WMI consumers that register for instance modification events from the MSVM_ComputerSystem class in the root\virtualization namespace may receive more events than expected

Applies to: Windows Server 2008 StandardWindows Server 2008 EnterpriseWindows Server 2008 Datacenter

Symptoms


A WMI event consumer process that registers for notification events via a WQL query for the MSVM_ComputerSystem class may experience one or more of the following symptoms: 
  • High CPU usage
  • Growth in working set memory
  • An increasing number of worker threads

Example notification query:

Select * from __InstanceModificationEvent WITHIN 10 WHERE TargetInstance ISA 'MSVM_ComputerSystem'

Cause


These problems can be caused by antivirus software that is installed in the parent partition if the real-time scanning component is configured to monitor the Hyper-V virtual machine files.

Resolution


Exclude the directories used to store virtual machine files from real-time antivirus scans as described in the following Microsoft Knowledge Base article:

Virtual machines are missing in the Hyper-V Manager Console or when you create or start a virtual machine, you receive one of the following error codes: "0x800704C8", "0x80070037" or "0x800703E3"

http://support.microsoft.com/kb/961804/en-us

Note:  If the virtual machine files are stored on a cluster these antivirus settings should be set on all nodes.

More Information


Repeated scans of the virtual machine files can be identified using Windows Sysinternals Process Monitor.

Msvm_ComputerSystem Class
http://msdn.microsoft.com/en-us/library/cc136822(VS.85).aspx