locked
Huge RAM and CPU by Local Security Authority Process

    Question

  • I think, it's not normal behavior:

    Am I right? :)

    It begins after some time of using WinDP (half an hour, or earlier, or lately) and does not stop till reboot. Sometimes RAM for this process reaches 1G and I can't even work on this machine.

    Any ideas?

    Tuesday, October 04, 2011 11:50 AM

All replies

  • Install the ADK (Windows Performance Toolkit), run WPRUI and start the trace. If the issue occurs again save the trace and upload it.
    "A programmer is just a tool which converts caffeine into code"

    Wednesday, October 05, 2011 5:23 PM
  • Where can I download the ADK? I've found only for MSDN subscribers...
    Thursday, October 06, 2011 6:27 AM
  • Yes, the ADK is currently only for MSDN subscribers.

    Try to install the WPT from Windows 7 and .net 4.0 SDK and run this command from a CMD with admin rights

    xperf -on latency+MEMINFO+CONTMEMGEN -stackwalk profile+ContiguousMemoryGeneration -MaxFile 1024 -FileMode Circular && timeout -1 && xperf -d latency.etl
    


    After you got the issue, stop the trace and compress the latency.etl and upload it.


    "A programmer is just a tool which converts caffeine into code"

    Thursday, October 06, 2011 6:28 PM
  • I've uploaded file here: http://www.fileconvoy.com/dfl.php?id=g630124a4adea90fa67287202484d090fd7d56

    The xperf was launched after system startup and nothing was done with the system (used no programs except Task Manager). After approx. 8 minutes of this tracing the Local Security Authority Process' resources began to grow up. I've stopped tracing when RAM for this process reached 30MB and was still growing up. By the time I'm writing this message it "eats" already more than 600MB of RAM.

    Friday, October 07, 2011 9:16 AM
  • what's the password?
    "A programmer is just a tool which converts caffeine into code"

    Friday, October 07, 2011 11:40 AM
  • what's the password?
    "A programmer is just a tool which converts caffeine into code"

    Sorry, forgot to write in my reply :) hugeRAM
    Monday, October 10, 2011 5:41 AM
  • I can't use the trace. I only see strange characters in xperfview.

    Google for en_windows_developer_preview_adk_x86_x64_734756.zip and install the Windows Performance Toolkit.

    Start WPRUI.exe, select the lsass.exe from the dropdown list, select under more details CPU, heap and VAlloc. Run the trace until you get the high CPU/mem usage now trace around 2 minutes and stop the trace.

    Zip all output files (plus the ngen folder) and upload them.


    "A programmer is just a tool which converts caffeine into code"

    Thursday, October 13, 2011 10:13 PM
  • After looking at the trace, it looks like the "Anti Malware" (Windows Defender for ex:) software is causing LSASS to consume CPU and memory. "Anti Malware" is known to hog memory and CPU resources. But I am not sure if it supposed to eat away 100s of MBs of memory.

     

    Anyway, can you turn off "Anti Malware" software to see if the issue goes away? Depending on the results you report, we can investigate further.

    Friday, October 14, 2011 10:26 AM
  • Start WPRUI.exe, select the lsass.exe from the dropdown list...

    There's no lsass.exe in the dropdown list...


    After looking at the trace, it looks like the "Anti Malware" (Windows Defender for ex:) software is causing LSASS to consume CPU and memory. "Anti Malware" is known to hog memory and CPU resources. But I am not sure if it supposed to eat away 100s of MBs of memory.

     

    Anyway, can you turn off "Anti Malware" software to see if the issue goes away? Depending on the results you report, we can investigate further.


    Ok, I'll try to disable Windows Defender.

    • Edited by syava_m Friday, October 14, 2011 11:55 AM
    Friday, October 14, 2011 11:53 AM
  • Disabling Defender doesn't solve the problem. Moreover now lsass begin to consume resources not after some time of working, but just after computer starts up.
    Monday, October 17, 2011 5:43 AM
  • Hello, gentlemen.

    I am experiencing similar trouble with WDM. It is leaking memory. Andre, could you please recommend how I could trace the leak. I have an access to MSDN.


    Well this is the world we live in And these are the hands we're given...
    Monday, October 17, 2011 8:10 AM
  • Download and install the ADK from MSDN subcriber page run "C:\Program Files (x86)\Windows Kits\8.0\Windows Performance Toolkit\WPRUI.exe", select "Entire System" (selecting lsass.exe doesn't work) and select under "More options" ->"Resource Analysis" "CPU usage" and "VAlloc usage" and press start. Now run the trace until you get the high CPU/Mem usage of lsass.exe and stop the tarce by clicking on "Save". Post the issue you have (lsass.exe  consumes high CPU/Mem usage) and save the trace. Use 7-Ziup to compress the ETL + ngen folder as 7z (ULTRA + LZMA2) and upload the 7z file to your public SkyDrive folder and post a link here:

    http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65


    "A programmer is just a tool which converts caffeine into code"

    Saturday, October 22, 2011 3:57 PM
  • Posted a link to my dump here http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
    Monday, October 24, 2011 6:03 AM
  • run it longer. I only see the is uses 5MB to to some RPC calls.
    "A programmer is just a tool which converts caffeine into code"

    Tuesday, November 01, 2011 4:19 PM
  • I've stopped tracing after lsass process reached about 30-40MBs of memory (don't remember exactly - many days have gone). Don't know why it shows only 5M... I'll try to record once more.
    Wednesday, November 02, 2011 12:46 PM