Re: winmgmt using 100% of 1 CPU.

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: [MS] Scott McNairy (scotmc_at_online.microsoft.com)
Date: 04/20/04 

Date: Tue, 20 Apr 2004 10:46:07 -0700

Delete the log files located here: %windir%\system32\wbem\logs
Then change the "Logging" level to 2 at this registry key here?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
We can get some good information out of the logs located in
%windir%\system32\wbem\logs after that change is made and the service is
cycled. I believe with Win2k, you will have to restart the service.

Also, does this problem persist through a reboot? Or does it take a while
to surface again after a reboot? 

-- 
[MS] Scott McNairy
WMI Test Engineer
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"drt" <drt@anon.net> wrote in message
news:uXVBrvpIEHA.3432@tk2msftngp13.phx.gbl...
> Windows 2000 Server SP3 plus critical fixes
> Winmgmt started to use 100% of 1 CPU "all of a sudden" after running for
> several weeks.
>
> tlist winmgmt shows "2nd" thread always "running".  I took several
userdumps
> of the process and noticed that thread 1 is in wbemcore!shutdown.  Stack
> trace and !peb output from windbg is below.
>
> Wondering if anyone has any ideas?
>
>
> eax=00834368 ebx=00000000 ecx=65c0e6b0 edx=65c0e6b0 esi=65c0e6b0
> edi=65c0e840
> eip=65ba3381 esp=0096fcf0 ebp=0096fd4c iopl=0         nv up ei pl nz na pe
> nc
> cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000
> efl=00000202
> wbemcore!CObjDbClassCache::ClearCache+0x15:
> 65ba3381 ff7008           push  dword ptr [eax+0x8]
> ds:0023:00834370=00c8218c
> 0:001> kv
> ChildEBP RetAddr  Args to Child
> 0096fcf8 65b8892e 65c0e840 00831ec8 00000000
> wbemcore!CObjDbClassCache::ClearCache+0x15 (FPO: [0,0,1])
> 0096fd4c 65bb6b3a 00000000 00000000 65c0e8a8
> wbemcore!CObjectDatabase::Shutdown+0x4e
> 0096fd64 65bb917e 00000000 77b2c650 00145930
> wbemcore!ConfigMgr::Shutdown+0x1ba (FPO: [EBP 0x0096fd8c] [1,0,4])
> 0096fd8c 65bb8c13 00000000 77abc8e3 00145930 wbemcore!Shutdown+0x91
> 0096fd94 77abc8e3 00145930 00000000 0096fdac wbemcore!DllCanUnloadNow+0x2c
> (FPO: [0,0,0])
> 0096fda4 77abdb91 77a54f90 00000000 00000000
> ole32!CClassCache::CDllPathEntry::CanUnload_rl+0x37 (FPO: [0,0,3])
> 0096fedc 77aba5c9 001385a0 0096ff78 00414ab7
> ole32!CClassCache::FreeUnused+0x67 (FPO: [Non-Fpo])
> 0096fee8 00414ab7 77f82b95 00000102 00000003
> ole32!CoFreeUnusedLibraries+0x35 (FPO: [Non-Fpo])
> 0096ff78 00415559 0000007c 0012fe60 0096ff94 WinMgmt!WaitingFunction+0x527
> 0096ff88 0041a098 0012fe60 0096ffa4 00419f86
> WinMgmt!MyService::WorkerThread+0x39
> 0096ff94 00419f86 00000001 00135308 0096ffec
> WinMgmt!CNtService::ServiceMain+0xe8
> 0096ffa4 77db243e 00000001 00135308 0012f85c
> WinMgmt!CNtService::_ServiceMain+0x16
> 0096ffb4 77e887dd 00135300 00000000 0012f85c ADVAPI32!ScSvcctrlThreadW+0xe
> (FPO: [1,0,1])
> 0096ffec 00000000 77db2430 00135300 00000000 KERNEL32!BaseThreadStart+0x52
> (FPO: [Non-Fpo])
>
>
> 0:001> !peb
> PEB at 7FFDF000
>     InheritedAddressSpace:    No
>     ReadImageFileExecOptions: No
>     BeingDebugged:            No
>     ImageBaseAddress:         00400000
>     Ldr.Initialized: Yes
>     Ldr.InInitializationOrderModuleList: 131f40 . 1437d18
>     Ldr.InLoadOrderModuleList: 131ec0 . 14363d0
>     Ldr.InMemoryOrderModuleList: 131ec8 . 14363d8
>             Base TimeStamp                     Module
>           400000 3bbb5e4e Oct 03 13:51:58 2001
> C:\WINNT\System32\WBEM\WinMgmt.exe
>         77f80000 3d3d0209 Jul 23 02:13:13 2002 C:\WINNT\System32\ntdll.dll
>         65c20000 3d3d0251 Jul 23 02:14:25 2002
> C:\WINNT\System32\WBEM\wbemcomn.dll
>         77e10000 3d3d020a Jul 23 02:13:14 2002
C:\WINNT\system32\USER32.dll
>         77e80000 3d3d0209 Jul 23 02:13:13 2002
> C:\WINNT\system32\KERNEL32.DLL
>         77f40000 3d0629ce Jun 11 11:48:14 2002 C:\WINNT\system32\GDI32.DLL
>         78000000 3baa6538 Sep 20 16:52:56 2001
C:\WINNT\system32\MSVCRT.dll
>         77db0000 3d3d020a Jul 23 02:13:14 2002
> C:\WINNT\system32\ADVAPI32.dll
