Hi
I have a server that has a process, constantly using 25% CPU. The process is spoolsv.exe and I have used process explore to view it in more detail.
If I use process explorer to look at thread it shows this at the top and shows that that has the cpu % of 25%..... kernel32.dll!MulDiv+0x120
If I click that and select stack it shows lot of these ntkrnlpa.exe and also these......
ntdll.dll!KiFstSystemCallR
User32.dll!FindWindowA+0x1
HPBMINI.dll!KillMiniinstal
I have removed all of the printers from the server and installed them as local printers on the machines. There is just a fax under printers now, but it i not used. If I disable the print spooler service the problem stops and then start about 5 minutes after I restart thne service.
Can anyone help me with this :-(.
Thanks
Derek
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Thanks for the reply. I have cleared the spool a few times and at this moment in time it is empty.
I really need to know how to analyse the threads and stacks to find out what could cause it. Seems the problem is posted all over the Net, but never really an answer, just lots of reloads, which isn`t an option here :-).
Thanks
Derek
Try excluding the Spool folder from your AV scanner. It MAY be that the AV scanner is holding the process open. Another option is to set all printers to print directly to the printer rather than spool first
(alternately to test - disable the on access scan portion of your AV and see if this sorts it)
I do not run any AV on my servers. I have UTM in front and desktop antivirus and as no one uses internet browser on our servers, i feel quite safe.
All the printers have been deleted, so there is no printing be carried out. I don`t want to permanently disable the spool though because the fax software will need to be used in the future.
Thanks
Derek
You can download what used to be the sysinternals tools off Microsoft these days. These include procmon and process explorer which really let you see what's going on in the machine regarding processes, applications, registry activity etc. You may be able to find what's going on in there, be warned there can be a bucket load of information to wade through to get to the answer but I've solved gnarly issues with them before.
This server has now started freezing. Screen just stops and system doesn`t respond to anything. You can ping it but only get two replies (hard reset required). This started to be every few days and is now twice per day. I have the spoolsvs stopped, so that is not the problem. When using process explorer I did notice that the spoolsv.exe caused lots of "hardware interrupst" which was using high cpu also.
I am begining to wonder if the server (ML150 G3) has gone bad, but how would I know which part to ask HP to change? I have tried the RAM, so all that is left is Mainboard, cpu and smart array card. It wouldbe easier to buy another basic ML150 and switch the drives over and see what happens, but G3`s are around anymore :-(.
Any suggestions before I do something radical :-).
Thanks
Derek
My feel would be to go for the motherboard, if you're certain that all the cooling is working inside the case and it's not just that a fan has stopped and something's overheated and hung solid. My home machine exhibited the exact same symptoms of hanging, stuck mouse pointer etc did it once a day for a few months, otherwise performed fine (for an aging box)
Get HP to replace the motherboard, realistically if it was the processor or the controller you'd be more likely to get a spontaneous reboot.
Thanks for your reply. I just got home from trying to fix it and think I have solved it. The spoolsv service was taking cpu (25%) and then sometimes the explorer .exe which made me remove all the printers etc.... etc..... The server is only an ML 150 so doesn`t have ilo or a management processor, so the only monitoring software on there is for the raid. The o/s is on the embedded sata RAID and the applications and files are on an E200 card.
I tried everything to find the threads/stacks etc....that were using the cpu but it only showed up as something called hardware interrupts . After reading many posts I decided to do a defrag as one post suggested that a really fragmented server could hang. I defragmented the F drive, but no change and then began to do the C drive. The office was quiet and I was watching the defrag on a remote workstation when I heard a scratching noise and then notice the cpu % go up to 47%. I ran to the server and the noise stopped and then started again, I took a guess and popped out one of the two hot plug o/s drives and the noise continued so I knew it was the other drive. The noise then went away but because I had heard it I knew the drive had issues. The RAID software said everything was fine, but after re-inserting the good drive and popping out the one that had made noise everything seemed fine.
I robbed a desktop drive from a spare pc and set it up as a hot spare, so it kicked in and rebuilt when I booted up and it seems fine even as I write this; so fingers crossed I found the issue J.
It was a HP drive, but under the sticker it says Seagate Barracuda and I don`t even think it was an Enterprise version.
Thanks again.
Derek
Business Accounts
Answer for Membership
by: robstaceyPosted on 2009-07-03 at 03:33:46ID: 24771409
Sounds like there might be a job stuck in the spool folder, even though you've removed the printers from the server. Have a look in C:\windows\system32\spool\
Good luck