High WMI-CPU Usage with Agent-based Polling

There was a bug Identified with Server 2008 R2 systems in SAM 6.3. You can apply the hotfix or upgrade to SAM 6.4, it was released this week.

OrionPlatform  v2016.2.5300 Hot Fix 2  - Released December 22th, 2016

This Hot Fix is in the customer portal.

Readme:

SolarWinds Orion Core 2016.2.5300 Hotfix
===================================================================================

This hotfix addresses a CPU utilization issue on multi-core nodes running
Microsoft Windows Server 2008 R2 when using Agent or WMI polling methods.

Install this hotfix on each SolarWinds poller and polling agent.

  ===================================================================================

Hi Sean,

I am already on SAM 6.4 RC.

Do you have any information if it is only fixed in 6.4 GA or if the Hotfix is already included in the RC.

Thanks,

Holger

The hotfixes are included in SAM 6.4. Make sure to upgrade the agents on the systems if they are being used.

What is the OS version of the remote server that is seeing the CPU spike?

Alright, so I will update my 6.4 RC to 6.4 GA and update the Agents to the latest release.

It is with Windows Server 2008 R2 so your initial hint is pointing into the right direction I guess.

The issue for which the hot fix was provided doesn't impact the cpu utilisation of the windows server. Instead the issue was that if it is a multicore 2008 r2 machine, the reported cpu utilization via WMI would be high due to the way those specific WMI classes are implemented by Microsoft. The hotfix uses alternative WMI classes to get the correct information.

If it is a recent developmen, I would actually suspect some recent Windows patch rather than the Agent version. You can definitely try downgrading the agent if it helps but you will need to point it to a downgraded solarwinds server as well.

Thanks for pointing that out. It was in fact "the real machine" where I had the High CPU Load. I was logged in via RDP and had the task manager open. I did see a high CPU Load for the WMI processes. After switching to RPC the load was not there any more.

I was also suspecting a windows Patch, that's why I started this conversation. Maybe other see this as well so we could point out the malfunctioning/trouble causing patch as a combined effort.

You have probably seen this WMI: How to troubleshoot High CPU Usage by WMI Components | Ask the Performance Team Blog

I haven't actually used this resource but seems pretty detailed to get to the bottom of high CPU caused by WMI