Solved

System process taking up 100% CPU sporadically on Exchange server

Posted on 2007-11-14
8
796 Views
Last Modified: 2013-12-10
Windows server 2003 running on very nice hardware uptime of over 200 days, running Exchange 2003 and McAfee Enterprise with all the proper config and exclusions.  Yesterday, the "system" process starting to sporadically take up 100% of the CPU resources on the server.  Only other software on the server are the HP tools and our Spam filter (Sunbelt Ninja).  We've had no problems like this at all in the nearly 1 year since this server has been running.  There are no other indications of a problem and no other software installed.  This seems to happen sporadically without a pattern.  When it happens, users get a frozen outlook, remote access to the server is stopped until CPU usage returns to normal.  Anyone have any ideas what could be causing it and what steps I could take to fix it?
0
Comment
Question by:MCPJoe
  • 4
  • 4
8 Comments
 
LVL 66

Accepted Solution

by:
johnb6767 earned 500 total points
ID: 20281000
Process Explorer for Windows v10.21
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

Double click the system process. Then Select the Threads tab, and see what .exe or .dll is using the CPU, and then select it by double clicking it....and copying/pasting the call stack here.....

What I would also be curious to see is the Interupts, and the DPC's in Process Explorer. If thats what is using the CPU (not seeen in the Task manager), then you have either a HW problem, or a Driver problem.

Might need to just let it run, and wait for the thing to respond again.... Also, if you leave the threads tab open, you can suspend process underneath (for testing) without killing them...
0
 
LVL 9

Author Comment

by:MCPJoe
ID: 20281257
Ok, I ran process explorer but didn't find anything listed that was eating up all the CPU usage.  PE would list the CPU usage next to the "System" object, but not show me what under that was using up the CPU.  The server has been up for almost 300 days, so I'm going to reboot, and then launch Process Explorer again and keep an eye on the server.  
0
 
LVL 9

Author Comment

by:MCPJoe
ID: 20281452
Ok, no problems so far after reboot, so I guess I jumped the gun on this one.  Uptime was 245 days after checking, so it was long overdue.  Thanks for the info though, your suggestion is still the right way to troubleshoot this issue.

Thanks
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 20281472
Did it load anything under the SYSTEM process?

Or was it there, just without CPU Usage?
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 9

Author Comment

by:MCPJoe
ID: 20281588
It was there with everything else under it, and I selected the option to view the process tree, but during the peeks of CPU usage, process explorer would lock up as well and I couldn't get the info on what was taking up all the CPU usage...
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 20281910
That almost seems like a HW issue, if the whoole systems locks up. Next time it happens (hopefully not for a long time) see if the CAPS LOCK, and the NUM LOCK keys still respond...
0
 
LVL 9

Author Comment

by:MCPJoe
ID: 20282227
great idea, I'll do that.  Thanks again.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 20282422
Anytime!!
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now