I have a SQL Server 2005 Enterprise Edition on a Windows Server 2003 Enterprise sp2. Lately, I get very high I/O(Reda, Write, Other in Task Manager) from process lsass.exe. When I run sysinternals' process monitor on lsass.exe, I get a lot of activity related to SQL Server process. It seems it repeats a pattern of IRP_MJ_CREATE, IRP_MJ_DIRECTORY_CONTROL, IRP_MJ_CLEANUP and IRP_MJ_CLOSE by requests from sql server. Any suggestions on the cause?
Asked
Active
Viewed 1,567 times
1
-
1Belongs on SuperUser.com – Sam Becker Jan 02 '10 at 06:18
-
No it doesn't - but it could do with some more data relating to to the level of IO, the spec and config of the server and what it is being used for. – Helvick Jan 02 '10 at 09:58
2 Answers
1
LSASS is the Local Security Authority process. LSASS does any work only as a result of security related activity occurring on other processes. A high amount of lsass.exe activity would indicate perhaps a high number of authentication (Kerberos, NTLM) events occurring.
Forget about Task Monitor or Process Monitor. Fire up Perfmon and look at the performance counters if you want to troubleshoot a problem. Get all counters/all instances for the Process category to identify which process consumes CPU/Memory/IO. I would be quite surprised to hear that lsass is truly a performance bottleneck.
I'd recommend you follow the Waits and Queues troubleshooting methodology to understand why you experience problems at peak hours. It's a proven methodology with an stellar track record on identifying problem root cause.
Remus Rusanu
- 8,283
- 1
- 21
- 23
0
The server is a database server. we have about 150 clients that use this server as db server for their application(hospital automation). In task manager, for sqlserver.exe, reads and writes are about 1 million, where lsass is 19,000,000 and it increases between 50-100 every second. This causes a significant decrease in server performance in peak hours.