0

We have a physical server that is running Windows Server 2016 and is acting as a domain controller. We are monitoring several services/parameters on this server via Nagios/Check MK and are noticing that Nagios is reporting svchost.exe is gradually consuming more and more CPU over time. Looking at the graph of Kernel usage for svchost.exe in Nagios, it is obvious that the CPU usage is trending up. Unfortunately, it appears that Nagios monitors the aggregate of all svchost.exe instances and doesn't provide any granularity into individual instances or services.

I have run PerfMon and recorded CPU privileged time for each instance of svchost.exe and determined that the instance of svchost.exe containing the following services is consuming the most CPU: CryptSvc, Dnscache, LanmanWorkstation, NlaSvc, and WinRM.

I've attempted to stop each of those 5 services to find a culprit and it appears that when I stop Dnscache, the CPU time for that instance of svchost.exe goes down BUT doing this makes the CPU time for the instance of svchost.exe containing RpcEptMapper and RpcSs increase by a noticeable amount.

Does anyone have any suggestions for things to try/check or any idea of what could be causing this gradually increasing CPU usage from svchost?

Keith
  • 4,637
  • 15
  • 25
CacheMoney
  • 25
  • 7
  • See if this helps: https://support.microsoft.com/en-us/help/3118385/svchost-exe-uses-excessive-cpu-resources-on-a-single-core-windows-serv – Massimo Nov 09 '20 at 16:02
  • " when I stop Dnscache, " - what if you cycle it (i.e. stop, start)? – TomTom Nov 09 '20 at 16:03
  • @TomTom My mistake, I should have mentioned that I tried stopping and starting and that didn't seem to make a difference. – CacheMoney Nov 09 '20 at 16:23
  • @Massimo Thank you very much. I will read over the article you provided and investigate. – CacheMoney Nov 09 '20 at 16:25
  • @Massimo Update: I just confirmed the WinRMRemoteWMIUsers_ group mentioned in the microsoft article does exist in our AD. So I guess that's not the problem here. – CacheMoney Nov 09 '20 at 16:41
  • Also wanted to mention that I separated Dnscache into its own instance of svchost.exe and this also makes CPU time for RpcEptMapper and RpcSs increase by a noticeable amount. – CacheMoney Nov 09 '20 at 19:29

0 Answers0