WMI consuming High CPU and Memory in Windows Server 2022

Question

I have a multiple production server with EC2 Windows 2019 based instances in Amazon Cloud. I'm facing issue that WMI Process make High CPU and High Memory. I have installed some third party agents such monitoring too agent and Anti-virus agent on all windows 2019 machines. If I stop the WMI Process in Task manager. Then some of agents too stopped. I have checked the Process Id with event logs and searching the process id in Task manager. I can see some process with same ID.

I can see multiple error with same Event ID.

Finally I update the patch using Amazon System Manager Server Patching. After completed the patching, Still I could see this errors and WMI Process. Is it legitimate process then why its consuming more CPU and Memory? How can I resolve this issues? Can any please help me out from this hell?

Answer 1

Hello

Thank you for posting in Microsoft Community forum!

WMI-Activity Error 5858 with ResultCode = 0x80041032 (WBEM_E_CALL_CANCELLED) indicates that the WMI caller has successfully issued , but has released the object before retrieving the full result set using the method. If the WMI service is still holding data for the client when the client terminates the link (by releasing the object), this event will be logged.

IWbemServices:ExecQueryIWbemContextIEnumWbemClassObject::NextIWbemContext https://learn.microsoft.com/en-us/troubleshoot/windows-client/system-management-components/wmi-activity-event-5858-logged-with-resultcode-0x80041032#more-information

We can see that process ID 1168 contains multiple services, but we are not sure which service is the main cause of high CPU and high memory in the WMI process, so we can try to use Windows Performance Recorder (WPR) for analysis. https://learn.microsoft.com/en-us/windows-hardware/test/wpt/

Steps:

Download tools:

https://docs.microsoft.com/en-us/windows-hardware/get-started/adk-install

You can install the "Windows Performance Toolkit" online or download the offline .msi:

Note: If you are connected to the Internet, please download the ADK (second) installation package first. The default step is next during installation.

1.Check as follows:

2.Click on Start button and reproduce the problem.

Note: you only want to run this long enough to capture the issue. Runs should be limited to no more that 5-10 minutes.

3.When the problem is reproduced, click "Save" and save it to a desired directory.

4.Open WPR to view the WMI process and analyze the threads that occupy the highest CPU and memory.

WPR How-to Topics | Microsoft Learn

Best Regards,

Wesley Li