SYSTEM (ntoskrnl.exe) high CPU usage - All Windows Server versions

Arnaud Rigole 126 Reputation points
2021-09-09T14:38:35.64+00:00

Hi everyone,

We can't understand a behavior that we got since yesterday on every file server of our infrastructure: The "SYSTEM" process (ntoskrnl.exe) is using all CPU available, conducting to completly overload the server and slow down to hell its services... Same problem on WS2012R2 & 2016.

On 2012R2, we got 3 KB installed recently (05/09) : KB5004233, KB5004298, KB5004285. On 2016, the last CU installed was the KB5005043 on late august. Nothing more since that.

130725-image.png

  • I tried to use ProcessHacker tool to see what could cause that, but i can't see nothing intersting / relevant :
    130812-image.png
    • I tried to follow the detailed informations of this thread:

https://superuser.com/questions/527401/troubleshoot-high-cpu-usage-by-the-system-process

Same thing, can't find any relevant using the Windows Performance Analyzer...

130755-image.png

Have you any advices ?
Thanks in advance...

Arnaud

Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,368 questions
Windows Server 2012
Windows Server 2012
A Microsoft server operating system that supports enterprise-level management, data storage, applications, and communications.
1,526 questions

8 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dave Patrick 426.1K Reputation points MVP
    2021-09-09T15:03:39.307+00:00
    0 comments
  2. Arnaud Rigole 126 Reputation points
    2021-09-10T07:17:38.183+00:00

    @Dave Patrick thanks for your response. As i told, we got unexpectedly the problem on every file server, from day to day !
    Every server is different and the only common binary is the Antivirus. We tried to disable it, and still have SYSTEM process up to 70% (peaks) cpu usage !

    Anyway, i tried yesterday to boot a 2012R2 without any additional service, and... check that out...

    130964-image.png

    Any ideas ?

  3. Arnaud Rigole 126 Reputation points
    2021-09-10T07:59:33.44+00:00

    Following this, i disabled ABE on every SMB share on a sample server : no changes
    https://learn.microsoft.com/fr-fr/windows-server/storage/file-server/troubleshoot/high-cpu-usage-issue-on-smb-server

    0 comments
  4. Docs 15,141 Reputation points
    2021-09-10T08:05:03.227+00:00

    See if this link is useful:

    https://learn.microsoft.com/en-us/windows-hardware/test/wpt/cpu-analysis

    .
    .
    .
    .
    .
    Please remember to vote and to mark the replies as answers if they help.

    On the bottom of each post there is:

    Propose as answer = answered the question

    On the left side of each post: Vote = a helpful post
    .
    .
    .
    .
    .

    0 comments
  5. Arnaud Rigole 126 Reputation points
    2021-09-10T09:31:51.827+00:00

    @Docs as you can see on my first post... i already tried to use WPA to identity binary/drivers involved...
    There is nothing relevant, pure system calls if i expand [root] stack tree of the system process...

    0 comments