Sunday, November 9, 2008

lsass.exe and SQL Server pegging CPU at 100%

Had an unusual problem with an MS Server 2003 today. The CPU was being pegged at 100% every 15 seconds for about 12 to 14 seconds. When I examined the Processes with Task Manager it showed that lsass.exe was the culprit and that its accomplices were sqlservr.exe and w3wp.exe.

This happened shortly after a deployment of a web site to the server that had been built on an x64 Server (2008) but deployed to an x86 Server (2003) - so I was considering this as a possible problem however I knew that I'd compiled the ASP.NET web app to target any CPU.

I found numerous references on the web to lsass.exe causing problems and also found this hotfix from Microsoft which I installed but it did not help: http://support.microsoft.com/kb/939268/ (when I say that it did not help I mean that it did not immediately fix the problem although it could have later added to a resolution by being there.)

After further hunting and examining event logs and server logs and disabling and stop and starting differenct web sites on the server I narrowed the problem down to one particular web site. This web site is an ASP.NET web app but also has a ASP Snitz forum in one of the sub-folders.

I tried taking the web site offline with the App_Offline.htm file and noticed that unlike when I stopped the web app the problem was still there. So I checked the forum and noticed that App_Offline only works with the ASP.NET part of the site and not the ASP part of the site.

This gave me a breakthrough in the hunt for a solution because I'd managed to separate the ASP and ASP.NET code and determined that it was the former. So I deleted the App_Offline.htm file and went into the forum admin page and took down the forum. The CPU usage immediately returned to normal and the pegging at 100% by lsass.exe and the others stopped.

Even though I'd isolated the problem to a small area I still didn't know what was causing this. Now this is the frustrating part: I switched the forum back online and the problem dissappeared. The CPU usage is back to normal and the problem gone. Although I'm happy that that problem's gone I'm frustrated that I don't know what caused it and fearful that it will return again.

Remember that I rebooted this server after I installed the MS KB patch metioned above which would have obviously stopped and restarted the web app and the forum code as well so I don't think that it was just a matter of stopping and starting it.

1 comment:

  1. Hi, i'm brazilian and i don't speak english =P. I had same problem with my Windows XP SP3, so i believe thats a geral problem. I solved this problem login a local account every power on the pc.
    Very very stupid no?
    So sorry my bad english.

    ReplyDelete