LittleWave 0 Posted May 5, 2020 Share Posted May 5, 2020 I noticed that when the screensaver is active the ekrn.exe process uses a lot of CPU, in the case in example 697 seconds in a period of about 15 minutes. Together with the ekrn.exe process, the dwm.exe process also uses a lot of CPU. Regards, Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 5, 2020 Administrators Share Posted May 5, 2020 Most likely you have enabled the Idle-state scan which is run when screen saver is activated if you select that as the trigger. Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 5, 2020 Author Share Posted May 5, 2020 If I do not go wrong the check for idle computer should be disabled. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 6, 2020 Administrators Share Posted May 6, 2020 Please carry on as follows: - in the advanced setup -> tools -> diagnostics, enable advanced OS logging - reproduce the issue with high cpu utilization - stop logging - collect logs with ESET Log Collector and provide me with the generated archive. Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 6, 2020 Author Share Posted May 6, 2020 (edited) Ok for diagnostics. Where do I find ESET Log Collector? Sorry, I find in FAQ Regards, Edited May 6, 2020 by LittleWave Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 6, 2020 Administrators Share Posted May 6, 2020 2 minutes ago, LittleWave said: Where do I find ESET Log Collector? Please see the link in my signature or in the FAQ section on the right-hand side of this forum: How do I use ESET Log Collector? Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 6, 2020 Author Share Posted May 6, 2020 I have a problem the generated file is 225 MB How do I send it? Regards, Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 6, 2020 Administrators Share Posted May 6, 2020 You can compress it, upload it to OneDrive, DropBox, Wetransfer.com, etc. and provide me with a download link. Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 6, 2020 Author Share Posted May 6, 2020 (edited) https://wetransfer.com/downloads/8c62a7e01ec45c09c84b5e786856b00c20200506124038/............. Regards, Edited May 8, 2020 by LittleWave Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 6, 2020 Administrators Share Posted May 6, 2020 The log was not created at the right time. 15% CPU utilization is attributed to Procmon. Ribbons.scr was using 1,7%. Then are 54 processes ngen.exe, out of which 49 taking 0,5-1,7% of the CPU. Ngen.exe is a part of .Net Framework. Ekrn was using 0,7% CPU and egui 1,2% CPU. ESET is not a .Net app so the running ngen.exe is unlikely to be attributed to it. Does disabling any of the protection features make a difference? Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 6, 2020 Author Share Posted May 6, 2020 Attached the situation processed Process Monitor for about 20 minutes. I tried to disable all features protections. ekrn.exe is in second position, after dwm.exe Regards, Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 7, 2020 Administrators Share Posted May 7, 2020 First of all, you should provide only one log at a time. It is not good to run performance logging together with Procmon and vice-versa or the results will be skewed and useless since most of activity will be attributed to logging. When creating a log with Procmon, enable advanced output under Filters before you start logging. After reproducing the issue, stop logging and save the log in the PML format and with all events selects. Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 8, 2020 Author Share Posted May 8, 2020 Here is the link where to find the ProcessMonitor logs, one with protection enabled, the other with protection disabled. https://wetransfer.com/downloads/66ae562972a6d38fa3300d4fa4baf06020200508080526/39c9c6eb37417bc97495ba5ab3150cb520200508080845/0b14ee Regards, Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 8, 2020 Administrators Share Posted May 8, 2020 The Procmon log with protection enabled didn't show high cpu utilization by ESET processes: The Procmon log with protection disabled: This was also confirmed by EsetPerf.etl log that you provided before. It also appears that you have FortiClient installed. We strongly recommend keeping only one AV at a time: Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 8, 2020 Author Share Posted May 8, 2020 (edited) It is not clear to me what he controlled. In the log with protection enabled, the ekrn.exe process had an intense CPU usage. Edited May 8, 2020 by LittleWave Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 8, 2020 Administrators Share Posted May 8, 2020 In your screen shot CPU utilization by ekrn is almost zero all the time: Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 8, 2020 Author Share Posted May 8, 2020 In the log with protection disabled, the ekrn.exe process had an intense CPU usage, a greater value than when protection was enabled. But perhaps it is I who do not correctly interpret the values. As for FortiClient I use it to connect to a client in VPN, I didn't know it was also an Antivirus, on the other hand I wouldn't even know how to disable it. Regards, Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 8, 2020 Author Share Posted May 8, 2020 But "Total User CPU" of ekrn.exe is 03 minutes and 57 seconds? Regards, Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 9, 2020 Administrators Share Posted May 9, 2020 The said time is the total time spent by the process from its start, not just from the time of logging. Please carry on as follows: 1, Start logging by running "wpr.exe -start GeneralProfile -filemode" as an administrator 2, Reproduce the issue. 3, Run "wpr.exe -stop trace.etl" to stop logging. 4, Provide trace.etl in a compressed form for perusal. Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 11, 2020 Author Share Posted May 11, 2020 I apologize for the late reply. https://wetransfer.com/downloads/f6c39d9a2143036a3510c7566d40043b20200511140622/1e1e2bbfeffca5a3c6795e128372940520200511140734/c06d4b Regards, Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 11, 2020 Administrators Share Posted May 11, 2020 Still no ESET process on top of the list of the most CPU-intensive processes: Link to comment Share on other sites More sharing options...
LittleWave 0 Posted May 11, 2020 Author Share Posted May 11, 2020 Ok! Thank you for your patience. Regards, Link to comment Share on other sites More sharing options...
Recommended Posts