[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

ntdll dll etwtracemessageva+0x130 on windows server 2008 R2 high CPU Usage

Posted on 2012-08-22
10
Medium Priority
?
2,547 Views
Last Modified: 2012-08-28
Hello Experts,

  We have one windows server 2008 r2 which is under monitoring. Every time we get an alert about CPU Usage is high for this server. I have checked the server and found out that eventlog service is taking high CPU usage (SVCHost.exe).

 I have used Process Explorer to get the information. Below are the stack value for above service.

 ntoskrnl.exe!SeAccessCheckWithHint+0xb4a
ntoskrnl.exe!IoGetRequestorProcess+0x250
ntoskrnl.exe!ExfTryToWakePushLock+0x899
ntoskrnl.exe!KeStackAttachProcess+0x117f
ntoskrnl.exe!ObReferenceObjectByPointerWithTag+0x23b
wevtsvc.dll+0x7984
wevtsvc.dll+0x79f8
wevtsvc.dll+0xf231
wevtsvc.dll+0x22154
wevtsvc.dll!SvchostPushServiceGlobals+0x10eae
wevtsvc.dll+0x228fc
wevtsvc.dll+0x2271e
wevtsvc.dll+0x22f50
wevtsvc.dll+0x22ee0
wevtsvc.dll+0x22aaa
wevtsvc.dll!SvchostPushServiceGlobals+0xd9ed
wevtsvc.dll!SvchostPushServiceGlobals+0xd834
RPCRT4.dll!I_RpcGetBuffer+0x265
RPCRT4.dll!Ndr64AsyncServerCallAll+0x11ae
RPCRT4.dll!NdrServerCallAll+0x40
RPCRT4.dll!NdrServerCall2+0x1ba4
RPCRT4.dll!NdrServerCall2+0x1d06
RPCRT4.dll!NdrServerCall2+0x23f9
RPCRT4.dll!NdrServerCall2+0x209d
RPCRT4.dll!NdrDllCanUnloadNow+0x52f
RPCRT4.dll!NdrDllCanUnloadNow+0xe5
ntdll.dll!TpSetTimer+0x3eb
ntdll.dll!EtwTraceMessageVa+0x46f
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x21


 What does this indicate? How I will come to know what application/file which is causing this?

 I think I have explained the problem in a clear manner. Please let me know if any other information is needed on this.

Thanks,

_Prashant_
0
Comment
Question by:Prashant Girennavar
  • 6
  • 4
10 Comments
 
LVL 47

Expert Comment

by:David
ID: 38323402
you've probably got a poorly written program keeping the event logger busy by doing something in a loop.   Go to the microsoft sysinternals site and look for filemon.  This utility will let you select a program and see which files are read/writing to it.

With such a utility you should be able to figure out which program is the culprit.  Hopefully it wasn't written by a staffer or some commercial software you bought, rather than microsoft.

(Note you can also ask filemon to let you know when a program interacts with the DLL, as it isn't limited to data files)
0
 
LVL 10

Author Comment

by:Prashant Girennavar
ID: 38323473
I think filemon is not available to download from sysinternals site. It is been combined with Process Monitor.

 Now I am using Process monitor to find out the program which is taking high CPU , but I am unable to find which program from this tool.

 Can you please tell me the procedure to find out the program which is taking this high CPU usage.

 I just have a stack of the eventlog service from process monitor tool. ( I have posted the stack above in my question).

Thanks,

_Prashant_
0
 
LVL 47

Expert Comment

by:David
ID: 38323506
Process monitor won't give you the files and specific read/write information.  Darn, I used to even have a copy of the source code to filemon somewhere.  

Are you sure filemon isn't there anymore? I think I loaded it on a server at office only a few months ago.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 10

Author Comment

by:Prashant Girennavar
ID: 38323567
http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

I tried searching that , but no luck. in the above link they are referring , it is been integrated with process explorer.

Please let me know how to proceed.

 Thanks,

 _Prashant_
0
 
LVL 10

Author Comment

by:Prashant Girennavar
ID: 38323814
I have installed Process Monitor. I found below HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers regulary using svchost.exe. I am not sure what is this all about ?

Below is the screen shot.

CPU High Usage
Thanks,

_Prashant_
0
 
LVL 10

Author Comment

by:Prashant Girennavar
ID: 38327977
Can some one help how to find out the program which is using eventlog service heavily?

I know we have determined the cause it eventlog which is taking high amout of CPU, but I am unable to determine what program is using it extensively.

your help is much appriciated.

Thanks,

_Prashant_
0
 
LVL 47

Accepted Solution

by:
David earned 2000 total points
ID: 38328018
There is a detail column. That says what is going on, how many bytes, etc ... your image is not showing that.   Also the path column tells you the registry entry, which you also did not expand.

So look at those two columns, along with the Operation column and see the registry entry or entries.  Open them up with regedit or at least look at the path (assuming it is registry I/O, can't tell w/o full details).

But you are so close to getting the information you need to see what process is screwing up.  If you want to do a brute force, start killing non-vital services while watching, and hopefully the messages will stop right after killing a service,then you have the offending program.
0
 
LVL 10

Assisted Solution

by:Prashant Girennavar
Prashant Girennavar earned 0 total points
ID: 38328098
The culprit was Operations Agent from HP. OPCLE.Exe was trying to read the eventlogs over and over.

 We have applied the hotfix for OPCLE , now the issue got resolved.

 Thanks for helping!!!!!!!!!!!!!!!!

Regards,

_Prashant_
0
 
LVL 47

Expert Comment

by:David
ID: 38328127
Glad to help.
0
 
LVL 10

Author Closing Comment

by:Prashant Girennavar
ID: 38340169
This is due to HP Operations agent.
0

Featured Post

Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to use a free utility called 'Parkdale' to easily test the performance and benchmark any Hard Drive(s) installed in your computer. We also look at RAM Disks and their speed comparisons.
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question