ESET File Server Security using 30-60% cpu on terminal server

[Aaron 300 0]

It was doing this earlier, and we uninstalled and reinstalled and it was fixed for a few months, and has now come back.

[Marcos 4,705]

Please install the Windows ADK (https://docs.microsoft.com/en-us/windows-hardware/get-started/adk-install).

When you notice a high CPU utilization by ekrn.exe, enable logging by running the following as an administrator:

wpr -start GeneralProfile -start Minifilter -filemode

After not more than 5 minutes, stop logging by running:
wpr stop EsetPerf.etl

 

Next compress EsetPerf.etl, upload it here or to a safe location, if too big and drop me a pm with a download link.

[Aaron 300 0]

Thanks for the fast response - unfortunately I wasn't able to run ADK while the issue was occurring.

Had to reinstall EFSW overnight as this is a critical server - looks like CPU usage is back down to 0-6% now, but it would be good to know if you have any ideas of what might have caused this.

We have over 70 users on this server, and this problem last happened 3 months ago on a clean install of EFSW.

Is there anything you can tell from the ESET logs I sent you by PM?

Any help is greatly appreciated - thanks!

[Marcos 4,705]

WPR from ADK should be installed before the issue occurs. When the issue is already manifesting, you just run the above command to generate an etl log. Without the log or an ekrn dump it's impossible to tell the cause of the issue.

[Aaron 300 0]

Ok, thanks - if it happens again I'll run WPR.