Christian Hans
asked on
Exchange 2013 CPU Spikes
We have been having many issues with resources on the Exchange 2013 CU6 servers recently... we have always had them but they seem to be happening more often now.
I remember back with Exchange 2010 there was the issue with iOS 6.1 devices syncing... this almost feels similar as our server is hitting 100% CPU usage. I found that we still have some of those, but I can't find any documentation stating that this carried over to Exchange 2013. Does anyone know?
It seems like everytime I look at Sysinternals Process Explorer the following are pretty much all at 90-100% CPU;
- w3wp.exe
- noderunner.exe
- Microsoft.Exchange.Store.W orker.exe
When the CPU spikes, we generally get calls from users saying Outlook disconnected and after a 2-5 mins Outlook clients connect again. We see this on all our servers in the DAG...
Ive been checking the counters in "\MSExchange RpcClientAccess\User Count" thinking this could help find the issue, but have had no luck... Running ExPerfWiz all afternoon. Averaging 8000-9000
Looking for ideas or suggestions?
Thanks
I remember back with Exchange 2010 there was the issue with iOS 6.1 devices syncing... this almost feels similar as our server is hitting 100% CPU usage. I found that we still have some of those, but I can't find any documentation stating that this carried over to Exchange 2013. Does anyone know?
It seems like everytime I look at Sysinternals Process Explorer the following are pretty much all at 90-100% CPU;
- w3wp.exe
- noderunner.exe
- Microsoft.Exchange.Store.W
When the CPU spikes, we generally get calls from users saying Outlook disconnected and after a 2-5 mins Outlook clients connect again. We see this on all our servers in the DAG...
Ive been checking the counters in "\MSExchange RpcClientAccess\User Count" thinking this could help find the issue, but have had no luck... Running ExPerfWiz all afternoon. Averaging 8000-9000
Looking for ideas or suggestions?
Thanks
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Post back. I'm heading home but will follow up tomorrow.
You also need to be running ExPerfWiz on your CAS and be looking at RPC Client access on those. At 300 your users will be affected an at 500 users will get disconnected.
I have a OneNote on RPC. I'll post that tomorrow.
I have a OneNote on RPC. I'll post that tomorrow.
ASKER
ScottCha, I really appreciate your help. Im just running a new experfwiz this morning for 4 hours so I should have it by lunchtime... PAL usually take a while to finish but Im confident Ill have results right after lunch and update here. Thank you Sir.
BTW... setting up the Active Directory Diagnostic Logging "HKLM\SYSTEM\CurrentContro lSet\servi ces\NTDS\D iagnostics "... this needs to be done on the Active Directory server(s) correct?
BTW... setting up the Active Directory Diagnostic Logging "HKLM\SYSTEM\CurrentContro
Sounds good. Here is the RPC notes I promised.
User impact will start at RPC Requests around 300.
500 means server is done, no more connections, users start getting disconnected and slow @ 300.
Counters to look at:
Process/Thread Count/Microsoft.ExchangeRp cClientAcc ess.Servic e
MSExchange RpcClient Access with counters RPC Averaged Latency and RPC Requests.
Look in the RPC Client Access logs on the CAS for backoffs from the MBX servers.
The error that will show will be "0x6bb".
User impact will start at RPC Requests around 300.
500 means server is done, no more connections, users start getting disconnected and slow @ 300.
Counters to look at:
Process/Thread Count/Microsoft.ExchangeRp
MSExchange RpcClient Access with counters RPC Averaged Latency and RPC Requests.
Look in the RPC Client Access logs on the CAS for backoffs from the MBX servers.
The error that will show will be "0x6bb".
ASKER
So... that was torture waiting for the PAL report to build. :-)
I changed '15 Field Engineering' to a Value of "5" on the Domain Controller and only saw the one 1644 Event right when I turned it on in the Directory Services log.
PAL results show this output throughout the day.... I don't know if you see anything that could help troubleshoot the issue...
I changed '15 Field Engineering' to a Value of "5" on the Domain Controller and only saw the one 1644 Event right when I turned it on in the Directory Services log.
PAL results show this output throughout the day.... I don't know if you see anything that could help troubleshoot the issue...