Link to home
Start Free TrialLog in
Avatar of Christian Hans
Christian HansFlag for United States of America

asked on

Exchange 2013 CPU Spikes

We have been having many issues with resources on the Exchange 2013 CU6 servers recently... we have always had them but they seem to be happening more often now.

I remember back with Exchange 2010 there was the issue with iOS 6.1 devices syncing... this almost feels similar as our server is hitting 100% CPU usage. I found that we still have some of those, but I can't find any documentation stating that this carried over to Exchange 2013. Does anyone know?

It seems like everytime I look at Sysinternals Process Explorer the following are pretty much all at 90-100% CPU;  
-  w3wp.exe
-  noderunner.exe
-  Microsoft.Exchange.Store.Worker.exe

When the CPU spikes, we generally get calls from users saying Outlook disconnected and after a 2-5 mins Outlook clients connect again. We see this on all our servers in the DAG...

Ive been checking the counters in "\MSExchange RpcClientAccess\User Count" thinking this could help find the issue, but have had no luck... Running ExPerfWiz all afternoon. Averaging 8000-9000

Looking for ideas or suggestions?

Thanks
ASKER CERTIFIED SOLUTION
Avatar of Scott C
Scott C
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Post back.  I'm heading home but will follow up tomorrow.
You also need to be running ExPerfWiz on your CAS and be looking at RPC Client access on those.  At 300 your users will be affected an at 500 users will get disconnected.

I have a OneNote on RPC.  I'll post that tomorrow.
Avatar of Christian Hans

ASKER

ScottCha, I really appreciate your help. Im just running a new experfwiz this morning for 4 hours so I should have it by lunchtime... PAL usually take a while to finish but Im confident Ill have results right after lunch and update here. Thank you Sir.

BTW... setting up the Active Directory Diagnostic Logging  "HKLM\SYSTEM\CurrentControlSet\services\NTDS\Diagnostics"... this needs to be done on the Active Directory server(s) correct?
Sounds good.  Here is the RPC notes I promised.

User impact will start at RPC Requests around 300.

500 means server is done, no more connections, users start getting disconnected and slow @ 300.

Counters to look at:

Process/Thread Count/Microsoft.ExchangeRpcClientAccess.Service

MSExchange RpcClient Access with counters RPC Averaged Latency and RPC Requests.

Look in the RPC Client Access logs on the CAS for backoffs from the MBX servers.


The error that will show will be "0x6bb".
So... that was torture waiting for the PAL report to build. :-)

I changed '15 Field Engineering' to a Value of "5" on the Domain Controller and only saw the one 1644 Event right when I turned it on in the Directory Services log.

PAL results show this output throughout the day.... I don't know if you see anything that could help troubleshoot the issue...

User generated image
User generated image