How to solve the problem of 100% CPU usage

Overview

This article mainly introduces the troubleshooting and solutions to the problem of high CPU usage in Windows instances.

Details

Alibaba Cloud reminds you:

• If you perform risky operations such as modifying or changing the instance or data, be sure to pay attention to the content of the instance. disaster and fault tolerance to ensure data security.
• If you make configuration and data modifications to instances (including but not limited to ECS, RDS), etc., it is recommended to create snapshots in advance or enable RDS log backup and other functions.
• If you have authorized or submitted security information such as login account and password on the Alibaba Cloud platform, it is recommended that you modify it in time.

This article mainly introduces the following steps.

Positioning problem. Find the specific process causing high CPU usage.

Analysis and processing. Check whether the processes causing high CPU usage are normal and classify them for processing.

• For normal processes: You need to optimize the program or upgrade the server configuration.
• For abnormal processes: You can manually check and kill the process, or you can use third-party security tools to check and kill the process.

Operation example. Introduce the specific troubleshooting and solution process.

More information. Introduce the use of troubleshooting tools.

Locating the problem

Microsoft has multiple tools to locate the problem of excessive CPU usage, such as Task Manager, Resource Monitor (Resource Monitor), Performance Monitor (Performance Monitor), Process Explorer, Xperf (Windows server 2008 and later), KernRate (Windows server 2003), grab the system Full Memory Dump for inspection. In the case of heavy traffic, you can also use Wireshark to capture network packets for a period of time and analyze traffic usage.

Tips: For Windows Server 2008 and above systems, the resource monitor that comes with the system is usually used to monitor the CPU.

• Click the Start menu at the bottom of the desktop and select Run.

• After opening the run box, enter perfmon -res in the box and click OK.

• In the resource monitor page, check whether the CPU usage of each process is too high The phenomenon.

• For processes that occupy higher resources, check the corresponding process ID and program of the process name.

• After locating the process ID, use the task manager to determine whether the program is abnormal and locate the specific location of the program.

1. Before locating the abnormal process, you need to click View (V)> Select Column (S) in the Task Manager.
   
2. Select PID (Process Identifier) in the pop-up box and click OK.
   
3. #In the process page of the task manager, the PID item will be added. Click PID and sort to find the abnormal process previously viewed by the resource monitor. Right-click the process name and select Open File Location to check whether the process is a malicious program.

Analysis and processing

Analysis and processing of excessive CPU usage

You need to determine whether the process that affects the high CPU usage is a normal process or an abnormal process. and classified for processing.

Analysis and processing of excessive normal usage

Under normal circumstances, when customers frequently access the business, or due to Windows' own services (update services, etc.), high network traffic and CPU may be occupied . For high CPU usage caused by normal processes, please troubleshoot one by one in the following order.

Tips: It is recommended that the memory configuration of Windows Server 2008 or Windows Server 2012 instances be 2G or above.

• Check whether there is any Windows Update behavior in the background.

• It is recommended to install anti-virus software on the server for anti-virus. If you have installed anti-virus software, please check whether the anti-virus software performs scanning operations in the background when the CPU is high. If possible, please upgrade the anti-virus software to the latest version, or delete the anti-virus software.

• Check whether the application in the ECS has a large amount of disk access, network access behavior or high computing requirements. Try to increase instance specifications and use more cores or memory specifications to solve resource bottlenecks, such as upgrading configurations.

• If your server configuration is high, there is no point in upgrading the configuration. In terms of architecture, it does not mean that the higher the server configuration, the better. At this time, you need to try to separate applications and optimize related programs at the same time. Example instructions are as follows.

Problem description: When multiple applications such as MySQL, PHP, and Web are deployed on a server at the same time, even if the configuration is relatively high, it is easy for resource load abnormalities to occur.
Solution: Try application separation and use different servers to host different applications. For example, the database is completely hosted through RDS, which reduces the resource consumption of the server itself and the large number of calls within the server. In terms of program optimization, you can make adjustments according to your own configuration, such as adjusting the number of connections and cache configurations, as well as various parameters for Web and database calls, etc.

Analysis and Processing of Abnormally High Usage

For abnormally high CPU usage, it may be caused by malicious viruses and Trojans. Sometimes third-party malicious programs may use the operating system's svchost.exe or Tcpsvcs.exe to disguise themselves, causing high CPU usage. You need to manually detect and kill abnormal processes.

Tips: If you cannot determine whether the process is a virus or Trojan horse, it is recommended to search the process name online and confirm it. In addition, it is recommended that you create a snapshot in advance to complete the backup before deleting the process.

• Use commercial anti-virus software, or use Microsoft's free security tool Microsoft Safety Scanner to scan and anti-virus in safe mode. The tool link is as follows.
• https://www.microsoft.com/security/scanner/zh-cn/default.aspx

• Run Windows Update to install the latest Microsoft Security patches.

