What do I do if a Windows instance has high CPU utilization? -

You can use tools, such as Task Manager and Resource Monitor, to check CPU utilization in Windows. This topic describes how to troubleshoot and resolve the high CPU utilization issue on a Windows Elastic Compute Service (ECS) instance.

Problem description

When you use a Windows ECS instance, the following issues may occur:

System unresponsiveness, slow service responses, or application performance degradation.
High CPU utilization or load is displayed in the ECS console. CPU utilization that exceeds 80% and load that exceeds 0.5 are considered high.
Alerts are generated indicating excessive CPU utilization or load.

Causes

The Windows ECS instance may have high CPU utilization due to one of the following reasons:

The ECS instance is infected by viruses or attacked by trojans.
Third-party antivirus software runs on the instance and consumes excessive CPU resources.
An exception occurs in an application or a driver on the instance, or an application has high I/O usage or a high interrupt rate.

Troubleshoot the issue

Use Resource Monitor to view CPU utilization metrics

This section describes how to use Resource Monitor to identify the high CPU utilization issue on an instance that runs Windows Server 2022. For information about other commonly used tools, see Common tools.

Connect to the ECS instance by using Virtual Network Computing (VNC).
For more information, see Connect to an instance by using VNC.
In the lower part of the desktop, click the Search icon, enter Resource Monitor, and then click OK.
In the Resource Monitor window, check for processes that cause high CPU utilization.
Record the process IDs (PIDs) and names of the processes.
Open the Task Manager window, click the Details tab, and then find the processes based on the recorded names and PIDs. Right-click each process name, select Open file location, and then check whether the process is a malicious program.

Resolve the issue

The following table describes the common causes of high CPU utilization issues and their solutions.

Issue	Cause	Solution
An abnormal user program or process occupies excessive CPU resources for an extended period, resulting in high CPU utilization and load.	The program or process consumes excessive CPU resources at runtime.	Use Resource Monitor to identify the program's PID, and terminate the process by using Resource Monitor or Task Manager. Warning Before you terminate a process, make sure that you understand the process information to prevent service interruptions due to incorrect operations. If you suspect that the process is malicious, scan and terminate it by using virus detection and removal.
A normal user program or process occupies excessive CPU resources for an extended period, resulting in high CPU utilization and load.	The business program or process consumes excessive CPU resources at runtime.	If the instance experiences a CPU performance bottleneck, resolve the issue by using one of the following methods: Upgrade the instance type. For more information, see Change the instance types. Optimize the business program.
A business program or process occasionally occupies excessive CPU resources or has high load for a short period.	The business program needs to be optimized for special scenarios, such as encryption, decryption, and high concurrency.	Optimize the business program.
No program or process consumes excessive CPU resources, while overall CPU utilization is high and load is low.	CPU resources required for normal operation of the instance's services exceed the instance's CPU performance capacity.	If the instance experiences a CPU performance bottleneck, upgrade the instance type. For more information, see Change the instance types.

Common tools

This section describes common Windows in-box tools used to identify high CPU utilization issues.

Task Manager

Task Manager allows you to view the lists of applications and processes and identify applications that cause high CPU utilization. The following figure shows the Task Manager window.

On the Performance tab, right-click the CPU graph and choose Change Graph To > Logical Processors.

Two graphs that show the utilization of two logical processors appear, as shown in the following figure.

When the CPU utilization of a process spikes to nearly 100% and the CPU utilization of other processes has insignificant change, a network I/O issue may occur.

Resource Monitor

Resource Monitor allows you to visually check CPU utilization and search for processes based on handles and modules.

Process Explorer

Process Explorer is part of the Microsoft Sysinternals suite. You can configure symbols to check thread call stacks of applications and identify potential anomalous drivers. You can download Process Explorer from Process Explorer.

The following figure shows the Process Explorer window.

Performance Monitor

Performance Monitor allows you to collect performance counters for various components to monitor CPU resource consumption.

Take note of the following critical performance counters:

\Processor(_Total)\% Processor Time: the percentage of time that the processor spends in executing non-idle threads. \Processor(_Total)\% Processor Time = \Processor(*)\% User Time+\Processor(*)\% Privileged Time.
\Processor(*)\% User Time: the percentage of time that the processor spends in running code in user mode. The performance counter can help you identify the applications or functions on which the processor spends a significant amount of time.
\Processor(*)\% Privileged Time: the percentage of time that applications spend in executing system calls in kernel (or privileged) mode, such as drivers, I/O request packets (IRPs), and context switching. If the value of % Privileged Time performance counter of the operating system exceeds 30%, the instance spends a significant amount of time in processing I/O requests.
If the % Privileged Time value is large, check the % DPC Time, % Interrupt Time, and Context Switches/sec performance counters.
- Large % DPC Time and % Interrupt Time values indicate that unknown devices perform many operations or have poor performance.
- A large Context Switch value indicates that the kernel switches processes or threads on the processor. For more information, see The Case of the 2 Million Context Switches and Mark Russinovich's The Case of the System Process CPU Spikes.
  A large Context Switches/sec value indicates that many threads are in the Ready state. To resolve this issue, reduce the number of threads.

References

For information about how to resolve high CPU utilization issues on Linux systems, see Troubleshooting and resolving high CPU utilization or load issues on Linux instances.