MonitoringHost.exe System Center Management Service Host Process

Question

Hello,

I would like to address an issue we are experiencing with our VM hosted on the Azure platform. Automatically, a process called "MonitoringHost.exe System Center Management Service Host Process" starts and consumes CPU resources up to 100%. The VM is configured with an AMD EPYC 7763 CPU with 8 virtual cores, 32 GB of RAM, and dual premium SSD disks. Without that process, the normal CPU usage remains around 5%.

From various research I have conducted on this well-known process, MonitoringHost.exe System Center Management Service Host Process, I have discovered that it is associated with monitoring the performance of Azure. Therefore, it is not a process that starts automatically when performance is under stress, but rather it appears to be the cause of CPU saturation.

Currently, I have temporarily resolved the situation by disabling it directly from the server using the "net stop HealthService" command in CMD. After making this modification, the server functions perfectly, and CPU usage does not exceed 5% during normal operations across all our connected systems. To restart the service, we can simply use the inverse command, "net start HealthService," once we have identified the problem.

Allow me to provide you with the information I have found during my research:

Disable specific monitors: If stopping the service resolves the issue, it might be useful to identify the specific monitors causing the high CPU usage. You can follow these steps to temporarily disable certain monitors:

• Open the monitoring console on your server.
• Navigate to the "Authoring" section and select "Monitors."
• Locate the monitors that may be related to high CPU usage and temporarily disable them by right-clicking and selecting "Disable."

Monitor CPU usage: After disabling specific monitors or temporarily stopping the service, monitor CPU usage for a certain period of time. If CPU usage reduces and returns to normal, it suggests that the issue may be related to this process.

Gradually enable monitors: To identify the specific monitor causing the high CPU usage, gradually enable monitors one by one and observe their impact on CPU usage. Begin with the most essential monitors and check CPU usage after enabling each one. This approach will help pinpoint the monitor causing the problem.

Contact Microsoft support: If you are unable to resolve the issue by isolating the monitors, it is recommended to reach out to Microsoft support for further assistance. Provide them with details about the problem and the actions you have already taken to aid in diagnosing and resolving the issue.

Therefore, I deduce that this process has configurable parameters, but I am unable to modify them through the Azure panel since they are reserved for you or Microsoft directly.

Thank you very much, Looking forward to your response.

Answer 1

@Giacomo , thank you for posting this question and apologies for the delayed response.

You are right, the MonitoringHost.exe process is the child process of HealthService (display Name: "Microsoft Monitoring Agent"). This agent is installed in 2 scenarios:

1. As System Center Operations Manager agent (SCOM Agent) - If you are using SCOM, then the steps mentioned in the question (related to disabling "Monitor" and enabling them one by one) are applicable. This is done by SCOM console.
2. This agent is also used as Log Analytics agent, which is used to send the telemetry from machine to Azure Log Analytics Workspace. If you are using the agent for this purpose, the steps mentioned in the question don't apply.

How do you identify the scenario of agent usage?

On the machine, open "Control Panel" --> search for "Agent" and you would see "Microsoft Monitoring Agent" listed.

Open that:

1. If you have something populated in "Operations Manager" tab, as shown below, then this agent is being used as SCOM agent (scenario 1 above). If this is the case, you should connect with your SCOM administrator team and seek help to troubleshoot this issue. The SCOM console, will be available most probably on the server mentioned as "Primary Management Server" in the screenshot below (or it could be on another server as well)

1. On the other hand, if the "Azure Log Analytics (OMS)" tab has details of "Workspace Id" mentioned, then this agent is being used as Log Analytics agent.

---

After identifying the nature of agent, there are some common steps that can be taken to troubleshoot both the scenarios

1. Upgrade the agent to the latest version.
2. The "Operations Manager" event log in "EventViewer" can help understand the issue better. Check these logs for events of "Warning, Error, Critical" level to understand if there are errors being logged. These should help diagnose the issue further.
3. You should also check the Application, system and security event logs to understand if there are other issues that might be causing this behavior.

The Troubleshooting guide for windows LA agent should help diagnose this issue further as it contains a varierty of scenarios available as a diagnosing script.

Hope this helps.

If the answer did not help, please add more context/follow-up question for it, and we will help you out. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.