2

On my ESX box, I have a Windows XP low resource machine that I use to host a few scripts and management tools for my (virtual) servers.

Whenever my box is idle for 20-30 minutes, without fail, the CPU and IO usage go to almost 100%. The moment I move the mouse, the usage drops very quick. Within about 5 seconds, it is just a regular VM acting how it should.

After this, it is like nothing has happened and it is very fast again.

I have read the other answers here which haven't helped, and I found the VMWare Guide which did not help either - the Virtual Machine is set up correctly (as far as I can see) - ACPI Uniprocessor etc. and Windows XP as the template.

I was wondering if anyone knows what is going on? Also, the thing that confused me the most was that I left Process Explorer running and managed to track it down to a svchost.exe process - unfortunately it was the large one that hosts a huge chunk of services.

I would of expected it to be the Idle process that would be taking the cycles, or the guest to show nothing and just busy on the ESX box... So this problem has stumped me.

Anyway, I read the good answer here, and if no one knows what is happening, I will try to implement it (the reason I haven't is that I don't really want to restart this machine - it is doing critical tasks at the moment). This server is a vanilla XP Pro SP3 install + VMWare Tools + Filezilla + A few management scripts (which I wrote and work fine if the PC is not left to idle).

enter image description here

enter image description here This is an example of the machine running at 100%, I then move the mouse and disconnect console - you can see, it takes just over 20 minutes, then, it goes back to 100% CPU and IO.

Does anyone know what is happening?

Community
  • 1
William Hilsum
  • 3,506
  • 5
  • 28
  • 39
  • are the guest tools installed? check and see that its using the right drivers, what kind of vmnic are you emulating? check the mouse and video drivers, specifically – SpacemanSpiff Oct 18 '11 at 04:53
  • @SpacemanSpiff Tools installed, Nic is "Flexible" (driver "VMware Accelerated AMD PCNet Adapter), Video card is set to 4MB memory, (driver VMware SVGA II) Keyboard (driver) is "standard 101/102 Microsoft...". – William Hilsum Oct 18 '11 at 04:59
  • How do the power saving settings look? Is it maybe starting a resource-intensive screen saver? – Shane Madden Oct 18 '11 at 05:00
  • @ShaneMadden Screensaver is just "Windows XP" ... The basic flag one! I haven't changed any power settings from the default options. Currently set at Scheme - "Home/Office Desk", Monitor off in 20 mins, hard disk/standby - never. Can't see anything else relevant. – William Hilsum Oct 18 '11 at 05:10
  • I have cross posted on the VMWare Forum and not getting an answer there - this getting rather urgent (and VERY annoying), so, I am going to start a bounty. – William Hilsum Oct 30 '11 at 07:01
  • Have you disabled the Windows indexing service? Download Windirstat also and see what is taking up the most diskspace. Perhaps the culprit is writing log files somewhere :) – SpacemanSpiff Oct 31 '11 at 04:49
  • @SpacemanSpiff It isn't Indexing service - That doesn't appear to be running on this box. I don't think Windirstat will help - there is 2 disks - one 10GB system drive, one 50GB drive for log files - which... has 0 files! I haven't yet actually started using this system because of this bug.... I am going to try and set up another XP VM shortly to see if it is something that "just went wrong" on this one... If no one comes up with a solution, I will probably take a look/think about using a Windows 2003 VM for the job. – William Hilsum Oct 31 '11 at 06:42
  • I think that is a very wise choice. – SpacemanSpiff Oct 31 '11 at 13:57
  • Is the machines running any form of Windows Search? Try disabling the search indexer and (if search is actually needed) something a bit more lightweight like [Everything](http://www.voidtools.com/). – tombull89 Oct 31 '11 at 15:01
  • @tombull89 - no search, and indexer isn't even turned on - this is a simple XP install with Filezilla and not really any other programs other than VMWare Tools. – William Hilsum Oct 31 '11 at 17:44
  • Windows XP? Are you expecting solid performance from Windows XP? Dump it. It is no longer maintained at Microsoft. Many people have encountered your problem towards the end of the XP life cycle - there is no solution than to reinstall. Likely malware. Upgrade to Windows 7 and it won't happen anymore. – labradort Nov 03 '11 at 18:11
  • 1
    @Labradort - I am certain there is no Malware, I really want Windows XP as I just need a lightweight OS for running a few scripts, why would I want to run Windows 7 on this? In fact, if I found my ISO, I would have installed Windows 2000 (which I have used before for this sort of task)... Just because something is dated, doesn't mean it is useless, and yes, I am expecting solid performance. – William Hilsum Nov 03 '11 at 18:43
  • Did you happen to change the number of vCPU's after you installed the OS? – gm777 Nov 04 '11 at 04:00
  • @User99912 - nope, set up with 1, still got 1. – William Hilsum Nov 04 '11 at 08:41
  • Have you read the news? There is no such thing as "I am certain there is no malware". There was a quote out there which is somewhat true... there are three kinds of sites: those who have been hacked, and those who don't know they have been hacked, and those who will be hacked. Windows XP still runs everything as Administrator rights for one reason it is easily hacked. – labradort Nov 30 '11 at 18:10
  • @labradort And then there are those who have a machine that is installed in a default/basic configuration and are not connected directly to the internet. – William Hilsum Dec 01 '11 at 07:21

