I have unusually high Kernel time on my CPUs as shown in task manager.
What are some ways I can troubleshoot this?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
This is probably easier than you think. If you have consistent, high system usage, Process Explorer provides a Threads tab that you can use for the System process (process id: 4). The offending module and function should be displayed.
If you need a formal tool for collecting the empirical data to analyze the issue, you may use the Windows Performance Recorder/Windows Performance Analyzer, part of the Windows Performance Toolkit.
I had the issue myself with high kernel times consuming 50% of CPU, while other processes accounted for the remaining 40%. The issue was caused by not properly disabling and uninstalling Trend AV.
Even though the services were stopped, and the realtime scan disabled, kernel mini filters appeared to be enabled. I deduced that they were consuming kernel time after I unstalled the software properly and observed that the kernel time reduced to 1/10th of the previous load.
To view the list of filters on your system, type
C:\Users\TEMP>fltmc filters Filter Name Num Instances Altitude Frame ------------------------------ ------------- ------------ ----- TmPreFilter 3 328500 0 luafv 1 135000 0
Microsoft has a list of 3rd party filters available here. According to that spreadsheet, TmPreFilter is Trend Micro, an AV Scanner.