Hi all,

I have a file server running Windows 2000 Adv w/SP4. The server hosts 2
TB of data has 3 GB RAM (Previously had 1.5 which I thought was a little
light so I doubled it thinking it may help this issue but it did not).
What is happening is that I am seeing paging at an absolutely monumental
level constantly.
Anywhere between 500 - 3000 Pages/Sec, mostly on the higher end but it
does drop down every now and again for a few seconds. What's strange is
that I have a 3 GB page file and only 25 - 30 MB is ever used.
What is somewhat frustrating is that the process that is doing most of
the paging if not all is the Services.exe which controls a whole bunch
of sub processes.
Is there any way I can drill down to see which service is the culprit?
I can see the thread ID's but don't see a way to translate that into
either a service or sub process executable spawned from services.exe

Any assistance is greatly appreciated, thanks.

Mike.

Try;
tlist -s
now match up the PID > Image name

You can extract the tlist.exe utility from the Support.cab file from the
Windows 2000 installation CD's Support\Tools folder

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Michael Silverman" wrote:
| Hi all,
|
| I have a file server running Windows 2000 Adv w/SP4. The server hosts 2
| TB of data has 3 GB RAM (Previously had 1.5 which I thought was a little
| light so I doubled it thinking it may help this issue but it did not).
| What is happening is that I am seeing paging at an absolutely monumental
| level constantly.
| Anywhere between 500 - 3000 Pages/Sec, mostly on the higher end but it
| does drop down every now and again for a few seconds. What's strange is
| that I have a 3 GB page file and only 25 - 30 MB is ever used.
| What is somewhat frustrating is that the process that is doing most of
| the paging if not all is the Services.exe which controls a whole bunch
| of sub processes.
| Is there any way I can drill down to see which service is the culprit?
| I can see the thread ID's but don't see a way to translate that into
| either a service or sub process executable spawned from services.exe
|
| Any assistance is greatly appreciated, thanks.
|
| Mike.

I will give it a try and report back my findings...thanks alot Dave!

Mike.

Dave Patrick wrote:
> Try;
> tlist -s
> now match up the PID > Image name
>
> You can extract the tlist.exe utility from the Support.cab file from the
> Windows 2000 installation CD's Support\Tools folder
>

Just tried it. It does not provide me the information I require, it
shows me what I already know. Thanks anyways.

Is there a utility that will display a table of thread ID to thread name
executable? I will peruse around and see if I can find one nut if
anyone knows of one, please let me know.

Mike.

Dave Patrick wrote:
> Try;
> tlist -s
> now match up the PID > Image name
>
> You can extract the tlist.exe utility from the Support.cab file from the
> Windows 2000 installation CD's Support\Tools folder
>

Should have returned something similar to;

Image Name PID Services
========================= ======
System Idle Process 0 N/A
System 4 N/A
smss.exe 632 N/A
csrss.exe 864 N/A
winlogon.exe 888 N/A
services.exe 932 Eventlog, PlugPlay
lsass.exe 944 Netlogon, PolicyAgent, ProtectedStorage,
SamSs
svchost.exe 1156 DcomLaunch, TermService
svchost.exe 1224 RpcSs
MsMpEng.exe 1292 WinDefend
svchost.exe 1332 AudioSrv, Browser, CryptSvc, Dhcp,
dmserver,
ERSvc, EventSystem, helpsvc, HidServ,
lanmanserver, lanmanworkstation, Messenger,
Netman, Nla, NtmsSvc, RasMan, Schedule,
seclogon, SENS, SharedAccess,
ShellHWDetection, TapiSrv, Themes, TrkWks,
W32Time, winmgmt, wuauserv, WZCSVC
svchost.exe 1428 Dnscache
svchost.exe 1484 LmHosts, RemoteRegistry, SSDPSRV, WebClient

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Michael Silverman" wrote:
| Just tried it. It does not provide me the information I require, it
| shows me what I already know. Thanks anyways.
|
| Is there a utility that will display a table of thread ID to thread name
| executable? I will peruse around and see if I can find one nut if
| anyone knows of one, please let me know.
|
| Mike.

