PRF: Perceived System Sluggishness

PERCEIVED SYSTEM SLUGGISHNESS

Description:  There are a number of factors which may cause a system to act sluggish, or appear to act sluggish.

Scoping the Issue:  Perfmon logs can be gathered on any Windows system to aid in troubleshooting perceived system sluggishness.  If you suspect a performance related issue on the system, capturing Performance Monitor logs during the time the problem is happening on the system may help determine the cause of the problem.  Poolmon Logs are also valuable to analyze potential high Paged Pool and NonPaged Pool usage issues.

Data Gathering:  In all instances, collecting either MPS Reports with the General, Internet and Networking, Business Networks and Server Components diagnostics, or a Performance-oriented MSDT manifest must be done.  Additional data required may include the following:

• Performance Monitor logs that include the timeframe when the Working Set Trimming occurred.  The length of time it takes the server to go from a normal state, to a memory leak state will determine the Perfmon capture interval. Please use the table below to set the capture interval.  You can create the log parameters manually, or by using the Performance Monitor Wizard.  Required counters include:
  • Cache / All Counters / All Instances
  • Memory / All Counters / All Instances
  • Process / All Counters / All Instances
  • Processor / All Counters / All Instances
  • Physical Disk / All Counters / All Instances

• Pool Monitor (PoolMon) logs that include the timeframe when the memory leak is occurring. As with Perfmon, the poolmon capture interval is set based on the frequency of the symptoms. The table below provides some guidelines for setting the interval. We strongly recommend capturing simultaneous Perfmon and Poolmon data simultaneously so we can correlate the events.

• It may also be necessary to capture a complete memory dump of the server while it is in the problem state.  In most cases we will capture what is known as a Ctrl-ScrollLock Memory Dump. However, if your system has a “Lights out Management” system (iLO), you will most likely want to capture what is known as an NMI Dump. In either case it is important to ensure that you have a pagefile on the root drive that is equal to the amount of RAM on the system plus about 100MB.  

Troubleshooting / Resolution:  After you have gathered this data, review the following:

• MPS Reports
  • Check the System Event Log for any Event ID 9, 11 or 15 messages.  The presence of these messages indicate a possible disk issue – more specifically a hardware issue.  If you are seeing these events, you should engage your hardware vendor.
  • Check the System Event Log for Event ID 333 messages.  These indicate a potential resource issue.  We have additional information in a previous blog post on Event ID 333, and also the Event ID 333 Support Center topic.
• Performance Monitor Logs
  • Check for Disk Related Performance issues.  Some common resolutions include adding more spindles, SAN configuration settings and addressing potential hardware issues
  • Check for high CPU issues for a specific process.  The information in our blog post on Processor Bottlenecks may be useful when troubleshooting High CPU issues, as well as the information in our Support Center topic on High CPU
  • Check for Low System PTE’s or memory pressure caused by a specific process.  Our blog post on Troubleshooting Memory Issues can help get you started.
  • Check for processes that are using an inordinate number of handles.  Our post on Troubleshooting Server Hangs goes into more detail
• Pool Monitor Logs
• Determine if there are any high NonPaged or PagedPool issues.  In the event that Pool Memory has been depleted, an Event ID 2019 (NonPaged) or 2020 (Paged) error will be logged
• Process Explorer
• In the event that you do have a high CPU issue, you can use Process Explorer to identify the process by sorting the CPU column.  Bring up the Properties of the process and click the Threads tab. You can sort by CPU and see which threads are taking up most of the CPU time.  If symbols are configured, you may be able to get more details on the thread, such as Stack information.

Additional Resources: 

• Microsoft® Windows® Internals, Fourth Edition: Microsoft Windows Server™ 2003, Windows XP, and Windows 2000
• Microsoft KB Article 177415 How to use Memory Pool Monitor (Poolmon.exe) to troubleshoot kernel mode memory leaks
• Microsoft KB Article 297019 - Personal folder files are unsupported over a LAN or over a WAN link
• Microsoft KB Article 822219 - Your system stops responding, you experience slow file server performance, or delays occur when you work with files that are located on a file server
• Microsoft KB Article 154690 - How to troubleshoot event ID 9, event ID 11, and event ID 15 error messages
• Microsoft KB Article 317249 - How to troubleshoot Event ID 2021 and Event ID 2022
• Microsoft KB Article 316739 - How to use the /userva switch with the /3GB switch to tune the User-mode space to a value between 2 GB and 3 GB
• Microsoft KB Article 244139 - Windows feature lets you generate a memory dump file by using the keyboard
• Microsoft KB Article 324446 - Terminal Server and connected Terminal Services clients pause when a Terminal Services client logs on or logs off
• AskPerf Blog - Troubleshooting Server Hangs (Part One)
• AskPerf Blog - Troubleshooting Server Hangs (Part Two)
• AskPerf Blog - Troubleshooting Memory Issues (Part One)
• AskPerf Blog - Troubleshooting Memory Issues (Part Two)
• AskPerf Blog - Troubleshooting 2019 and 2020 errors
• AskPerf Blog - An Overview of Processor Bottlenecks
• AskPerf Blog - Troubleshooting Event ID 333's
• AskPerf Support Center - Using Performance Monitor (pre-Windows Vista)