The 'SYSTEM' process is taking up all my cpu usage!!!

[woody]

Ok,

 

This is happening on my main server which mainly controls active directory and group policy.

 

The 'SYSTEM' process in task manager is eating up all of the cpu usage and is regularly at 99%.

 

I have tried using a tool from microsoft called qslice but when I double click on the SYSTEM process, there is no scroll bar to look through the threads and I can't fit them all in the window due to lack of screen size. AARRRHHH.

 

As you can image, this is slowing down access to the server. It is not good. Any suggestions?

[Ric_]

What's the box running?

 

Virus scan and apply patches, etc.

[Geoff]

Spyware comes to mind too. Check you hardware and drivers out too.

[ajbritton]

Would Process Explorer from SysInternals be of any use?

[Geoff]

Does that break down the system process? I presume it would..

 

What I wouldn't give for a windows equivelent of slabtop!!

[woody]

Thanks for all your comments guys. I have tried Process Explorer and it certainly tells me a lot more than Task Manager. I can see all of the DLLs that run under the system process, but how do I know which one if any are causing the problems?

 

Plus you can look at the threads under system and these do tell you what amount of the cPU they are taking up. All the cpu usage is being taken up by srv.sys although Process Explorer splits it up into smaller parts. I'm not sure how to interprit this. I have attached a screenshot of what is happening.

 

If anyone can interprit the handwriting on the wall, I will be very glad!

[Geoff]

Looks like a virus to me. Srv.sys handles netbios. There's been several security problems with it over the years. Maybe you picked up something nasty somehow?

[woody]

There's another thing. The cpu does seem to calm down inbetween lessons. But it picks up again as soon as everyone starts to log on. And while the CPU is working flat out, so is the GB network connection.

[StewartKnight]

was this screen dump taken when the CPU was at full belt?

 

Perhaps you have a machine spamming the server!

[Geoff]

yes. what does netstat think?

[woody]

I've just realised (DOH, it was over two years ago that I bought it) that the server has two processors. Does anyone know where I can set priorities for these processors. I've found a simple setting under advanced in the SYSTEM control panel for performance but there must be something more detailed. Both processors are xeon 2.5gb

[Geoff]

Get a better operating system. Windows Server (Standard at any rate) does not allow you to set processor afinity.

[woody]

What system would you recommend? We currently have MS server 2003 enterprise

[Ric_]

@mark_wood: Linux of course

 

Enterprise should allow you to set process affinity though.

[woody]

Does linux have an alternative to group policy settings? We moved from linux to windows server so we could lock down the clients!

[Geoff]

Well you could always run Novell NDS on your Linux servers and keep Group Policies.

 

Your better off moving your Windows desktops to Linux based thin clients in the long run though.

[woody]

I think I will stick to the territory I'm used to. I don't want to get into a windows or linux discussion and I think that if you have a head for all that stuff, then 'good on yer'.

 

I for my part struggled to get a simple fedora installation to work properly as a web server with php and mysql. I dread to think where I would end up trying to run linux servers on the network using Novell NDS for group policy and changing all my desktops to thin client linux.

 

I will admit, that is probably beyond me unless I was working alongside an expert and was shown the ropes rather than figure it all out my self.

 

Phew. And all that just to change the dual processor settings!

[Geoff]

Feel free to post about your Fedora web server woes in the Linux forum. We'll get you up and running in no time.

[woody]

Thanks Geoff. I know everyone is raring to help me. Actually, with a lot of help from my brother, I did get fedora up and running, and in the long run it wasn't too difficult. But the problem was, for all the simple things I'm used to doing in windows, I had to go round the houses to get working in Linux. Even to install simple drivers was a nightmare. Every procedure contained had a seperate problem lying just behind it.

 

At the end of the day, it is all a matter of know how, and if you don't know how, then there is a lot of wasted time that goes with running linux. Not wasted in the fact that you are learning (tho be it the hard way) but wasted in the fact that as a busy technician at work, and a busy father at home, you know you should be doing other things when you find yourself tinkering away in that linux console.

[Geoff]

I understand completely. No doubt myself, the Linux forum and your Fedora play box will still be waiting for you when you find time to pick where you left off.

[ninjabeaver]

@mark_wood Is this problem still on-going? I don't think this has anything to do with what you have there, but it may be worth invrstigating.

 

Just check that none of the students / staff have looped a netwok cable back into another point. That it from one network point to another. That happens here once in a while and kills the network and sends the CPU loopy here.

 

I just thought of it because you were saying it gets worse at lesson time.

 

Or if you have fixed it, what was it?

[woody]

Ok update time.

 

The problem appears to have gone away. Thank for the tip ninjabeaver regarding the network loop trick, I will bear that in mind.

 

All that I have done to the server is given it a bit of a clean up, removed old shared directories, deleted old files, removed a few unnecessary apps, etc. Whether all that has contributed to an improvement in CPU usage or not I cannot say. All I can say is that from yesterday afternoon, the CPUs have been running efficiently and the SYSTEM process has remained below 10% usage as I would expect it to be.

 

Thanks for all who have contributed to try and help me and If the problem comes back I will report back to here.

[Geoff]

Just check that none of the students / staff have looped a netwok cable back into another point. That it from one network point to another. That happens here once in a while and kills the network and sends the CPU loopy here.

 

You can stop this if you have managed switches. Look for an option called Spanning Tree Protocol (STP).

 

http://en.wikipedia.org/wiki/Spanning_Tree_Protocol