W3WP.exe process consuming 100% CPU on Exchange CAS Server

This one took one full day but was worth spending this much time at the end. one of my CAS server was at 100% CPU & was causing my iPAD users to sync emails extremely slow.

as a troubleshooting step, I stopped ActiveSync App pool on the CAS server & saw the CPU usage came down averaging at 10% in a few minutes, we knew it was either a known issue with bad firmware of an IOS (iPhone) or some user making a lot of hits to the server.

More details here -> http://support.microsoft.com/kb/2563324

I also used Logparser to collect statistics, I documented this process in my previous post here at http://messagingserversupport.com/2012/01/20/using-logparser-with-iis-logs-to-filter-connection-statistics-for-exchange-server/

Had PSS analysze a process dump for W3WP.exe process using procdump utility, following are the steps for collecting ProcDump

Please download the ProcDump tool (below link) on the CAS Server.
http://technet.microsoft.com/en-us/sysinternals/dd996900

-c CPU threshold at which to create a dump of the process.
-s Consecutive seconds CPU threshold must be hit before dump is written (default is 10).
-n Number of dumps to write before exiting.
-ma Write a dump file with all process memory. The default dump format includes thread and handle information.

Example: Write up to 3 dumps of a process named “World Wide Web Publishing Service” when it exceeds 90% CPU usage for five seconds

procdump -ma <PID> -c 90 -n 3 -s 5 -accepteula c:\w3wp.dmp.

We noticed that there was one user who had more hits than anyone else & had about 11 MB contacts, this users was trying to sync all 7500 contacts everytime he attempted a connection with CAS.

After I disabled this users device partnership, the CPU utilization came down drastically. the iPad users were able to sync with no problems.

Exchange Server 2007, Exchange Server 2010

Using Logparser with IIS logs to filter connection statistics for Exchange Server

Convert Public Folder Calendar to “Room Mailbox” in Exchange Server 2007

7 Responses to “W3WP.exe process consuming 100% CPU on Exchange CAS Server”

Jay Latchman says:

March 20, 2012 at 1:09 pm

We are having the same issue with one of our clients. Did you leave the user device disabled? How were they able to sync after your findings?

Reply
- Sandeep says:
  
  March 21, 2012 at 6:08 am
  
  Jay, we removed the device partnership until we made sure the user removes the additional contacts. We found the user had an outlook add-in that was downloading contacts to his mailbox. The user had to create ActiveSync partnership again.
  
  Reply
Matt says:

April 5, 2012 at 3:38 pm

What is PSS? "Had PSS analysze a process dump for W3WP.exe process using procdump utility"

Reply
- Sandeep says:
  
  April 5, 2012 at 4:54 pm
  
  Matt, PSS is Microsoft Product Support Services. you will need to gather process dump & provide to Microsoft to be able to tell exactly what is causing the spike in W3WP process. I have found it to be usually a user trying to sync too many contacts using ActiveSync
  
  Reply
Steve D says:

July 10, 2012 at 11:29 pm

Sandeep, did you find a way to “solve” the problem? I have a user with over 10,000 real contacts – i cant see any add-ins on his windows PC, but his iphone is always syncing the contacts- Microsoft confirmed it but couldnt advise how to solve.

Any advice?

Reply
- Sandeep says:
  
  July 11, 2012 at 4:58 am
  
  Hi Steven,
  
  basically anything more than 5000 contacts will show you this issue, you can use the following hotfix & registry key to throttle the AS connections, that way you can keep your CAS performance normal & not affect everyone in the enviornment because of a single user syncing 10 K contacts
  
  http://support.microsoft.com/kb/2656040
  
  if you have additional question, let me know.
  
  thanks
  
  Reply
casey says:

August 4, 2012 at 2:45 am

the default value of the registry key was 16, what did you set the value to to limit the resource exhaustion. Did you set it for one connection per ActiveSync device partnership?

Reply