WSUS SUP causes high CPU and clients fail updates scan

NOTE: The configuration suggestions I mention in this post won’t fix the underlying issue. Depending on the size of your environment they may be enough to get things working for you again. Microsoft is currently working on releasing a hotfix that I have tested and found to resolve this problem

 

Microsoft have released the WSUS server hotfix, details here: https://blogs.technet.microsoft.com/configurationmgr/2017/08/18/high-cpuhigh-memory-in-wsus-following-update-tuesdays/

NOTE2: It turns out there is a new issue from the August 2017 updates that “clears” the update history on a computer that will trigger a full client scan again. This will also cause high load on your WSUS server, although for slightly different reasons, however the suggestions here and the coming updates will help to resolve the load issue from that problem as well.

Microsoft have updated the August cumulative updates to resolve this issue, details here: https://support.microsoft.com/en-us/help/4039396/windows-10-update-kb4039396

 

NOTE3: Microsoft has now published some additional official guidance here: https://blogs.technet.microsoft.com/askcore/2017/08/18/high-cpuhigh-memory-in-wsus-following-update-tuesdays/

This issue is one I first encountered on only a couple of our WSUS servers (2 or 3 of 15 servers) last year in November 2016 after the new cumulative update process was introduced for patching. At first I assumed it to be a failure on my part to do more regular cleanup, or a result of the recent upgrade to ConfigMgr 1610, or an “end of year” rush of activity on the network. This isn’t unusual for the environment I currently manage (Education with approx. 370,000+ devices)

At first I looked at server bottlenecks (we run everything in VMWare) and even SQL DB corruptions. I tried doing WSUS resets, even recreating the database (this is a last resort in a large environment). I then thought maybe it was a Server 2012 WSUS issue as we had other Server 2012 related cases open with Microsoft. To test I rebuilt one server as 2012R2, but the problems persisted. Given it was only happening on a couple of server I assumed it was an issue with those servers in particular and didn’t suspect a larger issue.

Over the Christmas holidays things went quite, so there was nothing more I could do until school returned the following February.

Then everything basically exploded.

The first patch cycle we ran saw the WSUS server rocket to 100% CPU and stay there. Nothing I did could stop this reoccurring. I found ways to bring things under control for a few hours at a time. Endpoint definitions started falling behind because clients couldn’t scan for updates. Then it started happening on a couple more of the servers. At this point I conceded defeat and called in Microsoft. Unfortunately it was another 6 months before they finally identified it was a “function” of WSUS causing the grief and not the configuration or size of our environment.

The Problem

The most obvious symptoms will be clients failing to scan for updates and the WSUS server CPU (w3wp.exe) going very high. Some clients get through, many will fail. The main cause will be Windows 10 clients and the way WSUS has to process the Cumulative Updates.

No input file specified – Windows Server 2012 Deduplication on IIS with php

My gaming clan forums started throwing a rather annoying random error recently and I couldn’t figure out what had changed to cause it. Essentially a page saying only “No input file specified.”

My forums are running phpBB on Server 2012 running IIS with (of course) php installed. The message would just randomly appear when posting replies to messages, or searching for new topics. It didn’t always happen, and clicking refresh would then load the page fine. I tried re-installing php, upgrading to a newer php and “tweaking” settings in the php.ini file. No difference.

Looking in the IIS logs would show a 404 error returned, hitting refresh (maybe a couple of times) usually returned a 200 and loaded the page. The file being loaded was present and everything seemed to be in order.

Remote management of IIS from Windows 8

Got Windows 8? Yup

Got a Server somewhere running IIS? Yup

Got the IIS management feature install on Win8? Sure have

So you open it, connect to the remote IIS server and all is cool? Um……

Go figure. When you install the IIS management feature in Win8, the *only* thing you can manage is a local install of IIS. It doesn’t give the option to connect to another server at all. Thinking I’d stuffed it up somehow (using the mouse with my left hand instead of right perhaps?) I removed and re-added it, but still the same. No remote connect option!