Jump to content

How to get the cause of high CPU usage by DPC / Interrupt

Recommended Posts

How to get the cause of high CPU usage by DPC (Deferred Procedure Call) and interrupts?

Ok, you found this guide, because you see this:


in Process Explorer/Hacker or you run the DPC Latency Checker tool an see this:


(Attention: If you use Windows 8, don't use the "DPC Latency Checker tool". Due to internal Kernel changes in Windows 8, the "DPC Latency Checker tool" shows DPC spikes of over 1000µs all other the time. Those VALUES are not correct!)

The developers of the tool try to create a Windows 8 compatible version.

Here I will tell you a ) to see which driver causes the high CPU usage and b ) which driver causes the spikes.

To get started you need the Windows Performance Tools Kit. Read here how to install it:


Now open a command prompt with admin rights (http://windows.microsoft.com/en-US/windows7/How-do-I-run-an-application-once-with-a-full-administrator-access-token), go to C:\temp (cd\temp) and run the following commands:

xperf -on latency -stackwalk profile

now wait a time while the high DPC and Interrupt usage occurs.

to stop the trace run the following command:

xperf -d DPC_Interrupt.etl

This closes the trace and writes the result to the file DPC_Interrupt.etl.

In the next step, make a double click on the etl file to run the Viewer.

Now wait until the 2 passes are over.

Go to "Trace"->"Configure Symbol Paths" and type in the following:


Click ok, to close the dialog.

Now go to the graphs "DPC CPU Usage" or "Interrupt CPU Usage" (depending where you high CPU usage) and select the intervall, make a right click and select "Load Symbols" and next click summary table.


Now, you have to accept the license agreement to download the public debugging symbols.


Here you'll see summary of the calls


For me the cause is the NDIS.sys. This is a part of the networking system. The usage comes for me, when I have nearly 100% network speed usage on my 100MBit LAN adapter of my notebook.

In your case, you should see the driver which causes the issues.

An alternative way is to use the xperf commandline tool to dump the values into a text file:

xperf -I DPC_Interrupt.etl -a dpcisr > dpc.txt

Open the generated dpc.txt with notepad. Under CPU Usage Summing By Module For the Whole Trace you can see a summary of all DPC usage for each CPU core. Look here which driver is causing the high CPU usage.

Look in the dumped text files for µsec values which are over 256µsec. They can be critical.

An alternativ to xperf is the tool LatencyMon


It shows you the same statistic you see in the text file, but it shows you the values in realtime. So you can see which driver is the cause.

You can download this tool from here:


If the NDIS.sys driver is shown as possible cause, check your (W)LAN drivers for updates. For usbport.sys, check your chipset and USB device drivers for updates. if you see ACPI/HAL you may run into power saving feature issues. So update the BIOS and change the Power Plan in Windows.

To see which driver versions you use run this command:

xperf -I DPC_Interrupt.etl -a fileversion > fileversion.txt

Now open the fileversion.txt and look for the driver version you use. Do a Bing/google search if you can find updated drivers.

If you see UNKNOWN as cause you run drivers which use dynamic code. 1 known driver which uses such dynamic code is the DuplexSecure SPTD driver which is used in tools like DAEMON-Tools. If you see the UNKNOWN as a possible cause look if you have the SPTD driver installed. If yes, download the latest installer, run the installer and select "Uninstall" and reboot. Now run the xperf commands again and look if you see the real driver.

Ok, I hope, this helps you to determine which driver is causing high DPC, interrupt usage and spikes which causes sound glitches.

Edited by MagicAndre1981
Link to comment
Share on other sites

  • 1 month later...


Thank you very much for this post. I had a very similar problem and used your instructions to identify the problem.

In my case, Win7 automatically updated a driver for an I/O card and there were conflicts with the IRQ's. I had suspected the driver update as it occurred about the same time that I noticed the high (30%) CPU usage. But I had no idea how to check or confirm until reading your post.

Vielen Dank! :thumbup


Link to comment
Share on other sites

  • 3 weeks later...

MagicAndre, excellent tutorial. However, when I got the table, the module that was eating up all my CPU was "Unknown", and the function was "0xfffffa80076e15a0". This was in the Interrupt CPU Usage Table.

In the DCP CPU Usage table, the big boy was a very similar process; Module "Unknown", and function "0xfffffa80076e10a0".

