none
CPU on SQL Server spiked; environment was sluggish... RRS feed

  • Question

  • Hi,

    As many of us DBA's go through this; this time I need some assistance from the experts on this forum. We had an incident in my company that knocked out the clients for a couple of hours. I have attached the screenshots related to what I believe to be the issue. System support personnel are stating the SQL Server locked up on its own. I am stating the issue was symantec as the eventwr logs dictate. In an effort to come to a conclusion on my SQL Server, I pulled data from the SQL Error Logs, Eventvwr and default trace. I found nothing in the logs stating that the sql server service had an issue. The only errors I found were in the eventwr logs and they are attached below. I have read articles in the past about symantec and SQL not getting along. In my professional opinion, the issue of the CPU spiking at 100% was caused by symantec as the error msgs state below. As far as my analysis with the logs, performance monitor and default trace, there were no other issues going on at the time except for the symantec service. SQL Server: Microsoft SQL Server 2014 (SP2-GDR) (KB3194714) - 12.0.5203.0 (X64) running on Windows Server 2012 R2. bit) on Windows NT 6.3 <X64> (Build 9600: ) (Hypervisor)


    A SQL Server MVP or MSFT Eng should be replying soon as well. Hope this helps. Frank Garcia *** Please select "Vote As Helpful" if the information provided was helpful to you. If an answer to your issue solved the problem then please mark it as "Propose As Answer" located at the bottom. Thank you. ***

    Tuesday, October 10, 2017 11:12 PM

Answers

All replies

  • Hi Frank J Garcia,

    All your screenshot shows an error with Symantec endpoint protection, but nothing seems to be related to SQL Server, or am I missing something? And exactly what issue you are experiencing with SQL Server?

    If you have any other questions, please let me know.

    Regards,
    Lin

    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Wednesday, October 11, 2017 2:34 AM
    Moderator
  • The SQL Server was sluggish due to high cpu activity (spiked consistently at 100%). The only errors on the SQL Server were related to symantec. After symantec was uninstalled the CPU dropped and everything went back to normal.

    My question is; has anyone including yourself seen symantec cause this type of issue on a SQL Server (High CPU activity)?

    Thank you.


    A SQL Server MVP or MSFT Eng should be replying soon as well. Hope this helps. Frank Garcia *** Please select "Vote As Helpful" if the information provided was helpful to you. If an answer to your issue solved the problem then please mark it as "Propose As Answer" located at the bottom. Thank you. ***

    Wednesday, October 11, 2017 4:38 AM
  • so sql server is just a victim here. why not contact symantec support?
    Wednesday, October 11, 2017 5:03 AM
  • Well, you know... The DBA's are always picked on... blame SQL kindof thing... I know the issue is symantec but the system guys are blaming SQL. I just figured I would post here to see if anyone here had experienced a similar issue with symantec on a SQL server.

    Thanks for the reply.


    A SQL Server MVP or MSFT Eng should be replying soon as well. Hope this helps. Frank Garcia *** Please select "Vote As Helpful" if the information provided was helpful to you. If an answer to your issue solved the problem then please mark it as "Propose As Answer" located at the bottom. Thank you. ***


    Wednesday, October 11, 2017 5:16 AM
  • >the system guys are blaming SQL

    What evidence are they presenting that leads them to believe the problem is SQL? They can't just make wild claims without backing them up with proof or facts.

    Is Symantec Endpoint Protection (SEP) configured to exclude SQL Server files / folders?
    Excluding Microsoft SQL Server files and folders

    Is Symantec Endpoint Protection (SEP) configured according to Best Practice Recommendation?
    Best Practices for Endpoint Protection on Windows Servers

    Your Symantec Endpoint Protection version / patch level is out of date: 12.1.1.5
    Current version / patch level is 12.1.6:
    Download the latest version of Symantec Endpoint Protection

    Also SEP 12.x has been EOL'ed. The newest available version is 14:
    Endpoint Protection

    Do you have SQL max_server_memory set so that it leaves enough memory available for non-SQL processes like SEP?

    Hope that helps,


    Phil Streiff, MCDBA, MCITP, MCSA

    • Marked as answer by Frank J Garcia Wednesday, October 11, 2017 2:19 PM
    • Edited by philfactor Wednesday, October 11, 2017 2:28 PM
    Wednesday, October 11, 2017 11:26 AM
  • Frank,

    I had issue with Symantec with SQl Server 2005 version not with SQL Server 2014 and whoever is saying SQL Server "locked itself" is speaking out of its mind. He is just trying to create word out own. SQL Server cannot lock itself unless some other applications do so and this may be Symantec.

    I also agree people in IT sector tend to blame DBA's but you must hold your ground( if you are correct). I would appreciate if you can post the SQL Server errorlog or is it like it did not had any abnormal entry ?

    Can you also use ring buffer to get CPU details of previous day. Does it gives any hint ?

    How was memory utilization at that time?


    Cheers,

    Shashank

    Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it

    My TechNet Wiki Articles

    MVP

    Wednesday, October 11, 2017 11:33 AM
    Moderator
  • Yes it does. Thank you.

    A SQL Server MVP or MSFT Eng should be replying soon as well. Hope this helps. Frank Garcia *** Please select "Vote As Helpful" if the information provided was helpful to you. If an answer to your issue solved the problem then please mark it as "Propose As Answer" located at the bottom. Thank you. ***

    Wednesday, October 11, 2017 2:19 PM
  • Thank you Shashank, there were no errors in the error log. Memory utilization was normal and equal to the same as the day before. The CPU the day before spiked to 57% during the morning and late afternoon. Other than that it was fine.

    The system engineer rebooted the SQL Server after he said SQL locked up. I was not able to connect in anymore while he was in the system. He then stated he removed symantec.


    A SQL Server MVP or MSFT Eng should be replying soon as well. Hope this helps. Frank Garcia *** Please select "Vote As Helpful" if the information provided was helpful to you. If an answer to your issue solved the problem then please mark it as "Propose As Answer" located at the bottom. Thank you. ***

    Wednesday, October 11, 2017 3:54 PM

  • The system engineer rebooted the SQL Server after he said SQL locked up. I was not able to connect in anymore while he was in the system. He then stated he removed symantec.

    Off topic: Please dont allow anyone else to reboot SQL Server take this in your hand, unless you are not available at that time. Since he removed symantec I am sure you would see lot of relief. Keep us posted if you see something new

    Next time it freezes use DAC to connect and see what is happening inside SQL Server

    Sharing 2 valuable docs, please read Detours or similar techniques may cause unexpected behaviors with SQL Server

    How to choose antivirus software to run on computers that are running SQL Server


    Cheers,

    Shashank

    Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it

    My TechNet Wiki Articles

    MVP


    Thursday, October 12, 2017 6:16 AM
    Moderator