6 Answers6

2

Have you totally disabled all power management? Have you disabled hybernation? Have you disabled the screensaver?

mrdenny
  • 27,074
  • 4
  • 40
  • 68
  • Hibernate was never turned on (checked, default is off). As for screensaver, it is active, but just the default flag/Windows XP screensaver. I have the counterpart screensaver (Windows 2008 Logo) running on my other VMS without problems. The screensaver can be active without seeing the problem (tested)... It appears that the problems starts between 20-30 minutes after the last time I touched the machine. – William Hilsum Oct 18 '11 at 05:27
  • ... After Googling, other people have also suggested the Screensaver - I have since disabled this, but, I am still getting the same problem. – William Hilsum Oct 30 '11 at 06:55
  • Now that the screen saver is disabled, can you leave process explorer up and sorted by CPU and see what's jumping to the top of the list? – mrdenny Oct 31 '11 at 18:56
  • I just confirmed what I thought in my original question - it is the big svchost process - http://i.stack.imgur.com/Af1PT.png - I think I am going to have to separate the processes to examine further... although, I am going to pause this machine and set up a new VM tomorrow to see if I can recreate the issue. – William Hilsum Oct 31 '11 at 19:20
  • Try disabling the "Security Center" service. It's what runs the Windows Security Center which is what the apps under svchost are. – mrdenny Oct 31 '11 at 19:24
  • I really don't think this would be the solution, but, I am getting frustrated so I have tried it anyway! Will let you know in ~30 mins. – William Hilsum Oct 31 '11 at 20:27
  • If that was it, I'll pretend to be brilliant. If not I'll happily admit it was a total shot in the dark. – mrdenny Oct 31 '11 at 21:22
  • :) lol! ... Anyway... :( - Approached 10 minutes and I was getting ready to be excited... then.... http://i.stack.imgur.com/FBMU2.png ... Again, I am going to try and install from scratch and see if I can recreate the situation... I have virtualised XP hundreds of times locally without any problems - never on ESXi though... I just can't understand what is out of the ordinary in my situation, or if it is just that no one uses ESXi with XP! – William Hilsum Oct 31 '11 at 21:27
  • Damn, I was hoping. Hopefully it's just a fluke with this machine. I had a bunch of XP machines VM'ed before on ESX with no issues as well. Didn't use ESXi at the time so can't speak to that. Shouldn't be an issue though. Has to be something silly. – mrdenny Oct 31 '11 at 21:32
  • I guess the trick here is to see what's utilizing the CPU when it's "idle". Can you log the running processes? – SpacemanSpiff Nov 01 '11 at 01:09
1

I think you can use Process Explorer (From SysInternals) to try and drill down to which service is hammering the CPU.

Dan
  • 15,280
  • 1
  • 35
  • 67
  • I have already done this (the first picture) and tracked it down to the large process that hosts a load... I am going to go further down this route and try to split up the services when I have a bit more time. – William Hilsum Oct 31 '11 at 12:21
  • D'oh - sorry, completely missed that! But yeah, I'd stick with that route and keep persevering. Trial and error gets a bit old. You could try stopping as many services as you can, though. You might need to bite the bullet and reboot though. – Dan Oct 31 '11 at 12:41
0

Looks like a .NET recompile after doing SP3/windowsupdates etc. (see IOstats)

CyberOptic
  • 307
  • 3
  • 13
0

I've never tried this, but is it possible to hot-clone the desktop and remove / disable / point to nowhere its network cards? You can then leave this box doing its critical stuff and then do as much troubleshooting as you like on the dummy system.

Dan
  • 15,280
  • 1
  • 35
  • 67
0

I've seen similar behavior on non-virtual XP workstations. The behavior is the same as you describe: High CPU, high disk activity, and it stops almost immediately as soon as I touch the keyboard or move the mouse.

This may be Windows updating its prefetch cache. It normally runs in the background after a period of inactivity. There's a nice description here; scroll down to the "Prefetch" section. The last paragraph in the section states that the system will periodically fire up the defrag utility to try to move all of the prefetch files into a single contiguous area. It should normally only last for a couple minutes, but if you're in the habit of clearing our XP's prefetch directory (which you shouldn't), it would have more work to do to rebuild it. It's not clear to me whether the defrag part of this process can be disabled. TweakUI has an option to disable background disk optimization, but it's vague on exactly what it does.

If that isn't it, another possibility is be the Windows Indexing Service, which is on by default. It can be disabled with little impact if you don't use the Windows built-in search much. Since it's indexing your (virtual) disk, it will definitely cause disk I/O to spike, and CPU usually rises as well.

James Sneeringer
  • 6,755
  • 23
  • 27
  • Windows Update are set to manual... unless it still does something in the background (will try to explore more tomorrow), as for Indexing service, it is off by default on XP. – William Hilsum Nov 02 '11 at 01:02
0

See if you have the Windows Indexing Service running. It may be that during idle periods, the indexer is indexing your drives, and that is what is gobbling your cpu resources.

In My Computer, right click on each hard disk in turn, and choose "Properties".

Un-check the "Allow Indexing ..." check box at the bottom of the Properties window.

See if your performance increases.

Tim Kennedy
  • 1,194
  • 9
  • 13