0

I recently started working on the server for a certain software (Tango). The users complained that it recently became extremely low, so I used an application (ProcessHacker) to see the resource usage of the active processes.

I found out that CSRSS.EXE maks peaks of 80 MB/s in the I/O usage history. Now, I know that this is a server and I guess it's expected to be processing MySQL transactions all the time, but we are not as big a company (the system is used by maybe 15 people at any given time). However, I would like to know exactly what is going on. My questions are:

  • Is that I/O usage normal for such workload? (Note: disks are in a RAID1 setup)
  • Is there some way to check what is going on inside this file, maybe some software? (Note: CPU and network usage are low, and I got a .dmp file of it using ProcessHacker)

Cheers,

José F

jfabian
  • 1
  • 3
  • Are you sure that csrss.exe is actually causing *disk* I/O? It is well-known to cause a lot of [*"other"* I/O](http://serverfault.com/questions/289488/in-windows-task-manager-in-the-processes-tab-what-does-i-o-other-mean) when remote desktop sessions to the server are opened, which would not correspond to real disk activity. Also, do you have any antivirus suite (including Windows Defender or Security Essentials) running on your server? – the-wabbit Sep 24 '13 at 16:08
  • @syneticon-dj I thought about RDP causing a higher I/O usage, but the users complain about a slow operation even if I'm not logged in. The guy hired to sell and give support to the software said that it's too slow for the current work load. As for the AV, there's NOD32 installed (not by me, but by my colleague). I opened Disk Defrag and, even though the RAID partition uses NTFS, the MDF file was divided into something like 6000 pieces (all across the disk, literally). – jfabian Sep 24 '13 at 16:18
  • I would start by removing the AV - it often is a performance killer. MFT fragmentation usually occurs due to low disk space conditions and should indeed be fixed as it could benefit from the read-ahead functionality. Other than that, use Process Explorer (or perfmon) to see if disk I/O caused by CSRSS is indeed the problem. – the-wabbit Sep 24 '13 at 19:38
  • I was talking about the MySQL database file, not about the MFT :) The MFT seemed to be okay. I defragged the disk and things seem to be much better now, some disk-intensive processes ran faster. I will check again periodically. As for the apps, if they report the disk I/O activity, then they're the answer to my second question :) – jfabian Sep 25 '13 at 15:50

0 Answers0