This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 33%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAR%3C/text%3E%3C/svg%3E)
Hi everyone,
We can't understand a behavior that we got since yesterday on every file server of our infrastructure: The "SYSTEM" process (ntoskrnl.exe) is using all CPU available, conducting to completly overload the server and slow down to hell its services... Same problem on WS2012R2 & 2016.
On 2012R2, we got 3 KB installed recently (05/09) : KB5004233, KB5004298, KB5004285. On 2016, the last CU installed was the KB5005043 on late august. Nothing more since that.
https://superuser.com/questions/527401/troubleshoot-high-cpu-usage-by-the-system-process
Same thing, can't find any relevant using the Windows Performance Analyzer...
Have you any advices ?
Thanks in advance...
Arnaud
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 77%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMR%3C/text%3E%3C/svg%3E)
I just started seeing this on one Windows 2012R2 server recently, but ONLY when the server is trying to create a shadow copy. Eventually (not sure how long) this process times out and the CPU goes back to normal. Since this behavior is so recent I suspect Microsoft screwed up something in an update, which doesn't bode well for any of us. One thing I am going to try today is a full defrag on my disks including the $Mft.
Hello,
Thank you for your question.
As you mentioned its file server it could be due to accessing of shared files in network by clients.
I would suggest to check the usage during off hours if it comes down.
If the reply was helpful, please don’t forget to upvote or accept as answer.
Thanks for the response.
I spent the last 2 evenings, off production, from 8pm to 11pm, to try to debug... no users connected, no smb share accessed, no RDS session opened.
Still have the same CPU usage !
Arnaud
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 60%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETS%3C/text%3E%3C/svg%3E)
Hi,
Were you able to find the solution for this?
We have a FS that has the same symptoms since earlier today. Through ProcessExplorer I can see 212 threads with this address: nstoskml.exe!oGetIoPriorityHint+0x1d8
one thing I can't figure out is that on TCP/IP tab I can see several connections from servers that don't even exists anymore.
Just in case this can help someone with the same issues. In my case the related server was a File Server we use for RoamingProfiles so it is one of the machines with most IOPs in the cluster. After some time we noticed that the disks were always with high usage and the disk queue was spiking.
We also noticed performance issues on the physical host affecting backups and etc, so we decided to stop concurrent operations to decrease disk usage in critical hours which helped, but didn't solved. After that, I've split the usage between this FS and a secondary one on a different cluster, which finally stopped the snowball.
Hopefully this will give you some insights for troubleshooting. Good luck.