• Use MSconfig to disable all non-Microsoft service drivers and check whether the problem occurs again. For specific operations, please refer to How to perform a clean boot in Windows systems.

• If the server or site suffers a DDoS attack or CC attack, a large number of access demands will be generated in a short period of time. You can log in to Cloud Security Center to check whether the protection threshold for DDoS attacks in Cloud Shield has been adjusted, and verify whether CC protection is enabled. If the attack does not trigger the threshold and Cloud Shield is not cleaned, you can contact after-sales service to help start cleaning.

Operation example

Possible reasons for high CPU usage are as follows.

• Virus Trojan invasion.
• Run third-party anti-virus software.
• Application exceptions, driver exceptions, high I/O usage or high interrupt processing applications.

Tip: When using a 1-core 1GB instance of Windows Server 2012, the Windows Update service will automatically update, and the CPU usage of the instance will suddenly increase. High, this is normal.

Solution

Tips: This article quotes a large number of Microsoft’s official documents and tool links. The copyright and ownership rights belong to Microsoft. Please pay full attention to them. Consider the problems that may arise from Microsoft Windows product iterations or documentation that is not updated in a timely manner.

• #When the CPU usage is high, check whether the Windows Update process is executing in the background.

• Check whether the anti-virus software is performing scanning operations in the background. You can upgrade the anti-virus software to the latest version, or delete the anti-virus software.

• Click Run, then enter MSCONFIG, disable all non-Microsoft built-in service drivers, and then check whether the problem occurs again. Relevant reference documents are as follows.

• How to perform a clean boot in Windows

• Use commercial anti-virus software or Microsoft Security Scanner to safely Scan for viruses in mode. The reference documentation for Microsoft Security Scanner is as follows.

• Microsoft Security Scanner

• Run Windows Update to install the latest Microsoft security patches.

• When the ECS instance has a large amount of disk access, network access and high computing requirements, it is normal for the CPU usage to be high. You can upgrade the instance specifications to deal with the problem of insufficient resources. . For information on how to upgrade instance specifications, please refer to the following documents.

• Summary of configuration upgrade and downgrade methods

For more solutions, please refer to the following Microsoft documents.

• How to troubleshoot high cpu in the System process

More information

The following are recommended troubleshooting tools for Windows instances related content.

Task Manager

• Visually check the application list and locate applications that occupy higher CPU. The following is the Task Manager page.
  
• When checking the CPU usage on the performance page, right-click the CPU usage graph and click Change the graph to > Logical Processor. The figure below shows the usage of 4 logical CPUs.
  
• When the CPU usage of a single process soars to close to 100%, but the CPU usage of other processes does not change much, it may be network I/O caused by processing.

Resource Monitor

Visually check the CPU usage, and you can also search for the corresponding process through handles and modules.

Process Explorer

• Process Explorer is a Microsoft Sysinternals tool. By configuring the correct Symbols, it checks the Call Stack called by the thread of the corresponding application to locate possible problem drivers. The link to download the Process Explorer tool is as follows.
  
  • Process Explorer
• The following is the Process Explorer tool usage page.
  

Performance Monitor

• Performance Monitor (Performance Monitor) is Microsoft’s professional tool for collecting performance counters of various components. . For system CPU resource consumption, there are multiple Counters to check. Open Performance Monitor by clicking Start > Run > perfmon.
• Performance has the following three core parameters. Where \Processor(_Total)\% Processor Time is the sum of \Processor(*)\% User Time and \Processor(*)\% Privileged Time .
  • \Processor(_Total)\% Processor Time
  • \Processor(*)\% User Time
  • \Processor(*)\% Privileged Time
• \Processor(*)\% Privileged Time is when the application executes system calls in the kernel ( Such as driver, IRP, context switch, etc.) operation time. If the operating system spends more than 30% of its time in Privileged Time, as shown in the figure below, it means that the instance is performing operations related to high I/O throughput.
  
• When % Privileged Time is very high, further checks are required % DPC Time, % Interrupt The situation of Time and Context Switches/sec.
  • High% DPC Time, % Interrupt Time means that the unknown device has a large number of operations or poor performance problems. Please refer to the following documents.
    
    • Choose Your Own Adventure: High Deferred Procedure Calls (DPCs) or High Interrupts
  ##高
  • Context Switches/sec means that there are a large number of threads in the Ready state, and the number of threads needs to be reduced to solve the problem. When
• % DPC Time and % Interrupt Time are very high, you need to use the Microsoft Xperf tool for further analysis. Please refer to the following document to use the XPerf tool .
  
  • Windows IT Pro Magazine: Examining xPerf
When the Context Switch value is very high, please refer to the following document.
• • The Case of the 2 Million Context Switches
  • Mark Russinovich's The Case of the System Process CPU Spikes
• \Processor(*)\% User TimeIndicates the time consumed by the processor to execute program code. You can determine which application or function call consumes more time.
High
• User TimeThe situation is shown in the figure below.
  

Applicable to

cloud server ECS