EventSentry agent causes really high CPU usage in WMI Provider Host (WmiPrvSE.exe)

0 votes
asked Oct 2, 2018 in EventSentry by pbro (170 points)
Installing the EventSentry agent on one of my SQL Server machines causes a sustained 25% cpu usage in the WMI Provider Host process.

I've tried reinstalling the service, and searching through the KB, but I haven't found any fixes so far. I'm on any ideas?

1 Answer

0 votes
answered Oct 2, 2018 by Ingmar (7,190 points)
We're not currently aware of any issues where the agent would cause a high CPU utilization with WMI; EventSentry only utilizes WMI for a select number of smaller queries, mostly for hardware detection.

Is this SQL Server a physical or a virtual machine? If it's physical, is it DELL or HP? We have observed issues with the HP WBEM providers (which the agent utilizes) unfortunately, but not in regards to CPU usage.
commented Oct 2, 2018 by pbro (170 points)
It's a physical Dell R420 running win2012 R2.

We haven't run into this issue on the other 5-10 SQL Servers we've installed the agent on.

It's not a critical server... I'll just leave the agent stopped for now and try again after the next round of windows updates.
commented Oct 2, 2018 by Ingmar (7,190 points)
I'm happy to help in order to narrow this down - it could also have to do with the DELL WMI provider. Do you have OpenManage installed on that server?
commented Oct 2, 2018 by pbro (170 points)
We do have OpenManage on there, yes. Various version details below:

Systems Management Software (64-Bit) Version 9.1.0

Broadcom SNMP Agent Version 17.6.4
Common Storage Module Version 6.1.0
Data Engine Version 9.1.0
Hardware Application Programming Interface Version 9.1.0
Instrumentation Service Version 9.1.0
Apache Tomcat Webserver Version 8.5.15
Oracle Java Runtime Environment Version 1.8.0_131
Server Administrator Core files Version 9.1.0 (2757)
OMACS Version 9.1.0
Instrumentation Service Integration Layer Version 9.1.0
Server Administrator Instrumentation files Version 9.1.0
Inventory Collector Version 17.12.000
Storage Management Version 6.1.0
Server Administrator Common Framework Version 9.1.0
Operating System Logging Version 9.1.0
Remote Access Controller Managed Node Version 9.1.0
Server Instrumentation SNMP Module Version 9.1.0
Server Instrumentation WMI Module Version 9.1.0
commented Oct 4, 2018 by Ingmar (7,190 points)
Thanks for the details, we have OpenManage 9.10 installed as well and don't have any issues, although we don't have the "Server Instrumentation WMI Module" component installed. Does this show up as separately installed software?

Do you have a service installed on that computer that also reference "server instrumentation wmi" that look like they could be associated with that component?

Otherwise I would probably see if there is a new version of Dell OM available, although I believe that 9.1 is pretty current.
commented Oct 5, 2018 by pbro (170 points)
This has now started occurring on a second SQL server in the same environment, I've had to stop the agent on that one as well. This particular instance only manifested after a reboot.

I do not see a separate "Server Instrumentation*" service in services, and I do not see a separate "Server instrumentation*" in installed software. This server has OpenManage 8.5:

Systems Management Software (64-Bit)    Version 8.5.0
Broadcom SNMP Agent    Version 17.6.4
Common Storage Module    Version 5.4.0
Data Engine    Version 8.5.0
Hardware Application Programming Interface    Version 8.5.0
Instrumentation Service    Version 8.5.0
Apache Tomcat Webserver    Version 8.0.28
Oracle Java Runtime Environment    Version 1.8.0_112
Server Administrator Core files    Version 8.5.0 (2372)
OMACS    Version 8.5.0
Instrumentation Service Integration Layer    Version 8.5.0
Server Administrator Instrumentation files    Version 8.5.0
Inventory Collector    Version 17.03.200
Storage Management    Version 5.4.0
Server Administrator Common Framework    Version 8.5.0
Operating System Logging    Version 8.5.0
Remote Access Controller Managed Node    Version 8.5.0
Server Instrumentation SNMP Module    Version 8.5.0
Server Instrumentation WMI Module    Version 8.5.0
commented Oct 9, 2018 by Ingmar (7,190 points)
Sorry for the late response. This may be better handled by our support department, since we will likely need more information from your system(s) and perform additional troubleshooting steps. If you prefer to continue troubleshooting in the forums then please let me know.

At this point I can only imagine that it's either an issue with a WMI provider from OpenManage (although we're not aware of any issues), or an issue with the enumeration of patches and updates via WMI. This is something we can test with a different utility.
commented Oct 9, 2018 by pbro (170 points)
Okay. We'll be updating and restarting those servers this week for the regular patch cycle. If the issue recurs, we'll re-open the issue with support.
Welcome to EventSentry Q&A, where you can ask questions and receive answers from other members of the community.