Win Agent 2.2 64bit 100% CPU on Win 2008 R2 SP1

[mintonje]

The 2.2 Windows agent when installed on any of my Windows Server 2008 R2 SP1 servers causes svchost.exe to hit 100% CPU usage, the server then becomes unstable and the zabbix agent becomes unresponsive and stops sending data to the zabbix server.

I've tried various configurations in the conf file and tried running the 32bit agent with the same results.

The 2.2 32bit agent works fine on my Windows 2003 Servers.

Has anyone else experienced this or does anyone have any advice for me? Thanks!

[tchjts1]

I'll see if I can find a server to test that on...

[mintonje]

Excellent, thanks!

[ServicesIt]

I have the same problem.
Tested with 64- and 32-bit version but problem stays.
Installed the 209 version, 64- and 32-bit, no problems.

[mintonje]

I have the same problem.
Tested with 64- and 32-bit version but problem stays.
Installed the 209 version, 64- and 32-bit, no problems.

I'm glad I am not the only one. I have tested with both 2008 R2 SP1 and SP2 with similar results. I am currently running 2.0.9 without any problem as well.

The 2.2.0 agent continues to work fine on Server 2003.

[tchjts1]

My Win SA is building a 2008R2 SP1 server for me to test on. I'll have it by Friday. In the meantime, I will open a support ticket, assuming I will see the same results as you guys have reported.

[zalex_ua]

Does anybody use evenlog[] keys (to monitor windows event logs) on affected servers ?
How many per host?
Is there any patters?

If yes, then we need to know exact list of the keys and their update interval.

added: It could be related to ZBX-2008 which is not fully finished for 2.2.0 release.

[zalex_ua]

also, how long time you tried to wait before stop/kill unresponsive windows agent ?

[mintonje]

Does anybody use evenlog[] keys (to monitor windows event logs) on affected servers ?
How many per host?
Is there any patters?

If yes, then we need to know exact list of the keys and their update interval.

added: It could be related to ZBX-2008 which is not fully finished for 2.2.0 release.

I was using a single eventlog item, but I removed it and retested on the Win Server 2008 R2 SP1 host and the results were the same. I waited about 15 minutes before killing the service.

[zalex_ua]

After 2.2.0 release, these changes were made to windows agent:

https://www.zabbix.org/websvn/wsvn/zabbix.com?rev=40193

...G...... [ZBX-2008] added support of Audit Success/Failure severity for Security log
...G...... [ZBX-2008] implemented automatic loading of wevtapi.dll file and its functions
...G...... [ZBX-2008] improved performance of eventlog monitoring

(is it time to advertise the websvn ? )

Unfortunately, there no compiled agent available.
I'll ask to compile it tomorrow and it will be available here http://www.zabbix.com/developers.php in Pre-2.2.1rc1 (stable)

I'll let you know when it will be available.

[tchjts1]

zalex-ua: Thank you for accelerating this issue. I'll be happy to test it when the new agents are available.

[mintonje]

I'll test as well. Thanks!

[zalex_ua]

I've tested 2.2.0 release on a Win 7 x64 and Server 2008 R2 SP1 x64.

In both cases everything is fine.
In the 2008 later I've added a eventlog[System] key and I got all log records to zabbix frontend.
Yes, I saw a hill (~50% CPU usage) in taskmanager for 10-20 seconds or so, but that's ok.

Then I saw also unknown for me hills for 30-40 seconds long, then 10 minutes CPU is flat on 0%

[mintonje]

I think what I will try next is deploying the agent with no items configured for the host to be monitored and see how it behaves in that situation. If all is well, then I will slowly add items to the host and see which item causes the issue.

[mintonje]

I now have the 2.2.0 agent working on my 2008 servers. I didn't take the time to go through every single item, but I know it was one or more of the items in the 'Template Windows Baseline.'

I am using the below items from that template now and they are all working fine on all windows servers.

perf_counter[\Processor(_Total)\% Processor Time]
vm.memory.size[free]
system.swap.size[,free]
zabbix[host,agent,available]
system.uptime
proc.num[]
perf_counter[\Memory\Page Faults/sec]
perf_counter[\Memory\Page Reads/sec]
perf_counter[\Paging File(_Total)\% Usage]
perf_counter[\PhysicalDisk(_Total)\% Idle Time]
system.cpu.load[,avg1]
vm.memory.size[total]

I am also using the filesystem discovery and checking various other services.