How to identify SMS Executive process threads that are responsible for high CPU use on an SMS site server


When an SMS site server responds slowly, Task Manager may show that the SMS Executive process is responsible for high CPU use. This article describes how to use System Monitor in Microsoft Windows 2000 or in Microsoft Windows Server 2003 to identify the component in the SMS Executive process that is causing the problem.

You can run System Monitor locally on the SMS site server. You can also run System Monitor on another computer and then connect remotely to the SMS site server.

More Information

Configuring System Monitor to monitor the SMS Executive process

  1. In Windows Server 2003 or in Windows 2000, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  2. Expand Performance Logs and Alerts, right-click Counter Logs, and then click New Log Settings.
  3. In New Log Settings, type a name in the Name field. For example, type SMS Exec Threads, and then click OK.

    Note By default, the new log file is stored in the Perflog folder.
  4. In the SMS Exec Threads dialog box, click Add Counters on the General tab. (In Windows 2000, click Add.)
  5. In Add(Select) Counters, click to select the SMS site server, and then select instances that are specific to SMS for the following counters:
    Performance ObjectCounter nameInstance
    Processor% Processor Time_Total
    Physical Disk% Disk Time _Total
    Thread % Processor TimeAll the instances that start with SMSExec. For example, the instance may be smsexec/44.
    (40 or more entries may exist.)
    ThreadID ProcessAll the instances that start with SMSExec.
    ThreadID ThreadAll the instances that start with SMSExec.
    ThreadThread StateAll the instances that start with SMSExec.
    ThreadThread Wait ReasonAll the instances that start with SMSExec.
  6. Set the Interval value and the Units value in the Sample data every field. For medium-length logs that sample data for up to an hour, use the default value of 15 seconds. For shorter times, reduce the Interval value. For example, set the value to 2 or 3 seconds. To sample data for several hours or more, set the Interval value to 30 or 60 seconds.
  7. Click the Log Files tab. Make sure that the default Binary File in Log file type is selected, and then enter any comments in the Comment field.

  8. Click the Schedule tab. Set the Start log and Stop log times that you want, and then click OK.

Analyzing the Results

  1. In Windows Server 2003 or in Windows 2000, click Start, point to Programs, point to Administrative Tools, and then click Performance.
  2. Click System Monitor, and then click View Log Data on the Performance toolbar. Click the Source tab, click the Log files option, and then click Add. (In Windows 2000, click Select Log File, and then click Add.)
  3. In Select Log file, locate and select the log file that you created, and then click Open. (In Windows Server 2003, you must click OK to complete the file selection process.) By default, the log files are located in the Perflogs folder.
  4. Click Add on the Performance toolbar to select counters.
  5. In Add Counters, click Performance object. Make sure that the Memory object is selected. Click All counters, click All instances, and then click Add. Repeat this step for the following performance objects, and then click OK:
    • PhysicalDisk
    • Processor
    • Thread
  6. Click View Report. When you scroll over to the right, you may see one or more threads that have a very high % Processor Time value.
  7. Note the threads that have a high % Processor Time value. Make sure that you write down the following information for these threads:
    • ID Thread
    • Thread State
    • Thread Wait Reason
    Information for these threads may appear similar to the following:

    % Processor Time = 92.000

    ID Thread = 2008

    Thread State = 5

    Thread Wait Reason = 0

    This information indicates the following:
    • The ID Thread (TID) is 2008 in decimal notation and 0x7d8 in hexadecimal notation.
    • A Thread State value of 5 indicates that the thread is currently waiting. Other possible values are listed in the following table:
      Thread State ValueDefinition
      0 - InitializedA thread has started.
      1 - ReadyA ready thread wants to use a processor but must wait for a busy processor.
      2 - Running A running thread is using a processor.
      3 - StandbyA thread is initializing.
      4 - TerminatedA running thread has stopped.
      5 - WaitA waiting thread does not require a processor because the thread is waiting for a peripheral operation to complete or is waiting for a required resource to be free.
      6 - TransitionA thread in transition is waiting for a resource to run. For example, the thread is waiting for its execution stack to be paged in from disk.
      7 - UnknownA thread is in an unknown state.

      Thread Wait Reason is only applicable when the thread is in the Wait state. The following table explains the Thread Wait Reason values:

      Thread Wait Reason ValueThe thread is waiting for
      0 or 7The Executive service.
      1 or 8A free page.
      2 or 9A page in.
      3 or 10A pool allocation.
      4 or 11An execution delay.
      5 or 12A suspended condition.
      6 or 13A user request.
      14An event pair high.
      15An event pair low.
      16A local procedure call (LPC) receive.
      17An LPC reply.
      18Virtual memory
      19A page out.
      20 and higherUnassigned.

      Note Event pairs are used to communicate with protected subsystems.
  8. After you verify that the SMS Executive thread is responsible for the high CPU use, you must translate the TID hexadecimal value to an SMS Executive thread name.

    When an SMS Executive thread starts, it stores the TID that the thread is running under in the SMS log files.
  9. You can use the Windows Search function to search the SMS log files to determine the TID for the process that is causing high CPU use. To do this, follow these steps:
    1. On the SMS site server, click Start, point to Search. (In Windows 2000, click For Files and Folders.)
    2. In the A word or phrase in the file field, type the hexadecimal value for the TID. (In Windows 2000, this field is Containing text.)
    3. In the Look in field, specify the location of the SMS logs folder. (By default, this folder is SMS\logs.) Click Search (Now).

      In the following example, the 0x7D8 thread is found in the Despool.log file. Therefore, the SMS Despooler thread is responsible for the high CPU use.
      SMS_EXECUTIVE started SMS_DESPOOLER as thread ID 2008 (0x7D8).SMS_DESPOOLER2/16/2004 1:05:22 PM2008 (0x7D8)
      Note Typically, thread initialization appears in the log files as a message that is similar to the following: If more than one process runs under the same TID, the correct one to use will be the thread that started on a date that is closest to, but not later than, the date that you ran the System Monitor capture.

    Note You can use the Findstr.exe command-line utility or other "grep" utilities to search the log files for a TID. Additionally, you can use the SMS Trace utility (Trace32.exe) to review SMS log data. The SMS Trace utility can filter for specific TIDs. Systems Management Server 2003 Toolkit 1 includes the latest version of this utility. To download the toolkit, visit the following Microsoft Web site:

Article ID: 837372 - Last Review: Nov 27, 2007 - Revision: 1