Jump to content
Welcome to our new Citrix community!
  • 0

App Layer of Platform Layer : eventviewer cause CPU spike




I have a strange issue with ELM.


I have a OS layer windows 10 1809 x64 with latest ELM 1905.


when I create an App or a platform Layen, when i go to the provisionned machine and want to read the event log the cpu goes to 50% CPU (I have 2 core)

on the Task Manager it's the svchost that take the CPU. The log are not available.




on the Performance Manager I see the evenviwer read all evtx available.

after a while I can see the log and cpu goes 


On the initial master I don't have the issue. If I create a new version of the OS layer I don't have the issue.


If someone have evere see this kind of issue.


thanks a lot



Link to comment

11 answers to this question

Recommended Posts

  • 0

No , it' just the first platform layer and I check just after the creation of the provisionning machine.

And the same with an App Layer.


I have Launched a Microsoft Performance Analyzer and the only revelant thing I found is the rpcrt4.dll that consume the CPU (dll used by svchosts.exe)


I will try with a clean image of OS ( ISO OS, manadatory recommandation for app layering and the app layering setup) and try again. perhaps some configuration or optimization I made causes the issue


very strange behavior


Link to comment
  • 0

Same issue with a clean and simple OS layer


my process :

- Install Win1809

- Install XenTool (8.0)

- disable system restore, VSS, windows update

- Install AppLayer 1095

- create OSLAYER

- create a new platform layer and the issue happen when I go on the eventviewer


another thing, to log with local admin account take more time than the OS master.


@Rob Zylowski1709158051 : Hello Rob, do you have any idea on this issue ?



Link to comment
  • 0
Just now, Rob Zylowski1709158051 said:

I don't I have never looked but it usually takes a while on any of the VMs i use to open the event viewer while it loads.  I wonder if you wait 5 minutes after boot if its any different.

Thanks Rob,


I will test it. the strange behavior is when I add a new version of an OS layer I don't have the issue. There is a time to show event but quicker and tale much CPU usage.


I will try to create a simple platform and an app and try to publish an image to see if after aggregation of all layers the behavior are different



Link to comment
  • 0

That's interesting.  When you Add a version to the OS layer we don't use the same process as app layers and platform layers because we don't need our filter driver to capture the layer writes.


That said do you have a similar problem on your VDAs after deploying the image?  If not I wouldn't worry about that as an issue.

Link to comment
  • 0



So I create a simple Platform Layer for MCS.

Try eventviewer and got the issue

Add the provisionning machine into domain

shutdown for finalize

Create template and publish

start the machine

Try eventviewer and no issue. the svchosts.Exe consume some CPU but ~20% instead of 50% and I can see the log less than 30s against 4/5 minute with the issue


so the "problem" are only on the provisionning machine. Usually I often check the event viewer . I will do it once just before sealing the layer:10_wink:


have a nice day



Link to comment
  • 0

I think you mean when you enable elastic layering on the image. Just to be sure are you using the user layer or just application elastic layers. 


One thing i might try is to not tun the event viewer in a packaging machine  like when you are creating the platform layer as that will pull the evt logs in. That might be causing issues later but i think you should continue to work with support.  

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...