PRF: High CPU (Individual Process)

First published on TECHNET on Apr 10, 2009

HIGH CPU – INDIVIDUAL PROCESS

Description: High CPU usage can cause slow response times, system hangs, or just overall sluggishness on a system.  An individual process may be responsible for consuming most of the CPU time during this period. There are various reasons for a process to cause high CPU usage; the process may have a code defect (bug), another vendor may have injected a module into the process (anti-virus), intensive work (normal operation), or an actual processor bottleneck (hardware).

Scoping the Issue: Distinguishing between normal operation and an actual problem with a process that has high CPU usage can be difficult.  This is where having a baseline or historical data may help.  If CPU usage is constant, you can use Task Manager or Process Explorer to check which process is using the CPU.  Alternatively, if the process is spiking the CPU, Performance Monitor can be used to log process and processor activity.  Once the offending process is identified, check the product documentation or support site for any issues or updates.

Data Gathering: In all instances, collecting either MPS Reports with the General, Internet and Networking, Business Networks and Server Components diagnostics, or a Performance-oriented MSDT manifest must be done.  Additional data required may include the following:

• Performance Monitor logs that include the timeframe when the high CPU usage occurred.  Ideally, the capture interval should not exceed 10 seconds. You can create the log parameters manually , or by using the Performance Monitor Wizard .  Required counters include:
  
  
  
  • All Processor Counters / All Instances
  
  
  • All Process Counters / All Instances
  
  
  • All System Counters / All Instances
  
  
  • All Thread Counters / All Instances


• Task Manager
  
  
  
  • Sort CPU Time/Usage columns under the Process tab for highest consumers


• Process Explorer
  
  
  
  • Sort by the CPU column under the Process window for highest consumers
  
  
  • Sort by the CPU column under the Thread tab in the Process Properties for highest consumers
  
  
  • Configure debug symbols to see thread stack information in the Thread tab


• Another great tool for Vista/2008 and to a lesser extent XP/2003, is XPERF, which is part of the Windows Performance Analysis Tools :
  
  
  
  • Gather the trace.etl file for analysis; please check the Quick Start Guide .


• You may need to get dumps of the process when it is in state. Please see ‘Capturing Application Crash Dumps’ for more info.


• Additionally, there may be specific utilities available to help troubleshoot certain applications such as PSSDIAG for Microsoft SQL Server or the Exchange Best Practice Analyzer for Microsoft Exchange servers.  For third-party applications you should also contact the application vendor / developer for assistance.

Troubleshooting / Resolution: After you have gathered this data, review the following:

• MPS Reports
  
  
  
  • Look for any loaded modules in the process that may not be from the vendor
  
  
  • Outdated components, such as updates for a specific process or driver/filter updates if the System process is the culprit


• Performance Monitor Logs
  
  
  
  • Check Processes->%Processor time for high usage
  
  
  • Also look for evidence of a hardware bottleneck, such as Processor Queue Length, System\Context Switch/sec, Thread\Context Switches/sec, and Processor\Interrupts/sec


• Task Manager
  
  
  
  • Sort CPU Time/Usage columns under the Process tab for highest consumers
  
  
  • Check the base Priority of a process.  Some applications are able to boost their priority within the application.


• Process Explorer
  
  
  
  • Identify the process by sorting the CPU column.  Bring up the Properties of the process and click the Threads tab. You can sort by CPU and see which threads are taking up most of the CPU time.  If symbols are configured, you may be able to get more details on the thread, such as Stack information.


• Xperf
  
  
  
  • The trace.etl file can be viewed with Xperfview.exe . Detailed analysis may require a Microsoft Support Professional.


• User Dump




• If you are comfortable with debugging, you can try using the !runaway extension to see which thread is consuming CPU time.  Detailed analysis may require assistance from a Microsoft Support Engineer

Additional Resources:

• Microsoft® Windows® Internals, Fourth Edition: Microsoft Windows Server™ 2003, Windows XP, and Windows 2000


• AskPerf Blog: An Overview of Processor Bottlenecks


• Microsoft TechNet: Analyzing Processor Activity


• Microsoft TechNet: Troubleshooting High CPU Usage on a Domain Controller