Solved

Exchange Server NT Kernel & System

Posted on 2012-03-28
13
1,495 Views
Last Modified: 2012-04-16
I have an Exchange 2010 Server running on Windows 2008 R2 (virtual environment - VMWare)

The server has 2 vcpus, 16gb ram and it is doing Mailbox, CAS and Hub Transport with around 100  mailboxes... it has been ticking over quite nicely until.....

Just recently i have noticed that is has started really chugging - logging on you can see that the CPU usage is flatlining at 100% for a couple of hours at a time and then goes back to the usual peaks and troughs for a while before maxing out again.

When the CPU usage is at 100% the description of the process that seems to be causing it is NT Kernel & System which, having googled it, i cant seem much info on relating to a similar setup.

It is getting to the point where it is really effecting general mail flow and our users are complaning about OWA is painfully slow. Backups (using Veeam) are taking 9 hours as apposed to 3.

Nothing obvious is reported in the event logs.....

Any one seen anything similar or suggest any ways of troubleshooting this?
0
Comment
Question by:dbarnbrook
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 4
13 Comments
 
LVL 19

Expert Comment

by:Miguel Angel Perez Muñoz
ID: 37775885
If have got installed Eset Mail security, ensure "background scanning" is disable (antivirus and antispyware > mail server protection > VSAPI 2.X)
0
 

Author Comment

by:dbarnbrook
ID: 37775900
We dont use Eset Mail Security, we use GFI Mail Defence Suite for our virus scanning and antispam protection.
0
 
LVL 120

Assisted Solution

by:Andrew Hancock (VMware vExpert / EE MVE^2)
Andrew Hancock (VMware vExpert / EE MVE^2) earned 500 total points
ID: 37775956
what datastore is in use to support the VMs?
0
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 

Author Comment

by:dbarnbrook
ID: 37775994
The datastores sit on an iSCSI SAN... the disks are SAS with Raid 10 then carved up into iSCSI with multipathing.
0
 

Author Comment

by:dbarnbrook
ID: 37787700
This is getting ridiculous now....has been sat on 100% Cpu Usage for about 4 hours now...  any further suggestions would be greatly appreciated!!
0
 
LVL 120

Assisted Solution

by:Andrew Hancock (VMware vExpert / EE MVE^2)
Andrew Hancock (VMware vExpert / EE MVE^2) earned 500 total points
ID: 37787721
what process is causing the high 100% CPU?

I would suggest downloading Process Explorer

http://technet.microsoft.com/en-us/sysinternals/bb896653
0
 

Author Comment

by:dbarnbrook
ID: 37787773
The process is: System,  with the description of: NT Kernel & System.

Thanks hanccocka ....will try running the process explorer however is is really painful doing any kind of troubleshooting because of the cpu usage.
0
 

Author Comment

by:dbarnbrook
ID: 37787867
OK as i said the process is System PID 4 constantly taking 40 - 80 percent CPU (see attached screenshot)

process explorer
0
 
LVL 120
ID: 37787970
Schedule some downtime, and stop all the services on the server.
0
 

Author Comment

by:dbarnbrook
ID: 37802435
i will go through the services tonight as i have scheduled some downtime. In the mean time I did disable the network adapter and all cpu usage dropped to almost nothing, including the System Process....
0
 
LVL 120
ID: 37802442
have you checked for denial of service attach, or SMTP delivery.
0
 

Accepted Solution

by:
dbarnbrook earned 0 total points
ID: 37836430
Right - we finally figured it out..... One of our backups (we use Veeam) had failed a couple of weeks ago and basically it had created a snapshot of the VM but not deleted it afterwards. So therefore i think the Exchange box was basically writing changes to new disks and still reading from the old ones - hence the chugging. Once i had deleted the snapshot and the changes were committed it seems all back to normal now. Thanks for your sugggestions.
0
 

Author Closing Comment

by:dbarnbrook
ID: 37850421
I eventually figured the issue out for myself.... others helped with basic troubleshooting but didn't hit the nail on the head.
0

Featured Post

Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Ransomware is a malware that is again in the list of security  concerns. Not only for companies, but also for Government security and  even at personal use. IT departments should be aware and have the right  knowledge to how to fight it.
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…
how to add IIS SMTP to handle application/Scanner relays into office 365.

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question