>         77d30000 3f47e146 Aug 23 16:48:54 2003
C:\WINNT\system32\RPCRT4.DLL
>         779b0000 3d3d020c Jul 23 02:13:16 2002
> C:\WINNT\system32\OLEAUT32.dll
>         77a50000 3f47e146 Aug 23 16:48:54 2003 C:\WINNT\system32\ole32.dll
>         775a0000 3d3d020b Jul 23 02:13:15 2002
C:\WINNT\system32\CLBCATQ.DLL
>         65b80000 3d3d0251 Jul 23 02:14:25 2002
> C:\WINNT\System32\wbem\wbemcore.dll
>         77820000 3844d037 Dec 01 01:37:27 1999
C:\WINNT\system32\VERSION.dll
>         759b0000 38439952 Nov 30 03:30:58 1999 C:\WINNT\system32\LZ32.DLL
>         700e0000 3d3d0229 Jul 23 02:13:45 2002
> C:\WINNT\System32\wbem\fastprox.dll
>         65a80000 3d3d0251 Jul 23 02:14:25 2002
> C:\WINNT\System32\wbem\wbemess.dll
>         65a30000 3d3d0251 Jul 23 02:14:25 2002
> C:\WINNT\System32\wbem\wbemsvc.dll
>         65a70000 38439a39 Nov 30 03:34:49 1999
> C:\WINNT\System32\wbem\wbemperf.dll
>         77be0000 3d3d020c Jul 23 02:13:16 2002
C:\WINNT\system32\secur32.dll
>         7ca00000 3b4a4d70 Jul 09 19:33:52 2001
C:\WINNT\system32\rsaenh.dll
>         77c10000 3d3d020b Jul 23 02:13:15 2002
C:\WINNT\system32\USERENV.dll
>         77440000 3d3d020e Jul 23 02:13:18 2002
C:\WINNT\system32\CRYPT32.dll
>         77430000 3f6b616c Sep 19 15:05:00 2003
C:\WINNT\system32\MSASN1.DLL
>         782f0000 3d3d020d Jul 23 02:13:17 2002
C:\WINNT\system32\shell32.dll
>         77c70000 3d3d020b Jul 23 02:13:15 2002
C:\WINNT\system32\SHLWAPI.DLL
>         77b50000 3d3d020c Jul 23 02:13:16 2002
> C:\WINNT\system32\COMCTL32.DLL
>         74ff0000 3d3d023c Jul 23 02:14:04 2002
C:\WINNT\system32\mswsock.dll
>         75030000 3d3d0252 Jul 23 02:14:26 2002
C:\WINNT\system32\WS2_32.DLL
>         75020000 3843995d Nov 30 03:31:09 1999
C:\WINNT\system32\WS2HELP.DLL
>         77980000 3d3d020c Jul 23 02:13:16 2002
C:\WINNT\system32\DNSAPI.DLL
>         75050000 3d3d0253 Jul 23 02:14:27 2002
C:\WINNT\system32\WSOCK32.DLL
>         74fd0000 3d3d0239 Jul 23 02:14:01 2002 C:\WINNT\system32\msafd.dll
>         75010000 3d3d0253 Jul 23 02:14:27 2002
> C:\WINNT\System32\wshtcpip.dll
>         782c0000 3d3d020d Jul 23 02:13:17 2002 C:\WINNT\System32\rnr20.dll
>         77340000 3d3d020f Jul 23 02:13:19 2002
> C:\WINNT\system32\iphlpapi.dll
>         77520000 3844d039 Dec 01 01:37:29 1999 C:\WINNT\system32\ICMP.DLL
>         77320000 3844d039 Dec 01 01:37:29 1999
C:\WINNT\system32\MPRAPI.DLL
>         75150000 3d3d0247 Jul 23 02:14:15 2002
C:\WINNT\system32\SAMLIB.DLL
>         75170000 3d3d023d Jul 23 02:14:05 2002
> C:\WINNT\system32\NETAPI32.DLL
>         751c0000 3843995b Nov 30 03:31:07 1999
C:\WINNT\system32\NETRAP.DLL
>         77950000 3d3d020c Jul 23 02:13:16 2002
C:\WINNT\system32\WLDAP32.DLL
>         773b0000 3d3d020e Jul 23 02:13:18 2002
> C:\WINNT\system32\ACTIVEDS.DLL
>         77380000 3d3d020f Jul 23 02:13:19 2002
C:\WINNT\system32\ADSLDPC.DLL
>         77830000 3844d037 Dec 01 01:37:27 1999
C:\WINNT\system32\RTUTILS.DLL
>         77880000 3d3d020c Jul 23 02:13:16 2002
> C:\WINNT\system32\SETUPAPI.DLL
>         774e0000 3d3d020e Jul 23 02:13:18 2002
> C:\WINNT\system32\RASAPI32.DLL
>         774c0000 3d3d020e Jul 23 02:13:18 2002
C:\WINNT\system32\RASMAN.DLL
>         77530000 3844d038 Dec 01 01:37:28 1999
C:\WINNT\system32\TAPI32.DLL
>         77360000 3d3d020f Jul 23 02:13:19 2002
> C:\WINNT\system32\DHCPCSVC.DLL
>         777e0000 3844d037 Dec 01 01:37:27 1999
C:\WINNT\System32\winrnr.dll
>         777f0000 3844d037 Dec 01 01:37:27 1999
> C:\WINNT\system32\rasadhlp.dll
>         782d0000 3c9d12e9 Mar 23 17:42:33 2002
C:\WINNT\system32\msv1_0.dll
>         78280000 3cdb3cd4 May 09 22:21:56 2002
> C:\WINNT\system32\kerberos.dll
>         76670000 3844d040 Dec 01 01:37:36 1999
> C:\WINNT\system32\CRYPTDLL.DLL
>     SubSystemData:     0
>     ProcessHeap:       130000
>     ProcessParameters: 20000
>         WindowTitle:  'C:\WINNT\System32\WBEM\WinMgmt.exe'
>         ImageFile:    'C:\WINNT\System32\WBEM\WinMgmt.exe'
>         CommandLine:  'C:\WINNT\System32\WBEM\WinMgmt.exe
>
>

