Link to home
Start Free TrialLog in
Avatar of Prashant Girennavar
Prashant GirennavarFlag for India

asked on

ntdll dll etwtracemessageva+0x130 on windows server 2008 R2 high CPU Usage

Hello Experts,

  We have one windows server 2008 r2 which is under monitoring. Every time we get an alert about CPU Usage is high for this server. I have checked the server and found out that eventlog service is taking high CPU usage (SVCHost.exe).

 I have used Process Explorer to get the information. Below are the stack value for above service.

 ntoskrnl.exe!SeAccessCheckWithHint+0xb4a
ntoskrnl.exe!IoGetRequestorProcess+0x250
ntoskrnl.exe!ExfTryToWakePushLock+0x899
ntoskrnl.exe!KeStackAttachProcess+0x117f
ntoskrnl.exe!ObReferenceObjectByPointerWithTag+0x23b
wevtsvc.dll+0x7984
wevtsvc.dll+0x79f8
wevtsvc.dll+0xf231
wevtsvc.dll+0x22154
wevtsvc.dll!SvchostPushServiceGlobals+0x10eae
wevtsvc.dll+0x228fc
wevtsvc.dll+0x2271e
wevtsvc.dll+0x22f50
wevtsvc.dll+0x22ee0
wevtsvc.dll+0x22aaa
wevtsvc.dll!SvchostPushServiceGlobals+0xd9ed
wevtsvc.dll!SvchostPushServiceGlobals+0xd834
RPCRT4.dll!I_RpcGetBuffer+0x265
RPCRT4.dll!Ndr64AsyncServerCallAll+0x11ae
RPCRT4.dll!NdrServerCallAll+0x40
RPCRT4.dll!NdrServerCall2+0x1ba4
RPCRT4.dll!NdrServerCall2+0x1d06
RPCRT4.dll!NdrServerCall2+0x23f9
RPCRT4.dll!NdrServerCall2+0x209d
RPCRT4.dll!NdrDllCanUnloadNow+0x52f
RPCRT4.dll!NdrDllCanUnloadNow+0xe5
ntdll.dll!TpSetTimer+0x3eb
ntdll.dll!EtwTraceMessageVa+0x46f
kernel32.dll!BaseThreadInitThunk+0xd
ntdll.dll!RtlUserThreadStart+0x21


 What does this indicate? How I will come to know what application/file which is causing this?

 I think I have explained the problem in a clear manner. Please let me know if any other information is needed on this.

Thanks,

_Prashant_
Avatar of David
David
Flag of United States of America image

you've probably got a poorly written program keeping the event logger busy by doing something in a loop.   Go to the microsoft sysinternals site and look for filemon.  This utility will let you select a program and see which files are read/writing to it.

With such a utility you should be able to figure out which program is the culprit.  Hopefully it wasn't written by a staffer or some commercial software you bought, rather than microsoft.

(Note you can also ask filemon to let you know when a program interacts with the DLL, as it isn't limited to data files)
Avatar of Prashant Girennavar

ASKER

I think filemon is not available to download from sysinternals site. It is been combined with Process Monitor.

 Now I am using Process monitor to find out the program which is taking high CPU , but I am unable to find which program from this tool.

 Can you please tell me the procedure to find out the program which is taking this high CPU usage.

 I just have a stack of the eventlog service from process monitor tool. ( I have posted the stack above in my question).

Thanks,

_Prashant_
Process monitor won't give you the files and specific read/write information.  Darn, I used to even have a copy of the source code to filemon somewhere.  

Are you sure filemon isn't there anymore? I think I loaded it on a server at office only a few months ago.
http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

I tried searching that , but no luck. in the above link they are referring , it is been integrated with process explorer.

Please let me know how to proceed.

 Thanks,

 _Prashant_
I have installed Process Monitor. I found below HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers regulary using svchost.exe. I am not sure what is this all about ?

Below is the screen shot.

User generated image
Thanks,

_Prashant_
Can some one help how to find out the program which is using eventlog service heavily?

I know we have determined the cause it eventlog which is taking high amout of CPU, but I am unable to determine what program is using it extensively.

your help is much appriciated.

Thanks,

_Prashant_
ASKER CERTIFIED SOLUTION
Avatar of David
David
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Glad to help.
This is due to HP Operations agent.