Hello all,

 We have several SQL Server boxes in our environment. Some clusters, some stand-alone. We recently noticed that the clusters which have been up for a while (a few months) are seeing an unusually high amount of CPU being used by one of the wmiprvse processes. When I say relatively high, I'm saying about 50-60% of one CPU... total CPU usage depends (of course) on how many total CPUs in the system. We are not seeing this on stand alone machines. With the performance data we've been collecting, we can see this value increasing over the past few months. All systems are Windows 2003 Ent x64 R2 SP2 with SQL Server 2005 Ent x64 SP2.

 Has anyone heard of this before? Any ideas what the problem could be?

 Thanks.

It is WMI process and you cannot kill it,  but be wary, as it's possible to be used inside a network, to monitor your processes by a sysadmin.

Also see this KBA FIX: The Wmiprvse.exe host process may stop unexpectedly when you ...

 It seems that there is a problem in the WMI provider process that WMIPRVSE service is hosting.
To discover the reason , run process explorer (you can download it from sysinternals site) , and find what the process is being runing under wmiprvse.exe

Also that problem may be due to hardware problem. Try to make a diagonestic check for Server

Thank you both for your responses.

 satya, we already tried stopping all external monitoring software that might be using WMI. It had no effect. Also, the link you gave doesn't fit our situation. We have WMI using CPU, not crashing with an access violation.

 moh_hassan20, if it was only one box, I could believe it might be a hardware problem. Unfortunately, it all of our clusters, and each cluster is made up of different hardware.

I did run process explorer to see what is running this wmiprvse process. It's tree looks like:

System --> smss.exe --> winlogon.exe --> services.exe --> svchost.exe --> wmiprvse.exe

The svchost process in the tree is running the DcomLaunch service. Any ideas?

Thanks.

The process smss.exe  is responsible for administrating session,it is one of basic windows service.
Unfortunately, it may be used by some adware/spyware virus like Dosingle Adware, Advision Adware and others.

let us exclude that assumption first .

Try to use Spyware Doctor and McAfee to scan servers  and remove these malwares (if infected)