How to identify SMS Executive process threads that are responsible for high CPU use on an SMS site server (837372)

MORE INFORMATION

Configuring System Monitor to monitor the SMS Executive process

1. In Windows Server 2003 or in Windows 2000, click Start, point to Programs, point to Administrative Tools, and then click Performance.
2. Expand Performance Logs and Alerts, right-click Counter Logs, and then click New Log Settings.
3. In New Log Settings, type a name in the Name field. For example, type SMS Exec Threads, and then click OK.
   
   Note By default, the new log file is stored in the Perflog folder.
4. In the SMS Exec Threads dialog box, click Add Counters on the General tab. (In Windows 2000, click Add.)
5. In Add(Select) Counters, click to select the SMS site server, and then select instances that are specific to SMS for the following counters:

   Performance Object	Counter name	Instance
   Processor	% Processor Time	_Total
   Memory	Pages/sec
   Physical Disk	% Disk Time	_Total
   Thread	% Processor Time	All the instances that start with SMSExec. For example, the instance may be smsexec/44. (40 or more entries may exist.)
   Thread	ID Process	All the instances that start with SMSExec.
   Thread	ID Thread	All the instances that start with SMSExec.
   Thread	Thread State	All the instances that start with SMSExec.
   Thread	Thread Wait Reason	All the instances that start with SMSExec.

6. Set the Interval value and the Units value in the Sample data every field. For medium-length logs that sample data for up to an hour, use the default value of 15 seconds. For shorter times, reduce the Interval value. For example, set the value to 2 or 3 seconds. To sample data for several hours or more, set the Interval value to 30 or 60 seconds.
7. Click the Log Files tab. Make sure that the default Binary File in Log file type is selected, and then enter any comments in the Comment field.
8. Click the Schedule tab. Set the Start log and Stop log times that you want, and then click OK.

Analyzing the Results

1. In Windows Server 2003 or in Windows 2000, click Start, point to Programs, point to Administrative Tools, and then click Performance.
2. Click System Monitor, and then click View Log Data on the Performance toolbar. Click the Source tab, click the Log files option, and then click Add. (In Windows 2000, click Select Log File, and then click Add.)
3. In Select Log file, locate and select the log file that you created, and then click Open. (In Windows Server 2003, you must click OK to complete the file selection process.) By default, the log files are located in the Perflogs folder.
4. Click Add on the Performance toolbar to select counters.
5. In Add Counters, click Performance object. Make sure that the Memory object is selected. Click All counters, click All instances, and then click Add. Repeat this step for the following performance objects, and then click OK:
   • PhysicalDisk
   • Processor
   • Thread
6. Click View Report. When you scroll over to the right, you may see one or more threads that have a very high % Processor Time value.
7. Note the threads that have a high % Processor Time value. Make sure that you write down the following information for these threads:
   • ID Thread
   • Thread State
   • Thread Wait Reason
   Information for these threads may appear similar to the following:
   
   % Processor Time = 92.000
   ID Thread = 2008
   Thread State = 5
   Thread Wait Reason = 0
   
   This information indicates the following:
   • The ID Thread (TID) is 2008 in decimal notation and 0x7d8 in hexadecimal notation.
   • A Thread State value of 5 indicates that the thread is currently waiting. Other possible values are listed in the following table:

     Thread State Value	Definition
     0 - Initialized	A thread has started.
     1 - Ready	A ready thread wants to use a processor but must wait for a busy processor.
     2 - Running	A running thread is using a processor.
     3 - Standby	A thread is initializing.
     4 - Terminated	A running thread has stopped.
     5 - Wait	A waiting thread does not require a processor because the thread is waiting for a peripheral operation to complete or is waiting for a required resource to be free.
     6 - Transition	A thread in transition is waiting for a resource to run. For example, the thread is waiting for its execution stack to be paged in from disk.
     7 - Unknown	A thread is in an unknown state.

     
     Thread Wait Reason is only applicable when the thread is in the Wait state. The following table explains the Thread Wait Reason values:
     
     

     Thread Wait Reason Value	The thread is waiting for
     0 or 7	The Executive service.
     1 or 8	A free page.
     2 or 9	A page in.
     3 or 10	A pool allocation.
     4 or 11	An execution delay.
     5 or 12	A suspended condition.
     6 or 13	A user request.
     14	An event pair high.
     15	An event pair low.
     16	A local procedure call (LPC) receive.
     17	An LPC reply.
     18	Virtual memory
     19	A page out.
     20 and higher	Unassigned.

     
     
     Note Event pairs are used to communicate with protected subsystems.
8. After you verify that the SMS Executive thread is responsible for the high CPU use, you must translate the TID hexadecimal value to an SMS Executive thread name.
   
   When an SMS Executive thread starts, it stores the TID that the thread is running under in the SMS log files.
9. You can use the Windows Search function to search the SMS log files to determine the TID for the process that is causing high CPU use. To do this, follow these steps:
   1. On the SMS site server, click Start, point to Search. (In Windows 2000, click For Files and Folders.)
   2. In the A word or phrase in the file field, type the hexadecimal value for the TID. (In Windows 2000, this field is Containing text.)
   3. In the Look in field, specify the location of the SMS logs folder. (By default, this folder is SMS\logs.) Click Search (Now).
      
      In the following example, the 0x7D8 thread is found in the Despool.log file. Therefore, the SMS Despooler thread is responsible for the high CPU use.
      

      SMS_EXECUTIVE started SMS_DESPOOLER as thread ID 2008 (0x7D8).	SMS_DESPOOLER	2/16/2004 1:05:22 PM	2008 (0x7D8)

      Note Typically, thread initialization appears in the log files as a message that is similar to the following: SERVICE THREAD IS STARTING SMS_EXECUTIVE started Thread_Name as thread ID x If more than one process runs under the same TID, the correct one to use will be the thread that started on a date that is closest to, but not later than, the date that you ran the System Monitor capture.
      
   
   Note You can use the Findstr.exe command-line utility or other "grep" utilities to search the log files for a TID. Additionally, you can use the SMS Trace utility (Trace32.exe) to review SMS log data. The SMS Trace utility can filter for specific TIDs. Systems Management Server 2003 Toolkit 1 includes the latest version of this utility. To download the toolkit, visit the following Microsoft Web site:

   http://www.microsoft.com/smserver/downloads/2003/tools/toolkit.asp