We have been seeing 100% CPU usage by the HealthService.exe, I watched this process using Procmon and it seems to be when the HealthService is reading in the management pack XML files in C:\Program Files\System Center Operations Manager 2007\Health Service State\Management Packs\ for every 2k read of the XML file it is doing 40 registry operations, for some manangement packs (Exchange and ISA) these XML files are over 10MB in size, which is a lot of registry operations.
The reg keys/values being accessed are as follows:-
241245 14:16:37.8303590 HealthService.exe 10336 ReadFile C:\Program Files\System Center Operations Manager 2007\Health Service State\Management Packs\Microsoft.Exchange.2007.{4BF99177-714F-AA15-C59A-ABD5C15FDC78}.{7D625363-7C19-B887-5A4A-EA4B86265DC6}.xml SUCCESS Offset:
9,496,948, Length: 2,038
241246 14:16:37.8304162 HealthService.exe 10336 RegOpenKey HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 SUCCESS
241247 14:16:37.8304334 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001\Name SUCCESS Type: REG_SZ, Length: 80, Data: Microsoft Strong Cryptographic Provider
241248 14:16:37.8304436 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001\Name SUCCESS Type: REG_SZ, Length: 80, Data: Microsoft Strong Cryptographic Provider
241249 14:16:37.8304541 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001\Name SUCCESS Type: REG_SZ, Length: 80, Data: Microsoft Strong Cryptographic Provider
241250 14:16:37.8304639 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001\Name SUCCESS Type: REG_SZ, Length: 80, Data: Microsoft Strong Cryptographic Provider
241251 14:16:37.8304746 HealthService.exe 10336 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 SUCCESS
241252 14:16:37.8304898 HealthService.exe 10336 RegOpenKey HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider SUCCESS
241253 14:16:37.8305059 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Type SUCCESS Type: REG_DWORD, Length: 4, Data: 1
241254 14:16:37.8305169 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path SUCCESS Type: REG_SZ, Length: 22, Data: rsaenh.dll
241255 14:16:37.8305268 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path SUCCESS Type: REG_SZ, Length: 22, Data: rsaenh.dll
241256 14:16:37.8305371 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path SUCCESS Type: REG_SZ, Length: 22, Data: rsaenh.dll
241257 14:16:37.8305470 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path SUCCESS Type: REG_SZ, Length: 22, Data: rsaenh.dll
241258 14:16:37.8305746 HealthService.exe 10336 RegOpenKey HKLM\Software\Microsoft\Cryptography SUCCESS
241259 14:16:37.8305893 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid SUCCESS Type: REG_SZ, Length: 74, Data: 18baea45-2456-4bf9-95da-637b783bcf1f
241260 14:16:37.8305986 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid SUCCESS Type: REG_SZ, Length: 74, Data: 18baea45-2456-4bf9-95da-637b783bcf1f
241261 14:16:37.8306080 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid SUCCESS Type: REG_SZ, Length: 74, Data: 18baea45-2456-4bf9-95da-637b783bcf1f
241262 14:16:37.8306170 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid SUCCESS Type: REG_SZ, Length: 74, Data: 18baea45-2456-4bf9-95da-637b783bcf1f
241263 14:16:37.8306295 HealthService.exe 10336 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography SUCCESS
241264 14:16:37.8306448 HealthService.exe 10336 RegOpenKey HKLM\Software\Microsoft\Cryptography\Offload NAME NOT FOUND
241265 14:16:37.8306677 HealthService.exe 10336 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider SUCCESS
241266 14:16:37.8306977 HealthService.exe 10336 RegOpenKey HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 SUCCESS
241267 14:16:37.8307143 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001\Name SUCCESS Type: REG_SZ, Length: 80, Data: Microsoft Strong Cryptographic Provider
241268 14:16:37.8307244 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001\Name SUCCESS Type: REG_SZ, Length: 80, Data: Microsoft Strong Cryptographic Provider
241269 14:16:37.8307350 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001\Name SUCCESS Type: REG_SZ, Length: 80, Data: Microsoft Strong Cryptographic Provider
241270 14:16:37.8307449 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001\Name SUCCESS Type: REG_SZ, Length: 80, Data: Microsoft Strong Cryptographic Provider
241271 14:16:37.8307557 HealthService.exe 10336 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 SUCCESS
241272 14:16:37.8307708 HealthService.exe 10336 RegOpenKey HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider SUCCESS
241273 14:16:37.8307871 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Type SUCCESS Type: REG_DWORD, Length: 4, Data: 1
241274 14:16:37.8307980 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path SUCCESS Type: REG_SZ, Length: 22, Data: rsaenh.dll
241275 14:16:37.8308079 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path SUCCESS Type: REG_SZ, Length: 22, Data: rsaenh.dll
241276 14:16:37.8308182 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path SUCCESS Type: REG_SZ, Length: 22, Data: rsaenh.dll
241277 14:16:37.8308283 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path SUCCESS Type: REG_SZ, Length: 22, Data: rsaenh.dll
241278 14:16:37.8308561 HealthService.exe 10336 RegOpenKey HKLM\Software\Microsoft\Cryptography SUCCESS
241279 14:16:37.8308709 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid SUCCESS Type: REG_SZ, Length: 74, Data: 18baea45-2456-4bf9-95da-637b783bcf1f
241280 14:16:37.8308801 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid SUCCESS Type: REG_SZ, Length: 74, Data: 18baea45-2456-4bf9-95da-637b783bcf1f
241281 14:16:37.8308895 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid SUCCESS Type: REG_SZ, Length: 74, Data: 18baea45-2456-4bf9-95da-637b783bcf1f
241282 14:16:37.8308986 HealthService.exe 10336 RegQueryValue HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid SUCCESS Type: REG_SZ, Length: 74, Data: 18baea45-2456-4bf9-95da-637b783bcf1f
241283 14:16:37.8309141 HealthService.exe 10336 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography SUCCESS
241284 14:16:37.8309307 HealthService.exe 10336 RegOpenKey HKLM\Software\Microsoft\Cryptography\Offload NAME NOT FOUND
241285 14:16:37.8309542 HealthService.exe 10336 RegCloseKey HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider SUCCESS
Is there any reason for this much registry traffic just to read 2k of an XML file?
We are running SCOM 2007 (6.0.6278.0), it appears to hit the VMWare servers a lot harder than the physical servers. It happens on 2003/2008 servers, I have looked at the KB article for the MSXML hotfix but this is an older dll than we currently have installed.