This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Enterprise Console using lots of CPU and not functional anymore

I can't pinpoint why this is happening all of a sudden, but navigating the EC and trying to do anything just hangs for long periods of time or just hangs period. We use an external MS-SQL database. Running DebugView i see lots of this:

[2220] log4net:ERROR [RollingFileAppender] Unable to acquire lock on file C:\Users\daNduda\AppData\Local\Sophos\Sophos Endpoint Management\5.0\log\sophos-ui-framework.log. The process cannot access the file 'C:\Users\daNduda\AppData\Local\Sophos\Sophos Endpoint Management\5.0\log\sophos-ui-framework.log' because it is being used by another process. [2220] [2220] *** HR originated: -2147024774[2220] ***   Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302[2220] [2220] [2220] *** HR propagated: -2147024774[2220] ***   Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144[2220] [2220] [2220] *** HR originated: -2147024774[2220] ***   Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302[2220] [2220] [2220] *** HR propagated: -2147024774[2220] ***   Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144[2220] [1324] 1324: 2012-05-15 10:40:33.629 [CBS]                       IsCacheStillGood: True. [1324] 1324: 2012-05-15 10:42:35.813 [CBS]                       IsCacheStillGood: True. [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] 1324: 2012-05-15 10:44:36.448 [CBS]                       IsCacheStillGood: True. [2220] Warning     [0x000013E0] This group was not constructed from the group heirachy tree, it will be slower [2220] Warning     [0x000013E0] This group was not constructed from the group heirachy tree, it will be slower [1324] 1324: 2012-05-15 10:46:37.140 [CBS]                       IsCacheStillGood: True. [1324] 1324: 2012-05-15 10:48:37.972 [CBS]                       IsCacheStillGood: True. [1324] 1324: 2012-05-15 10:50:38.598 [CBS]                       IsCacheStillGood: True. 

:24769


This thread was automatically locked due to age.
  • So, you close SEC, re-open it... does the CPU just start straight from launch, does it require you to go into a certain option?

    As a long shot, If you open SEC and have Process Explorer (http://technet.microsoft.com/en-us/sysinternals/bb896653 ) open, you can look at the threads tab from the EnterpriseConsole.exe process, maybe the stack trace information from the thread consuming the most CPU might help point you in the right direction as to what operation is being performed.

    It might also be worth running Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645 ), to see what the process is doing terms of file access/registry access.

    Hope it helps.

    Regards,

    Jak

    :24773
  • Its the MgntSvc.exe that consumes a lot of cpu. Stack on that is:

    wow64cpu.dll!TurboDispatchJumpAddressEnd+0x6c0
    wow64cpu.dll!TurboDispatchJumpAddressEnd+0x4a8
    wow64.dll!Wow64SystemServiceEx+0x1ce
    wow64.dll!Wow64LdrpInitialize+0x429
    ntdll.dll!RtlIsDosDeviceName_U+0x24c87
    ntdll.dll!LdrInitializeThunk+0xe
    ntdll.dll!ZwWaitForSingleObject+0x15
    MSWSOCK.dll+0x76a6
    WS2_32.dll!recv+0x79
    DBNETLIB.DLL!ConnectionRead+0x1a7
    sqloledb.dll!DllUnregisterServer+0x130d6
    sqloledb.dll!DllGetClassObject+0x2f97d
    sqloledb.dll!DllUnregisterServer+0xc8a
    sqloledb.dll!SQLDebug+0x3b2f
    sqloledb.dll!DllGetClassObject+0x451a
    sqloledb.dll!DllUnregisterServer+0x4ff
    sqloledb.dll!DllUnregisterServer+0x71fa
    ntdll.dll!RtlInitUnicodeString+0x164
    ntdll.dll!RtlAllocateHeap+0xac
    ntdll.dll!RtlInitUnicodeString+0x164

    msxml6.dll!DllGetClassObject+0xc436
    msxml6.dll!DllGetClassObject+0x8b7b
    msxml6.dll!DllGetClassObject+0x84f3
    msxml6.dll!DllGetClassObject+0x785a
    msxml6.dll!DllGetClassObject+0x6c11
    msxml6.dll!DllGetClassObject+0x6e33
    msxml6.dll!DllGetClassObject+0xa478
    msxml6.dll!DllGetClassObject+0xa3c9
    msxml6.dll!DllRegisterServer+0x7d70
    msxml6.dll!DllRegisterServer+0x7e09
    msxml6.dll!DllRegisterServer+0x7e8e
    MgntSvc.exe+0x26991a
    MgntSvc.exe+0x267763
    MgntSvc.exe+0x267e04
    MgntSvc.exe+0x267bd7
    MgntSvc.exe+0x264e83
    MgntSvc.exe+0xa5d5f
    MgntSvc.exe+0x95489
    MgntSvc.exe+0x943b5
    MgntSvc.exe+0x7b92d
    MgntSvc.exe+0x88f84
    MgntSvc.exe+0x89ad1
    MgntSvc.exe+0x300c1
    MSVCR90.dll!_endthreadex+0x44
    MSVCR90.dll!_endthreadex+0xd8
    ntdll.dll!RtlInitializeExceptionChain+0x63
    ntdll.dll!RtlInitializeExceptionChain+0x36

    :24859
  • Process Monitor shows mgntsvc.exe doing lots of registry stuff

    Image 1

    :24861
  • Ahh, makes more sense...  What happens if you stop the router service on the server?

    If it levels off shortly after it would suggest, that it is working on message processing, rather than other tasks much a servicing the GUI.  Note: the Management service might be busy for a while after stopping the router as it may have taken on a large number of messages it needs to stick in the database.  So you may want to stop the router, and restart the management service to prove this.

    The "msgn" logs under:

    C:\ProgramData\Sophos\Sophos Endpoint Management \

    will show the number of messages being sent to the management service and from it.  Does it seem high?

    Maybe worth looking at the database also (counts per table for example, any of them, particularly the errors, events and threats table seem high?), is the sqlservr.exe process also show it's performing some work?  

    Looking at performance counters on the machine maybe also be worth while, average disk queue length for example.

    Jak

    :24867