69

My CPU usage is 100% most of the the time in Windows Server 2008-R2 with my own vps, vmware, quad core, and 4GB Ram. When I open windows Task Manager and go to the resource monitor I see that 100% usage is because of workerprocess.exe. I have 3 websites in my IIS.

  • How can I figure out which web site causes that usage
  • How can I limit it to 80% usage of CPU?
  • Could it be a DDOS attack?
  • Is there any way to prevent DDOS?

I installed eset-nod32 on my vps, but it doesn't show any attack in the logs. I've tried searching about IIS and preventing DDOS, and just found an extension for banning IP addresses, but how can I find which IP address are generating traffic?

The web site is written in ASP.NET and C#. How can I determine what is happening on that web site and which lines of code are causing the CPU usage?

Also, one of my web sites should access administrator's desktop and read and write some files. So because of that I changed its application pool -> identity (Process Model) to local system, and I don't know if it is related with the CPU usage or not.

starball
  • 20,030
  • 7
  • 43
  • 238
SilverLight
  • 19,668
  • 65
  • 192
  • 300

8 Answers8

129

Diagnosing

In terms of diagnosing what App Pool is causing trouble, you can:

  1. Select the server
  2. Go to IIS > Worker Processes

Server Settings

This should bring up a menu like this so you can determine which App Pool is running amok.

Worker Processes

From there you can simply restart the the app pool and 9 times out of 10 that will fix any immediate issues you're having.

Treating

Unless you run some sort of controversial business, this is probably not a DDOS attack. It's likely that some code is just hanging because it couldn't get through to another server or got stuck in a loop or mis-allocated resources or your app pool just hasn't been recycled in a while.

You can deal with this problem programmatically without having to manually identify, log in, and recycle the app pool. Just configure the CPU property on your App Pool. You can have it kill (and automatically restart) your process anytime you reach a CPU threshold for a certain amount of time.

In your case, if you want it to restart at 80%, you can right click on the app pool and go to Advanced Settings and apply the following configurations:

App Pool Advanced Settings

NOTE: As kraken101 pointed out, different IIS GUIs have treated this differently over time. While the config value is always in 1/1000 of a %, sometimes the GUI takes the whole percent.

You can add this to your config section like this:

<applicationPools>
   <add name="DefaultAppPool">
     <cpu limit="80000" action="KillW3wp" resetInterval="00:01:00" />
   </add>
</applicationPools>

Alternatively, you could script it with Powershell's WebAdministration Module like this:
(*make sure web-scripting-tools is enabled)

Import-Module WebAdministration

$appPoolName = "DefaultAppPool"
$appPool = Get-Item "IIS:\AppPools\$appPoolName"
$appPool.cpu.limit = 80000
$appPool.cpu.action = "KillW3wp"
$appPool.cpu.resetInterval = "00:01:00"
$appPool | Set-Item

Preventing

The steps above will help fix some things once they've broken, but won't really solve any underlying issues you have.

Here are some resources on doing performance monitoring:

Community
  • 1
  • 1
KyleMit
  • 30,350
  • 66
  • 462
  • 664
  • 1
    Thank you @KyleMit for the CPU autorestart tip. Just hands up for others, that the value for CPU Limit in IIS Manager (at least in IIS 7.5) must be set in 1/1000 of percent (it is mentioned in description of the field in the IIS form), so setting the value to 80 (0,08%) will lead to endles pool recycling and stopping as hapened to me :). – Kraken101 Jan 05 '17 at 13:23
  • `restart` you mean screw up all current users? – Toolkit Sep 12 '17 at 13:02
  • 1
    @Toolkit, any traffic waiting for a response from a machine that's hung at >95% CPU for >2 minutes was not going to do well anyway, and most certainly fated to be killed by timing out on its own. It doesn't do any additional harm to take their fate in your own hands while simultaneously removing the problem. I agree that there's some harm to be had, just not that it's being inflicted at the decision point of taking out the trash. Put another way, given that your entire server is hanging on a single app as described in this scenario, what alternative corrective action would you suggest? – KyleMit Sep 13 '17 at 19:27
  • fix the server and the app that causes issues. In my case the server went nuts – Toolkit Sep 14 '17 at 14:24
  • @Toolkit, but I already addressed that in my answer in the section about **Treating**. Obviously the best long term solution is to prevent issues before they arise, but that's going to have a huge universe of options depending on many different scenarios, and it still leaves the question of how to immediately respond to 100% CPU load. – KyleMit Sep 14 '17 at 18:58
18

