Random CPU Spikes in System process


Recommended Posts

For the last few days, I have been having random CPU spikes. The "System" process, about once every 1.5 to 2 minutes, takes up one entire core for about 10 seconds. Because it is the System process, I am suspecting it to be a driver (the most recent driver upgrades were installing Nvidia 195.62 laptop drivers (WHQL) and Realtek R239 HD Audio drivers, but I cannot lay the blame on an upgrade as I didn't notice exactly when the spiking started). I have ruled out other possible factors including malware and rootkits.

Process Explorer narrows it down to a thread that starts at Ntkrnlpa.exe!KeInsertQueueDpc+0x275, but because the System process is a protected process, it can't access any more information, including the thread stack. There are several other threads that start at the same address but do not spike.

How can I get more information about exactly what is causing the spikes or what function starts at KeInsertQueueDpc+0x275 or what execution stack it followed to cause the spikes? Any help in getting to the root of the problem is greatly appreciated.

Link to comment
https://www.neowin.net/forum/topic/859048-random-cpu-spikes-in-system-process/
Share on other sites

Thanks for your suggestion. I have already used kernRates (using the symbols with Process Explorer wasn't helpful, as all it showed was that it was a thread from the threadpool, it couldn't show anything else as the System process is protected in Win7).

I have two installations of Win7 on the same system (one Pro, the other Ultimate). The spiking occurs only in Pro. I ran the same workload (same running processes plus uTorrent and FDM with same config downloading the same file) in both environments for one hour, with kernrates running. Comparing the results showed that Ntfs.sys generated about 10% of the events in Pro, whereas it was ~0% in Ult. I have no idea whats triggering this behavior in Ntfs.sys in Pro. Re-running the profiler without the downloaders running also gives the same result. The other modules have caused more or less similar percentage of events.

There isn't any disc thrashing occurring when there are CPU spikes (if it is of interest, regular filesystem tasks barely results in any CPU usage). So, it looks like the NTFS driver is repeatedly trying to do something but getting stuck in a loop without doing anything noticeable.

Will try profiling again with xperf and let you know the results.

But saw something else. Coinciding with the CPU spikes, interrupts also go up and file activity occurs.

In the graph, the green line is the CPU usage for interrupts, the red one for the CPU utilization of first core and blue for the CPU utilization of the second core. And the bars indicate file activity. At the CPU spikes, all events are occurring.

Looking into the CPU usage around the time of the spikes, sure enough the System process is spiking and except the kernel, the Ntfs.sys driver shows the most usage. The values are similar to the one traced by kernrates.

post-113245-1261841455_thumb.png

post-113245-1261841633_thumb.png

Looking into the details of file activity, there are three events the System process participated in. The huge towers for the file IO events occurred for the Create event.

The total time the System process spent for Creating files is close to five seconds, which is about the same duration the CPU spikes last, and generated about 250,000 IO Request Packets, which explains the spikes in file IO.

post-113245-1261842452_thumb.png

post-113245-1261842466_thumb.png

Each of those 260,000 events are created by Thread with Id 48 of the System process, which is confirmed to the same thread that spikes by using Process Explorer to look into the threads' activity of the System process during the spike.

Each of those events look same:

  Quote
File Name: \Device\HarddiskVolume2\Windows\System32\drivers\etc\lmhosts

Flags: synchronous_io_nonalert Option24 normal shareRead shareWrite

Result: Object Name not found. (0xc0000034)

So it looks like its trying to create (or read?) the lmhosts file and failing. Sure the file isn't present in %windir%\System32\drivers\etc\; I do not use WINS. But why the hell is it trying to do the same for more than 250,000 times, when it has already failed once? And why is it doing this over and over again? I will try and create a dummy lmhosts file and see what happens, but that looks like a band-aid, not a solution.

post-113245-1261843143_thumb.png

Deleting and re-creating lmhosts fixed the problem, but it resurfaced on next restart. Dammit, I want a resolution. Don't ****ing care what the problem is anymore. I am taking a heavy hammer and disabling NetBIOS over TCP with brute force. No more NetBIOS, no more LanMan name resolution!

Ok, because you now know the cause, contact the MS support and tell them what you found out.

you can code a small program which creates the empty file. Now run the program with task scheduler at every startup. So you have a workaround until MS fixed it.

