Solved

Server 2003 Spoolsv.exe 25% cpu

Posted on 2009-07-03
9
1,562 Views
Last Modified: 2012-05-07
Hi
I have a server that has a process, constantly using 25% CPU.  The process is spoolsv.exe and I have used process explore to view it in more detail.
If I use process explorer to look at thread it shows this at the top and shows that that has the cpu % of 25%.....  kernel32.dll!MulDiv+0x120
If I click that and select stack it shows lot of these ntkrnlpa.exe and also these......
ntdll.dll!KiFstSystemCallRet
User32.dll!FindWindowA+0x15
HPBMINI.dll!KillMiniinstaller+0xd90

I have removed all of the printers from the server and installed them as local printers on the machines.  There is just a fax under printers now, but it i not used.  If I disable the print spooler service the problem stops and then start about 5 minutes after I restart thne service.

Can anyone help me with this :-(.
Thanks
Derek

0
Comment
Question by:stantechsvcs
  • 4
  • 3
9 Comments
 
LVL 5

Expert Comment

by:robstacey
ID: 24771409
Sounds like there might be a job stuck in the spool folder, even though you've removed the printers from the server.  Have a look in C:\windows\system32\spool\printers  This folder is where print jobs go when they're spooling.  Should be empty if nothing is printing but sometimes files get stuck. If there are any files they may be .spl and .shd files.  Make a note of the timestamp on these files and see if they match up with when this issue started happening.  Stop the spool service and delete these files and start the spool service again. If there's nothing in that folder the service has nothing to process so shouldn't hog CPU any more.  If there's nothing in there it might be worth looking into whether the faxing software you mentioned is doing anything.
Good luck
0
 

Author Comment

by:stantechsvcs
ID: 24771478
Thanks for the reply.  I have cleared the spool a few times and at this moment in time it is empty.

I really need to know how to analyse the threads and stacks to find out what could cause it.  Seems the problem is posted all over the Net, but never really an answer, just lots of reloads, which isn`t an option here :-).

Thanks
Derek
0
 
LVL 10

Expert Comment

by:Kieran_Burns
ID: 24771514
Try excluding the Spool folder from your AV scanner. It MAY be that the AV scanner is holding the process open. Another option is to set all printers to print directly to the printer rather than spool first
(alternately to test - disable the on access scan portion of your AV and see if this sorts it)
0
 

Author Comment

by:stantechsvcs
ID: 24771539
I do not run any AV on my servers.  I have UTM in front and desktop antivirus and as no one uses internet browser on our servers, i feel quite safe.
All the printers have been deleted, so there is no printing be carried out.  I don`t want to permanently disable the spool though because the fax software will need to be used in the future.

Thanks
Derek

0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 5

Expert Comment

by:robstacey
ID: 24776173
You can download what used to be the sysinternals tools off Microsoft these days.  These include procmon and process explorer which really let you see what's going on in the machine regarding processes, applications, registry activity etc.  You may be able to find what's going on in there, be warned there can be a bucket load of information to wade through to get to the answer but I've solved gnarly issues with them before.
0
 

Author Comment

by:stantechsvcs
ID: 24779247
This server has now started freezing.  Screen just stops and system doesn`t respond to anything.  You can ping it but only get two replies (hard reset required).  This started to be every few days and is now twice per day.  I have the spoolsvs stopped, so that is not the problem.  When using process explorer I did notice that the spoolsv.exe caused lots of "hardware interrupst" which was using high cpu also.
I am begining to wonder if the server (ML150 G3) has gone bad, but how would I know which part to ask HP to change?  I have tried the RAM, so all that is left is Mainboard, cpu and smart array card.  It wouldbe easier to buy another basic ML150 and switch the drives over and see what happens, but G3`s are around anymore :-(.  
Any suggestions before I do something radical :-).

Thanks
Derek
0
 
LVL 5

Expert Comment

by:robstacey
ID: 24781089
My feel would be to go for the motherboard, if you're certain that all the cooling is working inside the case and it's not just that a fan has stopped and something's overheated and hung solid.   My home machine exhibited the exact same symptoms of hanging, stuck mouse pointer etc did it once a day for a few months, otherwise performed fine (for an aging box)
Get HP to replace the motherboard, realistically if it was the processor or  the controller you'd be more likely to get a spontaneous reboot.
0
 

Accepted Solution

by:
stantechsvcs earned 0 total points
ID: 24781183
Thanks for your reply.  I just got home from trying to fix it and think I have solved it.  The spoolsv service was taking cpu (25%) and then sometimes the explorer .exe which  made me remove all the printers etc.... etc.....  The server is only an ML 150 so doesn`t have ilo or a management processor, so the only monitoring software on there is for the raid.  The o/s is on the embedded sata RAID and the applications and files are on an E200 card.

I tried everything to find the threads/stacks etc....that were using the cpu but it only showed up as something called hardware interrupts.  After reading many posts I decided to do a defrag as one post suggested that a really fragmented server could hang.  I defragmented the F drive, but no change and then began to do the C drive.  The office was quiet and I was watching the defrag on a remote workstation when I heard a scratching noise and then notice the cpu % go up to 47%.  I ran to the server and the noise stopped and then started again, I took a guess and popped out one of the two hot plug o/s drives and the noise continued so I knew it was the other drive.  The noise then went away but because I had heard it I knew the drive had issues.  The RAID software said everything was fine, but after re-inserting the good drive and popping out the one that had made noise everything seemed fine.

I robbed a desktop drive from a spare pc and set it up as a hot spare, so it kicked in and rebuilt when I booted up and it seems fine even as I write this; so fingers crossed I found the issue J.

It was a HP drive, but under the sticker it says Seagate Barracuda and I don`t even think it was an Enterprise version.

Thanks again.

Derek

0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Join & Write a Comment

Suggested Solutions

Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
this article is a guided solution for most of the common server issues in server hardware tasks we are facing in our routine job works. the topics in the following article covered are, 1) dell hardware raidlevel (Perc) 2) adding HDD 3) how t…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now