Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

lsass.exe high CPU and memory?

Orion NPM 9.5.1, NetFlow 3.6, APM 3.1

I have been seeing my Orion server bog down a lot lately. Checking the processes I see 'lsass.exe' at the top of the list. It is currently at 2.4Gb and 50% CPU utilization. This is on a Windows 2003 64bit server with 8Gb RAM.

It seems I am having to reboot my server every morning to avoid this - for awhile.

Does anyone know how lsass.exe plays with Orion and is anyone else seeing something similar?

Find more posts tagged with

Accepted answers

All comments

RogerWong

There's one KB article discussing a possible reason for this. Do you think this might be the cause?

http://knowledgebase.solarwinds.com/kb/questions/670/

Orion Network Performance Monitor starts “missing polls” and/or CPU load on the Orion NPM server is unusually high.

Problem Details
This problem occurs when the System Manager application is terminated abnormally. This can happen if you exit a Terminal Services session without first exiting the program or if you kill the OrionNetPerfMon (System Manager) process from the task manager.

Once this happens, the LSASS process will rapidly begin consuming system resources. The problem will get worse both over time and if the System Manager is abnormally terminated again.

This problem has been isolated to a bug with COM/DCOM within Windows 2000. Microsoft is working on the issue now and we are hoping to have a fix available very soon.

Solution
You can avoid this problem by only using the System Manager when you need to make changes and ensuring that the program exits completely before ending your session. If the problem does occur, you can temporarily resolve the issue by restarting the Orion Network Performance Monitor service.

FormerMember

support.microsoft.com/.../842382

Could also be a dangerous trjoan, backdoor, etc.

FormerMember

Thanks Roger but since the 'encouragement' by SW not to use the System Manager I rarely use it any more so that is not the issue. I know when I rebooted my Orion server and looked at lsass.exe it started about 73Mb but it slowly is climbing... I will continue to investigate.

FormerMember

Thanks pyro13g but the likelyhood of a virus or trojan on this network/server is so remote, I mean REALLY remote, that I don't think that is the issue. I also am not seeing any of the events or error codes mentioned in the article. I will keep looking.

Thanks for the reply.

smargh

[blah blah server 2008 wmi bug blah blah]

Posted irrelevent information - post edited.

RogerWong

He's already using 2003, though, so the Windows 2008 WMI bug is probably not the cause.