none
High CPU consumption on start after upgrade from 16.21 to 16.26 (one CPU core is loaded for 100% up to 30 seconds) RRS feed

  • General discussion

  • Latest versions of Process Explorer (I believe it started from v16.25) introduced high CPU consumption for 10-30 seconds on start of the program. It loads one core for 100% up to 30 seconds, and it is considerable when ProcessExplorer runs automatically on system start. It is always reproducible on different machines. Just compare.

    Windows 10 x32 (2 cores), Process Explorer v16.21:

    https://social.technet.microsoft.com/Forums/getfile/1455925

    Windows 10 x32 (2 cores), Process Explorer v16.26:

    https://social.technet.microsoft.com/Forums/getfile/1455927

    Windows 7 x64 (4 cores), Process Explorer v16.21:

    https://social.technet.microsoft.com/Forums/getfile/1455928

    Windows 7 x64 (4 cores), Process Explorer v16.26:

    https://social.technet.microsoft.com/Forums/getfile/1455929

    My account is not approved, so I can't post images and proper links, so I posted the screenshots as text links.
    • Edited by vrubleg Sunday, June 30, 2019 8:26 AM
    Sunday, June 30, 2019 8:24 AM

All replies

  • I reproed the problem on my machine, but without the symbol file for Procexp64 cannot be more precise that this..

    It seems to me as a logical quantity of time spent communicating via RPC with other services in order to get information on the system


    CPU usage is at 25%
    Most of the time spent in two threads: 7104(11.42%) & 13636 (10.26%).
    7104 is divided in 2: RPC Calls to Services
    Line #, New Process, New Thread Id, Ready Thread Stack, Readying Process, Readying Thread Id, 
    4, , ,   |- ntdll.dll!RtlUserThreadStart, , , 
    5, , ,   |    |- kernel32.dll!BaseThreadInitThunk, , , 
    6, , ,   |    |    |- ntdll.dll!TppWorkerThread, , , 
    7, , ,   |    |    |    |- ntdll.dll!NtWaitForWorkViaWorkerFactory, , , 
    8, , ,   |    |    |    |    ntoskrnl.exe!KiSystemServiceCopyEnd, , , 
    9, , ,   |    |    |    |    ntoskrnl.exe!NtWaitForWorkViaWorkerFactory, , , 
    10, , ,   |    |    |    |    ntoskrnl.exe!ExpWorkerFactoryStartDeferredWork, , ,
    11, , ,   |    |    |    |    ntoskrnl.exe!AlpcpSignal, , , 
    12, , ,   |    |    |    |    |- ntoskrnl.exe!KiExitDispatcher, , , 
    13, , ,   |    |    |    |    |    |- ntoskrnl.exe!KiDirectSwitchThread, , ,
    14, , ,   |    |    |    |    |    |  , svchost.exe (5164), , 1324, , 2,40 CryptSvc  Most time spent
    15, , ,   |    |    |    |    |    |  , services.exe (976), , 5738, , 0,51 SCM
    16, , ,   |    |    |    |    |    |  , lsass.exe (1012), , 6842,  , 0,50 LSASS
    17, , ,   |    |    |    |    |    |  , svchost.exe (2892), 11284, , 0,03 Task Scheduler
    18, , ,   |    |    |    |    |    |  , svchost.exe (3092), , 15, , 0,00 WMI
    19, , ,   |    |    |    |    |    |  , svchost.exe (1192), 13668, 1, , 0,00 RPCSS

    + 3.15% with SYstem
    Line #, New Process, New Thread Id, Ready Thread Stack, Readying Process, Readying Thread Id, Count,% CPU Usage
    60, , ,   |- ntoskrnl.exe!KiStartSystemThread, , , 6701, , 3,15
    61, , ,   |    ntoskrnl.exe!PspSystemThreadStartup, , , 6701,  , 3,15
    62, , ,   |    |- ntoskrnl.exe!ExpWorkerThread, , , 6700, , 3,15
    63, , ,   |    |    |- ntoskrnl.exe!IopProcessWorkItem, , , 6685, , 3,14
    64, , ,   |    |    |    fvevol.sys!FveWorkerKmTP, , , 6685,  , 3,14
    65, , ,   |    |    |    |- fvevol.sys!FveCryptoWorker, , , 6684,  , 3,14
    66, , ,   |    |    |    |    fvevol.sys!FveIoCryptoWorker, , , 6684, , 3,14
    67, , ,   |    |    |    |    |- fvevol.sys!ReadDecrypt, , , 6683, , 3,14
    68, , ,   |    |    |    |    |    fvevol.sys!FinishPrimaryRequestIfLastSubrequest, , , 6683,  , 3,14
    69, , ,   |    |    |    |    |    fvevol.sys!CompleteRequest, , , 6683,  3,14
    70, , ,   |    |    |    |    |    ntoskrnl.exe!IofCompleteRequest, , , 6683, , 3,14
    71, , ,   |    |    |    |    |    ntoskrnl.exe!IopfCompleteRequest, , , 6683,  , 3,14
    72, , ,   |    |    |    |    |    |- Ntfs.sys!NtfsMasterIrpSyncCompletionRoutine, , , 5908, , 1,79
    73, , ,   |    |    |    |    |    |    ntoskrnl.exe!KeSetEvent, , , 5908, , 1,79
    74, , ,   |    |    |    |    |    |    ntoskrnl.exe!KiExitDispatcher, , , 5908, , 1,79
    75, , ,   |    |    |    |    |    |  , System (4), , 5908, , 1,79
    76, , ,   |    |    |    |    |    |- ntoskrnl.exe!KiExitDispatcher, System (4), , 755, , 1,34


