Is anyone else seeing elevated CPU usage from svchost and EPSecurityService?
We recently noticed one of our in house servers was running at a sustained CPU usage (where it normally is mostly idle).
Not massive, but enough to wonder what was going on. Spent a few days troubleshooting it, figuring it was some corruption or patch issue. But when we started looking into our other client servers, we found the same thing. What we're seeing is ~5-15% CPU usage by both svchost (-netsvcs) and EPSecurityService (with EPProtectedService sometimes).
When we look into the svchost.exe threads, we see a variety of service threads: Winmgmt, iphlpsvc, dsmsvc using up the CPU, all out of wbemcore.dll
Just doing basic spot checks, this seems to be limited to our Hyper-V physical hosts. Not seeing it (that we've noticed) on desktop/laptops or virtual server instances. We've seen it on Server 2016, 2019 and 2022. Some clients have EDR active, others don't.
Comments
-
Hello @itxpress ,
Performance issues require an advanced troubleshooting because there is a wide variety of factors that can influence the CPU usage so please reach out to our Enterprise Support team for assistance in this case.
On the GravityZone side if these are seen sporadic, you can try to see if you can corelate them with some activities which are done on that machine. such as a scheduled scans for example.
Another thing that you can do is determine the module which causes the increase in CPU usage by following this article
With this information you can reach out to our Enterprise Support team and they will assist you in identifying the root cause.
Kind Regards,
Andrei
0
