CODEWITHSUNDEEP
wmicpu-usagewindows-server-2019wmi-service
Filip5991
Filip5991

Reputation: 443

WMI Provider Host high CPU usage

I've noticed high CPU usage on our win 2019 server from a process in task manager called WMI Provider Host. We are hosting several .net applications (and services) on the server, and I wanted to determine if the high CPU usage is because of some of the apps, or something else. The CPU usage is constant and stays between 20 and 50%.

Browsing articles, I've seen a lot of things, some suggesting malware, others saying not to touch the service. One of them suggests checking logs in event viewer at: Applications and Service Logs\Microsoft\Windows\WMI-Activity\Operational

I can see 2 repetitive errors there, so I was wondering if anyone could shed some light on those:

  1. Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = XXX; User = XXX; ClientProcessId = 24580; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : Select Name, Filename from CIM_DataFile Where Extension = 'jar' AND (Filename LIKE 'log4j-core-%' OR Filename LIKE 'apache-cassandra-%' OR Filename LIKE 'spring-beans-%' OR Filename LIKE 'spring-cloud-function-core-%' OR Filename LIKE 'jena-core-%' OR Filename LIKE 'spark-core_%' OR Filename LIKE 'grails-core-%' OR Filename LIKE 'commons-text-%' OR Filename LIKE 'commons-jxpath-%' OR Filename LIKE 'commons-configuration%-%' OR Filename = 'derby' OR Filename LIKE 'sshd-core-%' OR Filename LIKE 'jackson-databind-%'); ResultCode = 0x80041032; PossibleCause = Throttling Idle Tasks, refer to CIMOM regkey: ArbTaskMaxIdle

  2. Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = XXX; User = XXX; ClientProcessId = 24580; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : Select Name, Filename from CIM_DataFile Where Extension = 'exe' AND Filename = 'php'; ResultCode = 0x80041032; PossibleCause = Throttling Idle Tasks, refer to CIMOM regkey: ArbTaskMaxIdle

We do not usually install any updates on the server (as it is a live machine), and it has been online for months. It only hosts .net c# applications.

Upvotes: 1

Views: 708

Answers (0)

Related Questions