Solved

LSASS High CPU and Memory Utilization

Posted on 2013-10-22
4
497 Views
Last Modified: 2015-06-23
Hi all,

We have a very curious issue with a Windows 2008 R2 SP1 box (NOT a DC).
In essence lsass seems to be leaking handles and memory.
It goes through periods of high cpu (25% on a 4 core box, so 1 complete CPU).
I have managed to isolate the timing of these periods of high CPU usage down to one event, SQL Server backups.

In investigating this I stumbled across http://www.sqlservercentral.com/Forums/Topic1341522-391-1.aspx and sure enough we did not have the hotfix applied referenced in that (http://support.microsoft.com/kb/2545833). So that was applied last night and I put in performance monitoring on the lsass process.

Come this morning we still get CPU spikes every time SQL backups are running (transaction log backups every 15 minutes) and lsass is currently using 325,000 handles and 191,692K. From my performance stats I could see the gradual increase overnight.

SQL Server itself is suffering with it's transaction logs backups going from taking seconds to complete to now taking over 15 minutes.

Any insights or advice would be appreciated.

Cheers
Terry
0
Comment
Question by:qz8dsw
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 15

Author Comment

by:qz8dsw
ID: 39592542
OK, found out some more info.
The backup drive for SQL backups had recently been replaced. When they replaced it they copied the files, but not the permissions. SQL did not have access to delete old transaction logs.

This has now been rectified and am waiting to see if this is a resolution to our problem.
0
 
LVL 15

Accepted Solution

by:
qz8dsw earned 0 total points
ID: 39593270
Confirmed this is a resolution for our issue.
The handles lsass.exe was holding onto were user tokens going back to an ad account SQL server 2008 uses (Found by using handles.exe from sysinternals/microsoft).

I spose my question has now changed slightly since I have found resolution to the initial issue.

Why would lsass hold onto these resources and continue to build them up for what is in essence an access denied on deleting a file. (SQL Server trying to purge old transaction logs)

Any insight would be appriciated.

Cheers
Terry
0
 
LVL 35

Expert Comment

by:Seth Simmons
ID: 40845784
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains how to reset the password of the sa account on a Microsoft SQL Server.  The steps in this article work in SQL 2005, 2008, 2008 R2, 2012, 2014 and 2016.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question