Jump to content

ekrn.exe? High CPU usage when the screensaver is active


Recommended Posts

I noticed that when the screensaver is active the ekrn.exe process uses a lot of CPU, in the case in example 697 seconds in a period of about 15 minutes.
Together with the ekrn.exe process, the dwm.exe process also uses a lot of CPU.

Regards,

Annotazione 2020-05-05 184025.jpg

Link to comment
Share on other sites

  • Administrators

Most likely you have enabled the Idle-state scan which is run when screen saver is activated if you select that as the trigger.

Link to comment
Share on other sites

  • Administrators

Please carry on as follows:
- in the advanced setup -> tools -> diagnostics, enable advanced OS logging
- reproduce the issue with high cpu utilization
- stop logging
- collect logs with ESET Log Collector and provide me with the generated archive.

Link to comment
Share on other sites

Ok for diagnostics.

Where do I find ESET Log Collector?

Sorry, I find in FAQ

Regards,

 

Edited by LittleWave
Link to comment
Share on other sites

  • Administrators

You can compress it, upload it to OneDrive, DropBox, Wetransfer.com, etc. and provide me with a download link.

Link to comment
Share on other sites

  • Administrators

The log was not created at the right time. 15% CPU utilization is attributed to Procmon. Ribbons.scr was using 1,7%. Then are 54 processes ngen.exe, out of which 49 taking 0,5-1,7% of the CPU. Ngen.exe is a part of .Net Framework.

Ekrn was using 0,7% CPU and egui 1,2% CPU. ESET is not a .Net app so the running ngen.exe is unlikely to be attributed to it.

Does disabling any of the protection features make a difference?

Link to comment
Share on other sites

Attached the situation processed Process Monitor for about 20 minutes.

I tried to disable all features protections.

ekrn.exe is in second position, after dwm.exe

Regards,

Annotazione 2020-05-06 232019.jpg

Annotazione 2020-05-06 232206.jpg

Annotazione 2020-05-06 232230.jpg

Annotazione 2020-05-06 232300.jpg

Annotazione 2020-05-06 232328.jpg

Annotazione 2020-05-06 232407.jpg

Annotazione 2020-05-06 232440.jpg

Annotazione 2020-05-06 232517.jpg

Link to comment
Share on other sites

  • Administrators

First of all, you should provide only one log at a time. It is not good to run performance logging together with Procmon and vice-versa or the results will be skewed and useless since most of activity will be attributed to logging.

When creating a log with Procmon, enable advanced output under Filters before you start logging. After reproducing the issue, stop logging and save the log in the PML format and with all events selects.

image.png

Link to comment
Share on other sites

  • Administrators

The Procmon log with protection enabled didn't show high cpu utilization by ESET processes:

image.png

image.png

The Procmon log with protection disabled:

image.png

This was also confirmed by EsetPerf.etl log that you provided before.

It also appears that you have FortiClient installed. We strongly recommend keeping only one AV at a time:

image.png

Link to comment
Share on other sites

It is not clear to me what he controlled. In the log with protection enabled, the ekrn.exe process had an intense CPU usage.

Annotazione 2020-05-08 105543.jpg

Edited by LittleWave
Link to comment
Share on other sites

In the log with protection disabled, the ekrn.exe process had an intense CPU usage, a greater value than when protection was enabled. But perhaps it is I who do not correctly interpret the values.

As for FortiClient I use it to connect to a client in VPN, I didn't know it was also an Antivirus, on the other hand I wouldn't even know how to disable it.

Regards,

Annotazione 2020-05-08 110353.jpg

Link to comment
Share on other sites

  • Administrators

The said time is the total time spent by the process from its start, not just from the time of logging.

Please carry on as follows:

1, Start logging by running "wpr.exe -start GeneralProfile -filemode" as an administrator
2, Reproduce the issue.
3, Run "wpr.exe -stop trace.etl" to stop logging.
4, Provide trace.etl in a compressed form for perusal.

Link to comment
Share on other sites

I apologize for the late reply.

https://wetransfer.com/downloads/f6c39d9a2143036a3510c7566d40043b20200511140622/1e1e2bbfeffca5a3c6795e128372940520200511140734/c06d4b

Regards,

 

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...