causing the high CPU load. Disk I/O if a particular file is being hit, or if the result is a stream of errors, etc. – Bart Silverstrim Oct 13 '09 at 15:28
It's creating entries faster than I can scroll by holding down PgDn, when I'm not even loading anything. I feel like these tools are better suited to debugging a particular application after you already know what that application is. – Kev Oct 13 '09 at 16:25
There's a button that turns off the logging when you need to stop it. There's also autoscroll in the view menu. – Bart Silverstrim Oct 14 '09 at 11:36
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.