Intermittent high cpu usage on a windows 2016 file server

[nadeaumr]

Hi,

    I have a windows 2016 failover cluster with a file server role. Many shares are defined. About 500 users (windows 10 workstation) connected to the SMB shares. Recently, the server that host the file server role began to have intermittent high cpu (100%) period during the day. These periods could happen several times by hour but not regularly and they could last from few seconds as many as 45 seconds. Nothing happen outside working hours. Server has 8 vcpu (vmware).

When the surge occurs, it is the process "system" that grab all the cpu ressource. Windows Performance Analyzer show that stack "Smb2ContinuQueryDirectory" use almost all the cpu time. 

We have a directory (on a one of the share) that has more than 7000 subfolders in his root. And it is difficult to navigate in this directory when the cpu hit the ceiling.

What could cause these burst of cpu?

Any clue?

[#2]

Sounds like a process/computer/service is scanning the file structure for a reason, it's not On-Access scanning on Read instead of Write? Do you see a burst in network traffic at the same time or not? (Remote process vs local process)

[#3]

@Harm_Veenstra 

   After other tests, i can see that there is a folder that cause the burst. This folder is part of a share and the problematic folder (let's name it ABC) has more than 7000 subfolder in it root. Each time a folder is created/deleted at the root of ABC, there's an important spike of cpu. Althought the action is taken locally or via the share. This is not happening on other folder on the same share.

   I copied the same directory (ABC) on another drive on the server and create a new share. Now there's not problem creating folder with the new location. No more cpu spike.

I cannot explain why.

Regards,

Marc

[#4]

NTFS Corruption? Table thing? Strange :)