?
Solved

LSASS High CPU and Memory Utilization

Posted on 2013-10-22
4
Medium Priority
?
557 Views
Last Modified: 2015-06-23
Hi all,

We have a very curious issue with a Windows 2008 R2 SP1 box (NOT a DC).
In essence lsass seems to be leaking handles and memory.
It goes through periods of high cpu (25% on a 4 core box, so 1 complete CPU).
I have managed to isolate the timing of these periods of high CPU usage down to one event, SQL Server backups.

In investigating this I stumbled across http://www.sqlservercentral.com/Forums/Topic1341522-391-1.aspx and sure enough we did not have the hotfix applied referenced in that (http://support.microsoft.com/kb/2545833). So that was applied last night and I put in performance monitoring on the lsass process.

Come this morning we still get CPU spikes every time SQL backups are running (transaction log backups every 15 minutes) and lsass is currently using 325,000 handles and 191,692K. From my performance stats I could see the gradual increase overnight.

SQL Server itself is suffering with it's transaction logs backups going from taking seconds to complete to now taking over 15 minutes.

Any insights or advice would be appreciated.

Cheers
Terry
0
Comment
Question by:qz8dsw
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 15

Author Comment

by:qz8dsw
ID: 39592542
OK, found out some more info.
The backup drive for SQL backups had recently been replaced. When they replaced it they copied the files, but not the permissions. SQL did not have access to delete old transaction logs.

This has now been rectified and am waiting to see if this is a resolution to our problem.
0
 
LVL 15

Accepted Solution

by:
qz8dsw earned 0 total points
ID: 39593270
Confirmed this is a resolution for our issue.
The handles lsass.exe was holding onto were user tokens going back to an ad account SQL server 2008 uses (Found by using handles.exe from sysinternals/microsoft).

I spose my question has now changed slightly since I have found resolution to the initial issue.

Why would lsass hold onto these resources and continue to build them up for what is in essence an access denied on deleting a file. (SQL Server trying to purge old transaction logs)

Any insight would be appriciated.

Cheers
Terry
0
 
LVL 35

Expert Comment

by:Seth Simmons
ID: 40845784
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question