Excessive paging - how to narrow it down?

[Michael Silverman]

Hi all,

I have a file server running Windows 2000 Adv w/SP4. The server hosts 2
TB of data has 3 GB RAM (Previously had 1.5 which I thought was a little
light so I doubled it thinking it may help this issue but it did not).
What is happening is that I am seeing paging at an absolutely monumental
level constantly.
Anywhere between 500 - 3000 Pages/Sec, mostly on the higher end but it
does drop down every now and again for a few seconds. What's strange is
that I have a 3 GB page file and only 25 - 30 MB is ever used.
What is somewhat frustrating is that the process that is doing most of
the paging if not all is the Services.exe which controls a whole bunch
of sub processes.
Is there any way I can drill down to see which service is the culprit?
I can see the thread ID's but don't see a way to translate that into
either a service or sub process executable spawned from services.exe

Any assistance is greatly appreciated, thanks.

Mike.

 

[Dave Patrick]

Try;
tlist -s
now match up the PID > Image name

You can extract the tlist.exe utility from the Support.cab file from the
Windows 2000 installation CD's Support\Tools folder

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Hi all,
|
| I have a file server running Windows 2000 Adv w/SP4. The server hosts 2
| TB of data has 3 GB RAM (Previously had 1.5 which I thought was a little
| light so I doubled it thinking it may help this issue but it did not).
| What is happening is that I am seeing paging at an absolutely monumental
| level constantly.
| Anywhere between 500 - 3000 Pages/Sec, mostly on the higher end but it
| does drop down every now and again for a few seconds. What's strange is
| that I have a 3 GB page file and only 25 - 30 MB is ever used.
| What is somewhat frustrating is that the process that is doing most of
| the paging if not all is the Services.exe which controls a whole bunch
| of sub processes.
| Is there any way I can drill down to see which service is the culprit?
| I can see the thread ID's but don't see a way to translate that into
| either a service or sub process executable spawned from services.exe
|
| Any assistance is greatly appreciated, thanks.
|
| Mike.

 

[Michael Silverman]

I will give it a try and report back my findings...thanks alot Dave!

Mike.

 

[Michael Silverman]

Just tried it. It does not provide me the information I require, it
shows me what I already know. Thanks anyways.

Is there a utility that will display a table of thread ID to thread name
executable? I will peruse around and see if I can find one nut if
anyone knows of one, please let me know.

Mike.

 

[Dave Patrick]

Should have returned something similar to;

Image Name PID Services
========================= ======
System Idle Process 0 N/A
System 4 N/A
smss.exe 632 N/A
csrss.exe 864 N/A
winlogon.exe 888 N/A
services.exe 932 Eventlog, PlugPlay
lsass.exe 944 Netlogon, PolicyAgent, ProtectedStorage,
SamSs
svchost.exe 1156 DcomLaunch, TermService
svchost.exe 1224 RpcSs
MsMpEng.exe 1292 WinDefend
svchost.exe 1332 AudioSrv, Browser, CryptSvc, Dhcp,
dmserver,
ERSvc, EventSystem, helpsvc, HidServ,
lanmanserver, lanmanworkstation, Messenger,
Netman, Nla, NtmsSvc, RasMan, Schedule,
seclogon, SENS, SharedAccess,
ShellHWDetection, TapiSrv, Themes, TrkWks,
W32Time, winmgmt, wuauserv, WZCSVC
svchost.exe 1428 Dnscache
svchost.exe 1484 LmHosts, RemoteRegistry, SSDPSRV, WebClient

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Just tried it. It does not provide me the information I require, it
| shows me what I already know. Thanks anyways.
|
| Is there a utility that will display a table of thread ID to thread name
| executable? I will peruse around and see if I can find one nut if
| anyone knows of one, please let me know.
|
| Mike.

 

[Michael Silverman]

Yes, it did, that's not what I am looking for. I am looking for the
thread ID's that map to services.exe. Services.exe spawns about 40
threads on our file server and while I can see the Thread ID list and
what each is doing, I do not have a table that shows me thread ID 1 is
actually abc.exe and Thread ID 2 is DEF.exe. That's what I need.

Thanks Dave,

Mike.

 

[Dave Patrick]

AFAIK this is the most granularity you'll get. Are you saying all 40 are
listed under one PID instance of services.exe?

services.exe 932 Eventlog, PlugPlay

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Yes, it did, that's not what I am looking for. I am looking for the
| thread ID's that map to services.exe. Services.exe spawns about 40
| threads on our file server and while I can see the Thread ID list and
| what each is doing, I do not have a table that shows me thread ID 1 is
| actually abc.exe and Thread ID 2 is DEF.exe. That's what I need.
|
| Thanks Dave,
|
| Mike.

