Hello folks! I am Madhurjya and today I am going to talk about an issue that I recently worked upon; it was related to "Windows Search" - so here's what my customer's problem was:
The Microsoft Windows Search functionality on multiple windows 7 systems was failing in his environment, the indexing never completed and he was unable to search for new items. So, from
this statement it looked like the windows search database itself was not corrupt but for some reason the indexing process (searchindexer.exe) failed to add new items into its database and complete the indexing process. The question now was - what was preventing it?
Windows search by design runs as a low priority process and it was intentionally designed that way to ensure that it doesn’t impact the user experience and overall responsiveness of the
system. On a typical client system the foreground processes needs to be prioritized in order to deliver a smooth user experience -- I bet, none of us wants the searchindexer.exe process to kick in and consume CPU cycles when we are playing those blockbuster games on our PCs ;) – so “Windows Search” runs as a background process quietly doing its job when the system is relatively idle.
As it was a pressing problem for the customer, I first suggested him the temporary workaround of disabling "indexer backoff". As there were thousands of user’s systems affected throughout the organization we pushed the “Disable indexer backoff” policy using a GPO.
We can also use the below registry entry to disable Indexer backoff on a system:
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gathering Manager
DWORD: DiableBackoff
Value: 1
Once the policy was in place I verified that indexing completes and it was able to index new items. At this stage, as disabling indexer back off allowed indexing to complete, I knew that
there's most likely a process(s) running on the systems, that’s CPU cycles and was resulting in a indexer back off (as by default its designed that way)
To nail down the problem, all I needed was a perfmon log to check the resource usage on the system over a period of time, I collected perfmon logs from few of the affected machines and
started analyzing it; what I found was what I expected -- in all the perfmons I could see that a process spiked on and off throughout the log at random and monopolized the CPU cycles, although the duration of these spikes were not very long, (it spiked for around 10 - 15 secs) but that’s enough to backoff the indexing process on the systems; so the searchindexer.exe process used to back off and the indexing never completed as the system was already high on CPU usage due to these spikes. The culprit here was the process that was spiking CPU. I binged for the process name and found that it’s an antivirus process, I found numerous articles on the Internet that talked about high CPU usage being caused by this process.
To confirm, I checked the perfmons from couple of more systems and in each one of them I saw the same behavior, this was enough evidence and we were able to provide the customer the
necessary data to engage the application vendor to investigate the problem further. I suggested the customer to set the “Disable indexer backoff” policy to default (Disabled) once high CPU usage for the offending process is rectified as disabling indexer backoff can impact system performance.
That’s all for today,
see you next time :)