Event subscription to pull BMC SEL events into the event logs causes high CPU utilization in Windows Server 2008 R2

Applies to: Windows Server 2008 R2 StandardWindows Server 2008 R2 EnterpriseWindows Server 2008 R2 Datacenter More

Symptoms


If you follow the steps to configure event subscription to pull the base management controller (BMC) System Event Log (SEL) events into the event logs in Windows Server 2008 R2, as mentioned in KB 950257 , you may observe high CPU utilization on the system in the following processes:
  • SYSTEM
  • WMIPRVSE
  • SVCHOST (WINMGMT)

Cause


Pulling the hardware event consumes CPU resources. The WMI provider tries to pull all the events every time, which causes the high CPU usage.

Resolution


To resolve this problem, save the hardware events and clear them. Following the steps from below should drop the CPU utilization.

  1. Backup the hardware events in the event log.
  2. Open WMI Tester - wbemtest.exe
  3. Click on Connect button
  4. Type root\hardware in the Namespace and then click on Connect
  5. Click Query button and then input select * from recordlog
  6. Double-Click on the only entry and then copy the _Relpath property.
  7. Click Close until you get back to WMI Tester console
  8. Click Execute Method
  9. Paste the _Relpath into the object path and then click OK
  10. Notice a box that pops up that allows you to execute the Clear Log.
  11. Click the Execute! button and then click Close.