question

RichardScott-3936 avatar image
0 Votes"
RichardScott-3936 asked BrianCoverstone-8902 commented

High CPU MonitoringHosts.exe Process

Hi All,

Im hoping someone can help direct me to the cause of a Single Agent and one of its monitoringhost.exe processes using upwards of 20% CPU Consistently.

I have a single host that is 1 of 4 SQL Cluster Hosts so this host has multiple virtualised SQL Cluster instances running on it as do the other 3 hosts but one in particular has a monitoringHost.exe process that is consistently using High CPU for the past 3 weeks.

This host is a member of the same groups as the other 3 hosts so has the same number of rules and monitors directed at it as the other 3 Hosts
agent cache has been cleared , i also reinstalled the agent and the problem returns.

the event log shows no irregularities aside from some 1207 errors for non remotable rules, which are consistent across the other 4 hosts

I have noticed on the host that it is writing 50000 plus errors every 10 minutes to the application event log , i am not collecting these errors but would i be correct in thinking the agent is having to follow that event log and thus working hard to do so ?

msc-operations-manager
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

just to add the environment is 2019 ur2 both agent and management server

0 Votes 0 ·

This is happening to me as well using Azure SQL Defender. The CPU tends to follow sqlservr.exe, but hangs around 20% on average.
No 3006 event id.

This is just a disaster product. Going to remove it. Glad it's on my MSDN account with $50/mo Azure credit. I can't imagine paying a dime for this.

0 Votes 0 ·
AlexZhu-MSFT avatar image
0 Votes"
AlexZhu-MSFT answered

Hi,

For MonitoringHost.exe high CPU issue, there may be many reasons, we may do search in the Operations Manager Event log for some events at the time of the Spikes or when the issue occurs as Stoyan susgested in this post.

https://social.technet.microsoft.com/Forums/Lync/en-US/d6ddddf4-e241-4a49-87e3-fc7d6289c08c/monitoringhostexe-process-consuming-lots-of-cpu?forum=operationsmanagerauthoring

As you mentioned, the application log is being flooded with events. If the Event ID is 3006, we may check this article:

https://janscman.wordpress.com/2013/01/03/scom-troubleshooting-constant-high-cpu-usage-of-monitoringhost-exe-and-event-3006/
Note: this is not from MS, just for your reference.

Hope the above information helps.

Alex Zhu


If the response is helpful, please click "Accept Answer" and upvote it.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

StoyanChalakov avatar image
0 Votes"
StoyanChalakov answered StoyanChalakov edited

Hi @RichardScott-3936,

Here a couple of thoughts, besides what Alex already mentioned:

  • What version of SCOM are you using and did you update your agent to the latetst UR level?

  • How long does it take after you restart the agent to get to the 20% CPU?

  • Which event is your application log flooded with? How did you check if SCOM collects it? (I would certainly run a SQL query on the DW for that):


    select * from Event.vEvent ev
    inner join Event.vEventDetail evd on ev.eventoriginid = evd.eventoriginid
    inner join Event.vEventParameter evp on ev.eventoriginid = evp.eventoriginid
    where eventdisplaynumber = '6022'

You can replace the 6022 with the event Id from the Application lof and make sure it isn't collected indeed.


If the response is helpful, please click "Accept Answer" and upvote it.
Regards,
Stoyan







5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.