WMI Provider Host and Spooler SubSystem App - High CPU

[Joe W]

I have been battling this problem for years now and really need to find a solution. We have a 7.15 farm hosting provisioned Windows 2016 desktops running on esx 6.5 hosts. Each vm averages about 7-8 users a day. Every day at least one or multiple servers experiences an issue where something is causing the WMI Profiver Host service and the Spooler service to consume large quantities of CPU for extended periods of time-- sometimes for hours. If you end one service the other will drop off too only to resume occupying the CPU again moments later. I have tried everything from resetting the WMI metrics to installing all new printer drivers . There has to be someone out there who has seen this behavior before?

 

[Dennis Parker]

We had WMI High CPU issues for quite some time. There are threads about it here in the forums somewhere still I'm sure. We ended up disabling a feature in our monitoring system (I can't recall the exact WMI calls it was doing and what we disabled, but this wasn't CPU as we still do CPU monitoring with the monitoring system) and Citrix CPU monitoring that were both causing WMI rebuilds at a regular interval due to what others have deemed to be a bug, but Microsoft hasn't changed/fixed as far as I have seen. 

 

This may not be related to your specific case since we didn't have the same issues with the Print Spooler service you are seeing in that case. 

We did have some printer billing software packages that also generated high WMI CPU as they were doing their function and had to get fixes from the different vendors (at least two different vendors have caused this sort of issue for us, as well as one VOIP phone system), but again, not the Spooler service that you also are seeing. 

This can get difficult to troubleshoot as there are potentially many different causes that end up with the same symptom in the end and any one of them alone will cause it and disabling the one thing won't fix the issue. Breaking a "rule" of troubleshooting, only make one change at a time to see if things are fixed. 

[Joe W]

Yeah, we originally thought it was our monitoring (What's Up Gold) that was casuing the issue, but we switched to monitoring CPU, memory, etc. from the VMWare side rather than Windows thinking this would solve the problem but it did not. 

[Dennis Parker]

Look at Citrix monitoring as well. It isn't the monitoring itself that caused our issue either. It was a WMI "rebuild" process triggered by the monitoring processes. And it seems there are several WMI calls can trigger this rebuild. 

[Joe W]

Where would I look to find/configure CItrix monitoring? I guess you do see CPU/memory stats in Director. I didn't think of that. 

[Dennis Parker]

Yeah, those stats in Director aren't gathered. I set the "Enable resource monitoring" policy to Prohibited in Citrix policies.

 

[Joe W]

Oh wow. OK. Worth a shot. I've tried everything else.

 

Thanks! 

[Joe W]

So I guess this policy setting isn't available in version 7.6 of Xen App. Seems like 7.12 is when they added it. Instead I see a setting for CPU monitoring. 

 

 

I guess my question is: what specifically triggers the WMI service to spike?

[Dennis Parker]

You did say 7.15 in the initial post about this, so I thought that's what we were talking about, but neither here nor there.

I can't tell you specifically anything that causes the WMI spike, but I can direct you to a few discussions about the issue that helped me find my issues:
https://discussions.citrix.com/topic/400135-xenapp-715-cu2-wmiprvseexe-high-cpu/
https://discussions.citrix.com/topic/395518-wmiprvse-high-cpu-utilization/#comment-2010908
https://github.com/prometheus-community/windows_exporter/issues/89

[Joe W]

My bad. I am running two farms concurrently 7.6 (on Windows 2008 R2) and 7.15 (on Windows 2016). Both farms experience the same exact problem which is what makes it so confounding. 

 

I will review those links and see if there is anything I missed. In the meantime, I will disable the CPU Usage monitoring on the 7.6 farm and will monitor the effects. 

[Joe W]

Still no joy unfortunately. I turned off resource monitoring and while I am not seeing the WMI Provider Host consuimg high CPU at this time, I do still have an issue with  the Spooler service. I observed something strange in the C:\Windows\system32\spool folder. Every few seonds the folder would populate with .cab files and folders with a GUID string as the name. Then they would disappear. I compared this to a machine which was not experiencing high CPU and did not see this behavior. A quick google search led me to a bad printer driver again. But how to determine which one is causing the issue? Users are not reporting any issues with printing at all.

 

[Alan Rogers]

Did you have any luck tracking down this issue at all? I am seeing the same with the print spool on our Citrix 7.13 farm.

[Joe W]

Hey Alan,

 

That's a negative. Still occurs 3-4 times a day on any number of Desktop servers. It doesn't seem to affect performance-- at least people aren't complaining lol. More of an annoyance as our WhatsUp Gold monitor sends out multiple emails alerting us of the high CPU condition.