"System" process taken up all resources

[Terry]

The school I'm working with is experiencing the following
problem. Three identical servers, all with nearly the same
number of processes, packets, etc. The one server that
houses the user roaming profiles(300 teachers), mapped
data drive for each user(up to 800), and mapped "public"
folder(again up to 800), runs maxed out nearly all the
time (70-99% constantly). Nearly all of the resources are
being consumed by the "SYSTEM" process. Almost nothing
else runs on this server. Network sniffing says ethernet
usage only ~10%. Is this too much too ask from a dual PII
450's, 1GB Ram, raid 5 server? (I can't believe it is)
Thanks for any advice!
Terry

 

[Elijah Landreth [MSFT]]

There are numerous things that can cause this in your case, this is my best
educated guess based on the info I have:

This can be caused by a highly fragemented disk volume. The larger the
volume, the
larger the problem. Defragmenting the volume resolved the issue.
******************************************
other things known to cause this are:
Malfunctioning hardware sending interupts to the proc
HP OfficeJet Software (may have been patched by now)
RootKits and other Malware can cause this
******************************************
What to try next:
Disconnect the network cable. If the CPU utilization decreases, there
could be a
network hardware problem.

If network hardware has been ruled out, you can track down the thread ID
and the
load address of that thread using perfmon, pviewer, and pstat. You can
then
determine if a driver is causing the high CPU time:
(get the latest 2k support tools from microsoft download webpage)
The following must be done in REAL TIME. You cannot do this with a perfmon
log.

1. Start performance monitor and make sure you are in chart view (realtime).
2. Hit the plus sign, select the thread object, and counter % processor
time.
3. Under instance, add all of the system threads to the chart.
4. Look for the thread that is taking all of the CPU time and note the
instance
number (thread ID).
5. Once you find the thread, get the instance number from the bottom of
perfmon
where it displays the counter.
6. Start pviewer.exe, this is from the resource kit.
7. In pviewer, under process, select the system process. Find the thread ID
that matches the instance number from perfmon under Threads.
8. Get the start address under thread information.
9. Run pstat.exe with the command pstat > pstat.txt. Look at the bottom of
the
pstat.txt, match up Load Addr with the start address you found from
pviewer.
If you can't find it just search the whole file for the start address. If
you
get a match, this is the driver that is causing the problem. You will need
to
find out what that driver is and either replace, upgrade or disable it.
If you do not get an exact match, then look for the closest driver match
within the
address range that you determined in the previous steps.
*********************************************************************

personally my vote goes for the defrag resolution based onthe number of
users, but you can always call microsoft support to open an incident.

Elijah Landreth [MSFT]
Microsoft Server Setup Team

Search our Knowledge Base at http://support.microsoft.com/directory
Visit the Windows 2000 Homepage at
http://www.microsoft.com/windows2000/default.asp
See the Windows NT Homepage at http://www.microsoft.com/ntserver/

NOTE: Please reply to the newsgroup and not directly to me. This allows
others to add to and benefit from these threads and also helps to ensure a
more timely response. Thank you!

This posting is provided "AS IS" without warranty either expressed or
implied, including, but not limited to, the implied warranties of
merchantability or fitness for a particular purpose.
The views and opinions expressed in this newsgroup posting are mine and do
not necessarily express or reflect the views and / or opinions of
Microsoft.
or opinions of Microsoft.