Yes, it did, that's not what I am looking for. I am looking for the
thread ID's that map to services.exe. Services.exe spawns about 40
threads on our file server and while I can see the Thread ID list and
what each is doing, I do not have a table that shows me thread ID 1 is
actually abc.exe and Thread ID 2 is DEF.exe. That's what I need.

Thanks Dave,

Mike.

Dave Patrick wrote:
> Should have returned something similar to;
>
> Image Name PID Services
> ========================= ======
> System Idle Process 0 N/A
> System 4 N/A
> smss.exe 632 N/A
> csrss.exe 864 N/A
> winlogon.exe 888 N/A
> services.exe 932 Eventlog, PlugPlay
> lsass.exe 944 Netlogon, PolicyAgent, ProtectedStorage,
> SamSs
> svchost.exe 1156 DcomLaunch, TermService
> svchost.exe 1224 RpcSs
> MsMpEng.exe 1292 WinDefend
> svchost.exe 1332 AudioSrv, Browser, CryptSvc, Dhcp,
> dmserver,
> ERSvc, EventSystem, helpsvc, HidServ,
> lanmanserver, lanmanworkstation, Messenger,
> Netman, Nla, NtmsSvc, RasMan, Schedule,
> seclogon, SENS, SharedAccess,
> ShellHWDetection, TapiSrv, Themes, TrkWks,
> W32Time, winmgmt, wuauserv, WZCSVC
> svchost.exe 1428 Dnscache
> svchost.exe 1484 LmHosts, RemoteRegistry, SSDPSRV, WebClient
>

AFAIK this is the most granularity you'll get. Are you saying all 40 are
listed under one PID instance of services.exe?

services.exe 932 Eventlog, PlugPlay

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Michael Silverman" wrote:
| Yes, it did, that's not what I am looking for. I am looking for the
| thread ID's that map to services.exe. Services.exe spawns about 40
| threads on our file server and while I can see the Thread ID list and
| what each is doing, I do not have a table that shows me thread ID 1 is
| actually abc.exe and Thread ID 2 is DEF.exe. That's what I need.
|
| Thanks Dave,
|
| Mike.

If you run Perfmon and add a counter, then select thread as the
performance object, you will be able to see the thread ID's for a given
process.
Because services.exe is responsible for all Windows services running on
a system, it spawns a thread for each of these subprocesses that are in
fact other EXEs. The problem is that there appears to be no method of
correlation between these subprocess EXEs and the thread IDs that
Perfmon displays.
I have Quest Software's Spotlight for Windows running on our file server
and when I look at the 'Process Drilldown' table, I see that
Services.exe is paging incredibly high. As I stated before, somewhere
around 2 - 3 thousand Pages/Sec, see previous thread posts for other
details.
I can then double-click on Services.exe and I get the list of Thread
ID's that are running but I do not get the actual EXEs for those threads
in order to determine exactly which service or services are doing all
the paging.

Mike.

Dave Patrick wrote:
> AFAIK this is the most granularity you'll get. Are you saying all 40 are
> listed under one PID instance of services.exe?
>
> services.exe 932 Eventlog, PlugPlay
>

Doesn't seem to answer the question. Are you saying all 40 are listed under
one PID instance of services.exe?

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Michael Silverman" wrote:
| If you run Perfmon and add a counter, then select thread as the
| performance object, you will be able to see the thread ID's for a given
| process.
| Because services.exe is responsible for all Windows services running on
| a system, it spawns a thread for each of these subprocesses that are in
| fact other EXEs. The problem is that there appears to be no method of
| correlation between these subprocess EXEs and the thread IDs that
| Perfmon displays.
| I have Quest Software's Spotlight for Windows running on our file server
| and when I look at the 'Process Drilldown' table, I see that
| Services.exe is paging incredibly high. As I stated before, somewhere
| around 2 - 3 thousand Pages/Sec, see previous thread posts for other
| details.
| I can then double-click on Services.exe and I get the list of Thread
| ID's that are running but I do not get the actual EXEs for those threads
| in order to determine exactly which service or services are doing all
| the paging.
|
| Mike.

There is only ever one instance of services.exe. In this particular
case, there are 51 Thread IDs listed.

Mike.

Dave Patrick wrote:
> Doesn't seem to answer the question. Are you saying all 40 are listed under
> one PID instance of services.exe?
>