If anyone reading this topic has the same problem (I did), I've found a solution which appears to fix the problem for good

Open the properties box for a network adapter, any will do

Click TCP/IPv4 and then Properties

Jump to the WINS tab

De-select "Enable LMHOSTS lookup"

When you OK out of it the setting is applied to all network adapters

Hope this helps someone, spent most of my afternoon trying to find out what was going on

  • 2 years later...
  On 01/01/2010 at 09:35, FallenDeku said:

If anyone reading this topic has the same problem (I did), I've found a solution which appears to fix the problem for good

Open the properties box for a network adapter, any will do

Click TCP/IPv4 and then Properties

Jump to the WINS tab

De-select "Enable LMHOSTS lookup"

When you OK out of it the setting is applied to all network adapters

Hope this helps someone, spent most of my afternoon trying to find out what was going on

It works! Thanks.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Kids game on consoles or phones. Maintaining a Windows PC or updating a driver is way beyond a typical young person's skill set.
    • Here are some of the ways you can use Safari's new look on Apple iOS 26 by Aditya Tiwari iPhone's latest software update brings a ton of new features this year and is currently available in beta on supported iPhone models. Its fresh coat of the controversial Liquid Glass is also coming to the Safari web browser, alongside new iPhone wallpapers and a revamped Photos app. In this article, let's talk about the new way you can customize the Safari browser on your iPhone. A major highlight among new Safari features for iOS 26 is the new Compact mode for the Tab Bar. It serves as the default layout on the new iPhone update, available alongside the two other layouts from previous years. Use the new Compact Tab Bar layout in Safari You can follow these steps to customize Tab Bar layouts in Safari: Go to the Settings app on iOS 26. Open the Apps section from the bottom of the screen and scroll down or search to find Safari. You will find the three layout options under the Tabs section: Compact, Bottom, and Top. Tap on Compact to make it default, if it's not already selected. Each Safari layout offers its own set of perks and downsides. The new Compact Mode on Safari does what its name says. Its translucent interface uses much less screen real estate compared to the Bottom and Top layouts. You can find the Back button on the left side of the pill-shaped address bar that doubles up as a search bar. Next to it is a three-dot menu button to access features such as Share, All Tabs, Bookmarks, New Tab, and more. Use Bottom and Top layouts for quicker access to Safari options Bottom and Top layouts are almost the same, except that the latter places the address bar at the top of the screen. While the Top layout might be inconvenient when using an iPhone with one hand, some users may prefer to have their address bar in this position, perhaps for a more symmetrical view. After all, it's original and the only Safari layout available until iOS 15. Apple has given the Liquid Design treatment to both the Bottom and Top layouts, featuring a translucent, floating Tab Bar interface that offers a sneak peek of what's behind. Alongside the options for Bookmarks, Share, and All Tabs, you can find the Forward button to go to the next page in the browser. This is not the case with the Compact mode, but iOS already lets you swipe from the right edge of the screen to go forward. It appears that Apple has made it difficult to use Safari with one hand. It has shifted the New Tab and Tab Groups menu buttons to the top-left corner of the All Tabs page on iOS 26. This is where the Compact mode stands out, as these options are easily accessible. Alternatively, when on the All Tabs page, you can press the tabs pill at the bottom of the screen to access the Tab Groups menu. One thing you'll notice is that the Compact and Bottom tab layouts shrink into a small pill when you scroll down a web page. The pill is translucent, like the Tab Bar, and changes colors according to its background, providing more screen real estate on your iPhone. However, in the Top layout, the address bar collapses into a pill at the top of the screen. You can scroll up on the screen or tap the pill to get back to the whole UI. Apart from that, the Safari 26 beta version for iOS 26 and iPad 26 brings several under-the-hood features to the table. For instance, Apple has added Screen Time support to WKWebView, which powers the browsing experience for in-app browsers. Safari users on iOS, iPadOS, and macOS can also report issues when they have trouble with a web page, accessible via the Page menu on the left of the address bar in all three layouts. The new Safari features and changes are currently being tested through the Apple Developer Program. These features are expected to be available to the public when Apple releases the iOS 26 update later this year. We'll continue to update this article as more beta releases arrive. If you plan to install iOS 26 developer beta, keep in mind that these releases can be unstable, and make sure to back up your data beforehand.
    • I experienced this in the 80s and 90s and I believe it ultimately set me back. My “computer lab” in grade school and then again in high school in the 90’s had all macs. Then I hit the workforce. Windows and Office were foreign to me. I can see Apple excelling in the creative space but not in the mainstream office. This isn’t a knock on Apple, but more a reality that’s concerning in the context of this article. ….just my experience and opinion
    • Is this the non-subscription version? Can I move the license to a a new PC later on?
  • Recent Achievements

    • Week One Done
      DXB APPS earned a badge
      Week One Done
    • One Month Later
      DecaffKnight94 earned a badge
      One Month Later
    • Dedicated
      S.P earned a badge
      Dedicated
    • One Month Later
      adxnksd42031 earned a badge
      One Month Later
    • Rising Star
      aphanic went up a rank
      Rising Star
  • Popular Contributors

    1. 1
      +primortal
      663
    2. 2
      ATLien_0
      259
    3. 3
      Michael Scrip
      234
    4. 4
      Steven P.
      157
    5. 5
      +FloatingFatMan
      151
  • Tell a friend

    Love Neowin? Tell a friend!