 

[Michael Silverman]

If you run Perfmon and add a counter, then select thread as the
performance object, you will be able to see the thread ID's for a given
process.
Because services.exe is responsible for all Windows services running on
a system, it spawns a thread for each of these subprocesses that are in
fact other EXEs. The problem is that there appears to be no method of
correlation between these subprocess EXEs and the thread IDs that
Perfmon displays.
I have Quest Software's Spotlight for Windows running on our file server
and when I look at the 'Process Drilldown' table, I see that
Services.exe is paging incredibly high. As I stated before, somewhere
around 2 - 3 thousand Pages/Sec, see previous thread posts for other
details.
I can then double-click on Services.exe and I get the list of Thread
ID's that are running but I do not get the actual EXEs for those threads
in order to determine exactly which service or services are doing all
the paging.

Mike.

 

[Dave Patrick]

Doesn't seem to answer the question. Are you saying all 40 are listed under
one PID instance of services.exe?

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| If you run Perfmon and add a counter, then select thread as the
| performance object, you will be able to see the thread ID's for a given
| process.
| Because services.exe is responsible for all Windows services running on
| a system, it spawns a thread for each of these subprocesses that are in
| fact other EXEs. The problem is that there appears to be no method of
| correlation between these subprocess EXEs and the thread IDs that
| Perfmon displays.
| I have Quest Software's Spotlight for Windows running on our file server
| and when I look at the 'Process Drilldown' table, I see that
| Services.exe is paging incredibly high. As I stated before, somewhere
| around 2 - 3 thousand Pages/Sec, see previous thread posts for other
| details.
| I can then double-click on Services.exe and I get the list of Thread
| ID's that are running but I do not get the actual EXEs for those threads
| in order to determine exactly which service or services are doing all
| the paging.
|
| Mike.

 

[Michael Silverman]

There is only ever one instance of services.exe. In this particular
case, there are 51 Thread IDs listed.

Mike.

 

[Dave Patrick]

Then it should have worked.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
<snip>
In this particular
| case, there are 51 Thread IDs listed.
|
| Mike.

 

[Michael Silverman]

What should have worked? The tlist utility does not show Thread IDs and
corresponding executable names so again, it does not provide the
information I am looking for, was there something else you were
referring to?

 

[Dave Patrick]

Are we hung in a loop?
tlist -s

should have returned something similar to;

Image Name PID Services
========================= ======
System Idle Process 0 N/A
System 4 N/A
smss.exe 632 N/A
csrss.exe 864 N/A
winlogon.exe 888 N/A
services.exe 932 Eventlog, PlugPlay
lsass.exe 944 Netlogon, PolicyAgent, ProtectedStorage,
SamSs
svchost.exe 1156 DcomLaunch, TermService
svchost.exe 1224 RpcSs
MsMpEng.exe 1292 WinDefend
svchost.exe 1332 AudioSrv, Browser, CryptSvc, Dhcp,
dmserver,
ERSvc, EventSystem, helpsvc, HidServ,
lanmanserver, lanmanworkstation, Messenger,
Netman, Nla, NtmsSvc, RasMan, Schedule,
seclogon, SENS, SharedAccess,
ShellHWDetection, TapiSrv, Themes, TrkWks,
W32Time, winmgmt, wuauserv, WZCSVC
svchost.exe 1428 Dnscache
svchost.exe 1484 LmHosts, RemoteRegistry, SSDPSRV, WebClient

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| What should have worked? The tlist utility does not show Thread IDs and
| corresponding executable names so again, it does not provide the
| information I am looking for, was there something else you were
| referring to?

 

[Michael Silverman]

LOL! ok, it did return that...but using an example with this output can
you tell me what the Thread ID is for TapiSrv? It is running under the
svchost process but what is the Thread ID? That is not displayed here.

I can see Thread IDs in Perfmon and in Spotlight for Windows but they do
not show me the corresponding thread executables.

Mike.

 

[Dave Patrick]

1332

This tool may give you more granularity.

http://www.sysinternals.com/Utilities/ProcessExplorer.html

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| LOL! ok, it did return that...but using an example with this output can
| you tell me what the Thread ID is for TapiSrv? It is running under the
| svchost process but what is the Thread ID? That is not displayed here.
|
| I can see Thread IDs in Perfmon and in Spotlight for Windows but they do
| not show me the corresponding thread executables.
|
| Mike.

 

[Bill Stewart]

1332

That's the process ID, not the thread ID.

 

[Dave Patrick]

I know.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| That's the process ID, not the thread ID.
|
| --
| Bill Stewart

 

[Bill Stewart]

I know.

Maybe I don't understand. The OP's question was how to determine the
thread ID. Telling him the process ID doesn't answer the question.