Do you have any insight? I would attach the ELT, but it's 54 megs...

Link to comment
Share on other sites

Hello Andre,

First of all, thanks so much for your help.

Here is my problem:

I am running a Core 2 Duo E6300 on a Intel DG965WH motherboard, I recently switched up some components and move the computer over to a new case and the high CPU usage started happening.

I've ran everything you have suggested and found out that my high CPU usage was caused by a module called intelppm.sys with a function called C1Halt.

I searched it up and it seems like the intelppm.sys is the processor driver, I know I can't disable that. So what should I do at this point?



Link to comment
Share on other sites

Do you have Deamon Tools installed? If yes, remove them and make a new trace if you still have the issue.

I had Deamon Tools, but I removed it when I read that some people found that DT was slowing their computers. In any event, my computer was sluggish before I installed DT, so I can only infer that its not a result of DT. In fact, when I first installed Windows 7, I only had 3 gigs of RAM in, and I was so sick of the sluggishness that I upped it to 8 gigs (all new chips).

Edited by Ogiwan
Link to comment
Share on other sites

I've ran everything you have suggested and found out that my high CPU usage was caused by a module called intelppm.sys with a function called C1Halt.

is the C1Halt function called from the Idle process? If yes, this nothing you should worry about. This is a powersaving feature of CPUs (http://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface).

I had Deamon Tools, but I removed it when I read that some people found that DT was slowing their computers.

ok, because I can't see which driver is causing this you must use the old "try and look" way be running a clean boot:


Does a Clean boot help? If yes, a driver from your application is causing it.

Edited by MagicAndre1981
Link to comment
Share on other sites

A clean boot doesn't seem to help; function "0xfffffa80077005a0" is still 30% in the "Actual Duration" column, and it still doesn't know what it is.

I'm not reading that wrong, am I? It's not the "system idle" process under a cunningly concealed name, right? The next greatest usage is hal.dll, but that only comes in at a palty .09 "% Actual Duration". I can't see how that would affect performance.

Link to comment
Share on other sites

Thanks for this brilliant article! It helped us tracking down high CPU usage on HP 6930p and HP 2530p series notebooks. In our case, the driver was


which indicates outdated graphic card driver. For all HP 6930p / 2530p users with Intel graphic chip-sets: It's a good idea to use the original Intel drivers and not the HP branded ones - the latter ones are outdated and my cause this high CPU usage behavior (at least on Vista 64 bit)

best regards,


Edited by preisl
Link to comment
Share on other sites


I have followed your guide in an attempt to solve a similar issue on my PC. I am running Windows 7 (x64) with an AMD Phenom 8450 Triple-Core Processor. After going through the steps you have outlined, I have discovered that my issue is with usbport.sys.

In your guide you mention to update the chipset drivers to solve this problem. I must admit that I am not entirely sure how to do this. In the meantime, I have gone into Device Manager and checked for driver updates on every hardware component listed and the problem has still not been alleviated. Any assistance that you can provide in leading towards a solution to this problem would be greatly appreciated.


Link to comment
Share on other sites

Hi Andre, I got to say that you wrote a pretty easy to follow article. I'm not expert computer tech but I need to understand certain things in case things go wrong as I work with pro audio. I actually started my thread over at http://social.answers.microsoft.com/Forums/en-US/w7performance/thread/94a81980-94df-4341-9d85-50611921c011 . To make a long question short, I use a DAW called Sonar8 and I get the occasional dropout, but with my system specs it doesn't make much sense, the frequency is way to often.

I followed you're instruction on how to find the cause of high cpu usage. i completed it but I would like to also know where does the DPC_Interrupt.etl get saved I found mine in '' C:\ '' and it was named Kernel not DPC_Interrupt.etl. Is there a way to name it something else? or put it on the desktop initially during it's creation?

I don't understand the stats very well, it seems like under Interrupt CPU usage- Module -'' Wdf01000.sys '' is to blame the odd thing is that it goes to about 11% actual Duration, but the audio dropout happens 50 seconds later.

I saved what I believe to be a representation of the issue, can you have a look and confirm there is a problem with DPC or anything else. Thanks. Also Im sorry if im posting in the wrong forum.

im not able to upload my file so i post it here for upload , thanks http://www.sendspace.com/file/t5eaaa

Edited by sounds
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...