Last post Oct 18, 2019 01:41 AM by lextm
Oct 16, 2019 12:14 PM|mathieu.lutun|LINK
I ran into an issue with my API generating a huge CPU load of lsass.exe. The environment :
In order to investigate it, I created a new ASP.NET Core website using the default template (`dotnet new web`). I updated Kestrel configuration to look like this :
public static IHostBuilder CreateHostBuilder(string args) =>
webBuilder.ConfigureKestrel((context, options) =>
options.AddServerHeader = false;
options.Listen(IPAddress.Any, 5001, listenOptions =>
listenOptions.UseHttps(StoreName.My, "*.mycertificate.domain", false, StoreLocation.LocalMachine);
Alongisde this website, i created a load test using JMeter in order to hit the website with this load :
When running the test browsing the homepage of the website, the result is having the lsass.exe process to heavily use the CPU close the 100%.
I ran others tests using those configurations and the result is still the same
- Kestrel using different ways to load the certificate
- IIS using InProcess website with a https binding on the certificate
Any ideas on how to configure properly https on aspnet-core to create a heavy load API ?
Thanks for your help
Oct 17, 2019 03:21 AM|Lewis Lu|LINK
High LSASS.exe CPU utilization can be caused by many different single or combined issues.You could use the Active Directory Data Collector tool which assists in determining what the problem cause is in Windows Server 2008 and late.
Oct 17, 2019 08:11 AM|mathieu.lutun|LINK
Unfortunately, our server is standalone wihtout any connection to an AD. Only local accounts are used when launching the app using kestrel in a console or IIS using the default app pool identity
Here is the list of roles and features enabled on the server :
Oct 18, 2019 01:41 AM|lextm|LINK
As lsass.exe works on several part of HTTPS sessions, it is not trivial to tell what exactly happens without things like dump analysis. Possible causes can be related to the certificate you use (some certificates require more processing than others), but
that's only one of the many possibilities.