If you follow the steps to configure event subscription to pull the base management controller (BMC) System Event Log (SEL) events into the event logs in Windows Server 2008 R2, as mentioned in KB 950257 , you may observe high CPU utilization on the system in the following processes:
- SVCHOST (WINMGMT)
Pulling the hardware event consumes CPU resources. The WMI provider tries to pull all the events every time, which causes the high CPU usage.
To resolve this problem, save the hardware events and clear them. Following the steps from below should drop the CPU utilization.
- Backup the hardware events in the event log.
- Open WMI Tester - wbemtest.exe
- Click on Connect button
- Type root\hardware in the Namespace and then click on Connect
- Click Query button and then input select * from recordlog
- Double-Click on the only entry and then copy the _Relpath property.
- Click Close until you get back to WMI Tester console
- Click Execute Method
- Paste the _Relpath into the object path and then click OK
- Notice a box that pops up that allows you to execute the Clear Log.
- Click the Execute! button and then click Close.