Relevant Pages

  • Re: save autorecover spontaneously resets to 10 minutes, why?
    ... On the desktop, however, the deletion cures these two problems until the PC ... Deleting the registry key not only cures the ... >> transformed working with Word, until I found, on the second reboot of the ...
    (microsoft.public.word.docmanagement)
  • Re: Characters intermittently become invisible
    ... Have you tried logging out and logging back in as an alternative to reboot? ... you have some program that is consuming GDI resources ... This happens on all running applications. ... The only reliable work around I have found is to reboot. ...
    (microsoft.public.win32.programmer.gdi)
  • Re: Blocked drive letter
    ... Sorry, but this registry key does not exist (when I read your hint, I remembered, that I allready deleted it). ... If it was me, I'd just delete the Z key and reboot, but all of the ... network and therefore i mapped a shared folder to drive letter z. ...
    (microsoft.public.windowsxp.general)
  • RE: ADMT password migration problems
    ... the TcpipClientSupport dword registry key to ... One more reboot for both DC's and then try ADMT on the target DC using Test ... with the password export server. ...
    (microsoft.public.windows.server.migration)
  • Re: Repeated updates of KB828026
    ... Uninstall the update, verify that the registry ... key was gone, reboot and reinstall. ... Removed the Registry Key: ...
    (microsoft.public.windowsupdate)