krview and Kei386EoiHelper

[netbumbler]

I have a system module going slightly rogue on me - it's shooting up to 25-35% CPU and causing slow-down on the 25 users on the machine. I downloaded the microsoft krview app - very cool thing - and it gives me a breakdown of the event that is causing the problem. In NTOSKRNL is an even kei386eoihelper - kernview gives a slice of what is using what cpu power and this kei386eoihelper represents 86% of the NTOSKERNEL system events. This definitely seems to be my problem but I can't figure out how to diagnose WHAT it is. Can anyone please point me in the right direction?
Thanks!
Chris

 

[mattjurado]

Before you look at that, what has changed on the server? Anything new installed? Patches, updates?

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[netbumbler]

Not really. The servers been up for 33 days. We've added a program and also we've relocated some client files locally to the machine. Concerning the program - we've shutdown the 4 services that were running - and yet the CPU % behaviour did not stop. Restarting the services did not yield any significant CPU increase so I tend to think it's not these services. The relocation of the files could mean additional local file I/O (actually, we're using net shares locally) - but would it be likely to cause an anomaly in NTOSKERNEL?
Another thought - is to try a restart of the server. I know sometimes processes just begin exhibiting strange behaviour and a restart clears them out - this could be one of those times.
Thanks for any thoughts on the matter!
Chris

 

[mattjurado]

I would simply look at rebooting the server and seeing if the behavior returns...

Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.