    The other half time spent waiting on the other thread 13636
    Line #, New Process, 
    26, , ,   |    |    |- procexp64.exe!<PDB not found>, , , , 1,79
    27, , ,   |    |    |    |- procexp64.exe!<PDB not found>, , 1,79
    28, , ,   |    |    |    |    |- user32.dll!GetMessageW, , , , 1,58
    29, , ,   |    |    |    |    |    win32u.dll!NtUserGetMessage, , , , 1,58
    30, , ,   |    |    |    |    |    |- ntoskrnl.exe!KiSystemServiceCopyEnd, , ,  , , 1,58
    31, , ,   |    |    |    |    |    |    win32kfull.sys!NtUserGetMessage, , ,  1,58
    32, , ,   |    |    |    |    |    |    |- win32kfull.sys!xxxRealInternalGetMessage, , 1,52
    33, , ,   |    |    |    |    |    |    |    |- win32kfull.sys!xxxReceiveMessage, , ,  , 1,47
    34, , ,   |    |    |    |    |    |    |    |    |- ntoskrnl.exe!KeSetEvent, , ,  1,46
    35, , ,   |    |    |    |    |    |    |    |    |    ntoskrnl.exe!KiExitDispatcher, , , 1,46
    36, , ,   |    |    |    |    |    |    |    |    |  , procexp64.exe (8668), 13636, , 1,46



    Thread 13636 is divided in 5 part: two waiting on Csrss, one on SYstem and two messaging exchange with another internal thread 1612
    Line #, New Process, New Thread Id, Ready Thread Stack,  % CPU Usage
    139, , ,   |    |- winsrvext.dll!StartCreateSystemThreads, , 0,17
    140, , ,   |    |    win32u.dll!ZwUserCallNoParam, , , 1473, , , 0,17
    141, , ,   |    |    ntoskrnl.exe!KiSystemServiceCopyEnd, , , 1473, , , , 0,17
    142, , ,   |    |    win32kfull.sys!NtUserCallNoParam, , , 1473, 7, , 0,17
    143, , ,   |    |    win32kbase.sys!xxxCreateSystemThreads, , , 1473,, , 0,17
    144, , ,   |    |    |- win32kfull.sys!RawInputThread, , , 1116, 5 , , 0,14
    145, , ,   |    |    |    |- win32kbase.sys!UserSessionSwitchLeaveCrit, , , , , 0,10
    146, , ,   |    |    |    |    ntoskrnl.exe!ExReleaseResourceAndLeaveCriticalRegion, , , 430,  , 0,10
    147, , ,   |    |    |    |    ntoskrnl.exe!ExpReleaseResourceExclusiveForThreadLite, , , 430,  , 0,10
    148, , ,   |    |    |    |    ntoskrnl.exe!KiExitDispatcher, , , 430, , 0,10
    149, , ,   |    |    |    |  , csrss.exe (14796), 10328, 430,  , 0,10


    Line #, New Process, New Thread Id, Ready Thread Stack, Readying Process, Readying Thread Id, Count, % CPU Usage
    167, , ,   |    |    |    |    |  , csrss.exe (14796), 16200,  0,02


    Line #, New Process, New Thread Id, Ready Thread Stack,  % CPU Usage
    172, , ,   |- ntoskrnl.exe!KiStartSystemThread, , , 10291, , 1,11
    173, , ,   |    ntoskrnl.exe!PspSystemThreadStartup, , , 10291, , 1,11
    174, , ,   |    |- ntoskrnl.exe!ExpWorkerThread, , , 233,  , 0,68
    175, , ,   |    |- ntoskrnl.exe!SMKM_STORE<SM_TRAITS>::SmStReadThread, , , 181,, 0,22
    176, , ,   |    |- ntoskrnl.exe!KeSwapProcessOrStack, , , 9860, , 0,20
    177, , ,   |    |    |- ntoskrnl.exe!KiInSwapProcesses, , , 9661, , 0,20
    178, , ,   |    |    |    ntoskrnl.exe!KiReadyOutSwappedThreads, , , 9661, , 0,20
    179, , ,   |    |    |  , System (4), 100, 9661, , 0,20

    I don't know if with previous version this didn't happen, but I see a lot of Crypto related stuff going on here, and crypto always take time.. maybe a new feature under implementation or a little bug in the driver, but the time spent "externally" to the process seems quite reasonable.. let's see if MarkC can spend some time on this and shed some light on it..

    Thanks
    -mario

    Monday, July 1, 2019 8:41 AM
  • Thanks for reporting

    Have added to the Process Explorer backlog and will raise at this week's backlog review

    MarkC(MSFT)

    Tuesday, July 2, 2019 10:43 AM
  • Now that you published the Change Log for Process Explorer this behavior looks in line with the change "and improves security of loading system libraries."..

    Infact there is a lot of works going on to check for the security via the crypto service and other security related stuff..

    May be this can be relaxed/delayed a bit in order to not use so much CPU at the startup..

    Thanks
    -mario

    Tuesday, July 2, 2019 11:08 AM
  • Yeah, but the issue appeared in v16.25, not in v16.26.
    Wednesday, July 3, 2019 11:40 AM