High CPU usage: System -> SRV.SYS / HAL

[Woolbox]

Dear Experts! :-)

I've been troubleshooting performance problems on a particular server for a
few days now and cannot quite figure this one out.

Environment
* The server used to be a physical one, was virtualized using VMWare
Converter and now running on VMWare Server 1.0.6.
* Host machine runs on Windows Server 2003 R2 Enterprise with SP2 and
has two dual-core Intel 3.2 GHz processors and has 8 GB RAM
* Host machine currently hosts the problematic server only

Symptoms and attempts to resolve
When copying (larger) files from the server, approx. CPU utilization rises
to 50%, slowing down the server.

Process Explorer reveals that the offending process is "System", under which
"srv.sys!WorkerThread" consumes the majority of CPU ressources.
Ran KernRate (Kernrate_i386_XP.exe -s 5 -j
srv**http://msdl.microsoft.com/download/symbols) which showed to modules
consuming approx. 50% each of the total consumption: "intelppm" and "hal".

Disabled the IntelPPM service and rebooted. Then ran KernRate again, zooming
into the "hal" module (Kernrate_i386_XP.exe -s 5 -j
srv**http://msdl.microsoft.com/download/symbols -z hal -f). Here is the top
modules under the "hal" module:

----- Zoomed module hal.dll (Bucket size = 16 bytes, Rounding Down) --------
Percentage in the following table is based on the Total Hits for this Zoom
Module
Time 1332 hits, 25000 events per hit --------
Module Hits msec %Total Events/Sec
HalProcessorIdle 737 5000 23 % 3685000
WRMSR 737 5000 23 % 3685000
READ_PORT_BUFFER_UCHAR 482 5000 15 % 2410000
READ_PORT_ULONG 482 5000 15 % 2410000
READ_PORT_USHORT 482 5000 15 % 2410000

(the rest of the modules are 2% or less)

I've tried adding a second virtual CPU, switching HAL between Standard PC,
MPS and ACPI to no avail.

Why is 1/4 of the cPU cycles used by HAL apparently used for idleing? What
is WRMSR, READ_PORT_BUFFER_UCHAR, READ_PORT_ULONG and READ_PORT_USHORT and
why do they use so many CPU cycles just for copying files?

I have no idea where to go from here! :-(

Any ideas or suggestions would be much appreciated!

Let me know if you need additional info.

[Woolbox]

Anyone?

Update: Tried uninstalling McAfee antivirus, but it didn't help.

"Woolbox" wrote:

> Dear Experts! :-)
>
> I've been troubleshooting performance problems on a particular server for a
> few days now and cannot quite figure this one out.
>
> Environment
> * The server used to be a physical one, was virtualized using VMWare
> Converter and now running on VMWare Server 1.0.6.
> * Host machine runs on Windows Server 2003 R2 Enterprise with SP2 and
> has two dual-core Intel 3.2 GHz processors and has 8 GB RAM
> * Host machine currently hosts the problematic server only
>
> Symptoms and attempts to resolve
> When copying (larger) files from the server, approx. CPU utilization rises
> to 50%, slowing down the server.
>
> Process Explorer reveals that the offending process is "System", under which
> "srv.sys!WorkerThread" consumes the majority of CPU ressources.
> Ran KernRate (Kernrate_i386_XP.exe -s 5 -j
> srv**http://msdl.microsoft.com/download/symbols) which showed to modules
> consuming approx. 50% each of the total consumption: "intelppm" and "hal".
>
> Disabled the IntelPPM service and rebooted. Then ran KernRate again, zooming
> into the "hal" module (Kernrate_i386_XP.exe -s 5 -j
> srv**http://msdl.microsoft.com/download/symbols -z hal -f). Here is the top
> modules under the "hal" module:
>
> ----- Zoomed module hal.dll (Bucket size = 16 bytes, Rounding Down) --------
> Percentage in the following table is based on the Total Hits for this Zoom
> Module
> Time 1332 hits, 25000 events per hit --------
> Module Hits msec %Total Events/Sec
> HalProcessorIdle 737 5000 23 % 3685000
> WRMSR 737 5000 23 % 3685000
> READ_PORT_BUFFER_UCHAR 482 5000 15 % 2410000
> READ_PORT_ULONG 482 5000 15 % 2410000
> READ_PORT_USHORT 482 5000 15 % 2410000
>
> (the rest of the modules are 2% or less)
>
> I've tried adding a second virtual CPU, switching HAL between Standard PC,
> MPS and ACPI to no avail.
>
> Why is 1/4 of the cPU cycles used by HAL apparently used for idleing? What
> is WRMSR, READ_PORT_BUFFER_UCHAR, READ_PORT_ULONG and READ_PORT_USHORT and
> why do they use so many CPU cycles just for copying files?
>
> I have no idea where to go from here! :-(
>
> Any ideas or suggestions would be much appreciated!
>
> Let me know if you need additional info.