I have a SQL Server 2005 Enterprise Edition on a Windows Server 2003 Enterprise sp2.
Lately, I get very high I/O(Reda, Write, Other in Task Manager) from process lsass.exe. When I run sysinternals' process monitor on lsass.exe, I get a lot of activity related to SQL Server process. It seems it repeats a pattern of IRP_MJ_CREATE, IRP_MJ_DIRECTORY_CONTROL, IRP_MJ_CLEANUP and IRP_MJ_CLOSE by requests from sql server.
Any suggestions on the cause?
Lsass.exe high I/O with SQL Server 2005 sp3
iosql-server-2005
Best Answer
LSASS is the Local Security Authority process. LSASS does any work only as a result of security related activity occurring on other processes. A high amount of lsass.exe activity would indicate perhaps a high number of authentication (Kerberos, NTLM) events occurring.
Forget about Task Monitor or Process Monitor. Fire up Perfmon and look at the performance counters if you want to troubleshoot a problem. Get all counters/all instances for the Process category to identify which process consumes CPU/Memory/IO. I would be quite surprised to hear that lsass is truly a performance bottleneck.
I'd recommend you follow the Waits and Queues troubleshooting methodology to understand why you experience problems at peak hours. It's a proven methodology with an stellar track record on identifying problem root cause.