We are in the process of trying to deploy Topbeat, Filebeat, and WinLogBeat in our Windows-based web hosting environment. When the Topbeat service is running, one core of our servers is completely consumed by the WMI Provider Host (WmiPrvSE.exe). I feel fairly confident saying that Topbeat is the culprit causing this activity in the WMI process because the high CPU utilization is highly correlated with starting the Topbeat service. When the service is stopped the box returns to it's usual, low level of CPU activity.
The performance impact is more pronounced in our Server 2008R2 environments compared to our Server 2012R2 environment but i see the effect on both versions of the OS.
These are the things I've attempted to reduce the performance impact of the Topbeat agent:
- Increase the polling interval - I set the "period" in the config file to values as high as 5 minutes (300 seconds) with not much impact. I also expected the high CPU to occur periodically on the same interval as the collection period, but this was not the case.
- disabled file system stats - This data isn't terribly important to us so I tried setting "filesystem" to false, but this had no effect.
- disabled individual process stats - We are VERY interested in this data, but wanted to see if disabling it had any impact on the CPU impact of the service.
- disabling SCOM health agent - In the thought that there was some contention between the two monitoring services I tried disabling the SCOM health agent. This didn't change the CPU activity.
Do any other members of the community have experience deploying topbeat on Windows servers? I guess what I'm trying to determine is if this high WMI CPU utilization is related to a quirk of our environmental configuration or a conflict with another service running on these boxes.