Well, this can take long time to figure out. Few points to narrow it down:

Tomas Voracek
  • 5,886
  • 1
  • 25
  • 41
  • I have this same issue in IIS 7. I already which page and what is causing it. what I don't know is why it only happens in IIS 7 windows 10 and not any other IIS and server ( I am running this same code with no change on 6 other machines Windows 2003,2008, 2012, 8.1 and 7) – AaA Nov 02 '15 at 03:47
  • 4
    In my case, IIS was trying to connect to Microsoft server to update Dot.NET and compile Website again. Because server was in intranet and didn't have access to internet, it was keep failing and start over. As you see it had nothing to do with code or AppPool. Anyway a sysinternal tool to find why the downvotes, is a good idea! – AaA Apr 21 '16 at 08:38
  • @AaA Since we are on site for programmers I assumed that OP problem is related to problem with his application code. High CPU usage can be caused by anything, be it code, update, buggy code in IIS/Windows/driver etc. – Tomas Voracek Apr 21 '16 at 09:33
  • @AaA have you got the cause and solution in your problem? Somewhat similar situation I'm facing. High CPU after Changing(upgrading) Server machine and configuration – Amit Apr 02 '18 at 09:26
  • @Amit, my web applications are compiled `ASP.NET Web applicastion` one developer included a `Web site' style page in the application, I made open the project instead of open website and compile the page into application. but I assume this has nothing to do with your issue, You still need to investigate the issue. Isolate your appPool for each application, find the AppPool that is using a lot and then fine the page causing it looking at sysinternal ProcessMon – AaA Apr 04 '18 at 03:02
1

Use PerfMon to collect data and DebugDiag to analyse.

Found this link while searching for similar issue.

http://www.iis.net/learn/troubleshoot/performance-issues/troubleshooting-high-cpu-in-an-iis-7x-application-pool

azed
  • 156
  • 2
  • 4
1

I was facing the same issues recently and found a solution which worked for me and reduced the memory consumption level upto a great extent.

Solution:

First of all find the application which is causing heavy memory usage.

You can find this in the Details section of the Task Manager.

Next.

  1. Open the IIS manager.
  2. Click on Application Pools. You'll find many application pools which your system is using.
  3. Now from the task manager you've found which application is causing the heavy memory consumption. There would be multiple options for that and you need to select the one which is having '1' in it's Application column of your web application.
  4. When you click on the application pool on the right hand side you'll see an option Advance settings under Edit Application pools. Go to Advanced Settings. 5.Now under General category set the Enable 32-bit Applications to True
  5. Restart the IIS server or you can see the consumption goes down in performance section of your Task Manager.

If this solution works for you please add a comment so that I can know.

Pramil Gawande
  • 455
  • 8
  • 13
1

There are a lot of reasons that you can be seeing w3wp.exe high CPU usage. I have selected six common causes to cover.

  1. High error rates within your ASP.NET web application
  2. Increase in web traffic causing high CPU
  3. Problems with application dependencies
  4. Garbage collection
  5. Requests getting blocked or hung somewhere in the ASP.NET pipeline
  6. Inefficient .NET code that needs to be optimized
Ardavan Dejpanah
  • 96
  • 5
0

If it is not necessary turn off 'Enable 32-bit Applications' from your respective application pool of your website.

This worked for me on my local machine

Yogesh Patil
  • 151
  • 1
  • 6
  • Oddly enough, turning this ON seems (so far so good) to have stopped the intermittent issue of CPU usage heading north for a particular app pool. I know we had to do that with another one years ago, but cannot remember why. – gchq Feb 23 '20 at 13:51
-1

Use procmon to define your problem.

Bart van Kleef
  • 87
  • 5
-5

I recently had this problem myself, and once I determined which AppPool was causing the problem, the only way to resolve the issue was remove that app pool completly and create a new one for the site to use.

embryo
  • 147
  • 1
  • 1
  • 7