Help Center> Elastic Cloud Server> Troubleshooting> General Issues> Why Is My Windows ECS Running Slowly?
Updated on 2023-03-03 GMT+08:00

Why Is My Windows ECS Running Slowly?

If your ECS runs slowly or is disconnected suddenly, the possible causes are as follows:
  • Your ECS is a shared ECS.

    Multiple ECSs share CPU resources. When resources are insufficient, ECSs may contend for CPU resources, causing slow responses.

  • The bandwidth or CPU usage of the ECS may be excessively high.

    If you have created an alarm rule using Cloud Eye, the system automatically sends an alarm to you when the bandwidth or CPU usage reaches the threshold specified in the rule.

If your ECS is a shared ECS, perform the following steps:
  1. Fault locating: Check the instance type. For details about dedicated and shared ECSs, see ECS Types.
  2. Troubleshooting: If you have high requirements on service stability, you are advised to change a shared ECS to a dedicated ECS by referring to General Operations for Modifying Specifications.

To handle this issue, perform the following operations:

  1. Fault locating

    Identify the processes leading to high bandwidth or CPU usage.

    Windows offer multiple tools to locate faults, including Task Manager, Performance Monitor, Resource Monitor, Process Explorer, Xperf (supported by versions later than Windows Server 2008), and full memory dump analysis.

  1. Troubleshooting
    Check whether the processes are malicious and handle the issue accordingly.
    • If the processes are not malicious, optimize them or modify ECS specifications.
    • If the processes are malicious, stop these processes manually or use a third-party tool to stop them automatically.

Fault Locating

  1. Log in to the ECS using VNC available on the management console.
  2. Start the Run dialog box, and then enter perfmon -res.
    Figure 1 Starting the Resource Monitor
  3. On the Resource Monitor page, click the CPU or Network tab to view the CPU or bandwidth usage.
    Figure 2 Resource Monitor
  4. Obtain the IDs and names of the processes with high CPU or bandwidth usage.
  5. On the remote login page, click Ctrl+Alt+Del to start the Windows Task Manager.

    Alternatively, start the Run dialog box and enter taskmgr to start the Windows Task Manager.

    The following describes how to display PIDs in Windows Task Manager, locate a process, and check whether it is malicious.

    1. Click the Details tab.
    2. Click PID to sort the data.
    3. Right-click the process with high CPU or bandwidth usage and choose Open File Location from the shortcut menu.
    4. Check whether the process is malicious.
      Figure 3 Checking the process


Before the troubleshooting, check whether the process leading to the high CPU or bandwidth usage is malicious, and then take measures accordingly.

Suggestions for non-malicious processes

  1. If your ECS runs Windows Server 2008 or 2012, ensure that the available memory is 2 GB or larger.
  2. Check whether Windows Update is running on the backend.
  3. Check whether the antivirus software is running scan tasks on the backend.
  4. Check whether any applications requiring high CPU or bandwidth are running on the ECS. If so, modify ECS specifications or enlarge bandwidth.
  5. If the ECS configuration meets the application requirements, deploy applications separately. For example, deploy the database and applications separately.

Suggestions for malicious processes

If the high CPU or bandwidth usage is caused by viruses or Trojan horses, manually stop the affected processes. You are advised to troubleshoot the issue as follows:

  1. Use the commercial-edition antivirus software or install Microsoft Safety Scanner to scan for viruses in security mode.
  2. Install the latest patches for Windows.
  3. Run MSconfig to disable all drivers that are not delivered with Microsoft and check whether the fault is rectified. For details, see How to perform a clean boot in Windows.
  4. If the ECS or site encounters a DDoS or CC attack, and a large number of access requests are generated within in a short period of time, log in to the management console and perform the following operations:
    • Check whether Anti-DDoS has been enabled and whether the protection rules are proper. To configure a protection rule, see Enabling Anti-DDoS.
    • Check whether CC attack protection has been enabled and whether the protection rules are proper. To configure a protection rule, see Configuring CC Attack Protection Rules.