ashdisp.exe kiils my cpu

Avast Business Avast Server Protection
1

I use AVAST server on server 2003 as Terminal Server
some times a proccess named ashdisp.exe takes all the cpu he can get and destroy all the work on the terminal by slowing him down (100% cpu), when I kill this proccess the clients can get back to work.

what can I do to stop it ?

2

How many ashDisp.exe’s are there running on the machine when the problem occurs?
And, are you able to re-simulate the problem?

Thanks
Vlk

3

at list two, on seperated users.

4

OK, and only one of them takes up the CPU?

Also, are you still able to simulate the problem?

Thanks
Vlk

5

sometimes only one and sometime both of them
and it happening few times over the day

6

Do you think you could create a memory dump of the aswDisp.exe process when the problem is happening (i.e. it’s taking 100% CPU)?

To create the dump, please follow these steps:

userdump.exe aswDisp.exe c:\aswdisp.dmp

(or, use the PID [Process ID] if the aswDisp.exe instance that’s causing the problem)

  • the previous step creates file c:\aswdisp.dmp. ZIP this file (name it e.g. aswdisp-dump.zip) and upload it to ftp://ftp.avast.com/incoming .
    Please note that you don’t have READ access to the ftp server (only WRITE) - meaning that you won’t be able to verify the upload (you won’t even see the file listed).

BTW to make things a bit more responsive, it’s usually useful to give the offending process “Low” priority (right-click it in the Task Manager, and choose Set Priority → Low).

Thanks
Vlk

7

it’s done ,
by the way, each user open this proccess, and take around 30mb of memmory each.
and from timt to time one or teo proccess geting crazy and consume all the cpu they can.

thanks.

8

Hi nomis,

and thanks for the dumps.

The problem is, it really doesn’t seem the process was taking CPU (i.e. was doing anything) at the time the dumps were taken. All threads are idle!
Are you sure you captured dumps from the processes that were really using the CPU?
Did you use “aswDisp.exe” on userdump’s command-line, or rather the PID?

by the way, each user open this proccess, and take around 30mb of memmory each.

This is not entirely correct… The 30MB consumption is only forced after performing the memory dump, unless you do so, aswDisp’s working set is quite conservative (typically ~5MB)

Thanks
Vlk

9

I couldnt catch the problem alive. sorry.

10

So it only takes a couple of seconds?

11

no it keeps eating my cpu until in end the proccess

12

So… it shouldn’t be a problem to generate the dump at the moment the problem is happening, right? (unless I’m missing something here).

Thx
Vlk

13

new dump is uploded right now.

14

Hmm, nothing (again)… :-\ >:(

15

how could it be nothing ? it takes 50% of my cpu ?

16

They’re just saying that into your dump, unfortunately, there isn’t any info related to ashdisp.exe being using 50% of the CPU. They’re not saying that the problem does not exist.

17

maybe becouse the dump is only on my session and not other users on the terminal server

18

i’ve uploaded a picture of the task manager showing the cpu to your FTP

19

How are you generating the dumps, exactly?
Using the process name (ashDisp.exe) or process ID?

Process ID would be better - as you’re running multiple instances of the program. Maybe userdump is generating dump for the other copy.

To use the process ID, first enable its display in the Task Manager (View → Select Columns and check the “PID” box). The will allow you to see the ID of the offending process. The run userdump as follows

userdump.exe 1234 c:\aswdisp.dmp

(replace 1234 by the real Process ID of the ashDisp.exe process).

Cheers
Vlk