Solved Batch and CSRSS.exe relationship?

Dell / LATITUDE D610
June 14, 2011 at 08:33:52
Specs: Microsoft Windows XP Professional SP3, 2.13GHz / 1GB
I have about 1,600 text files that have protocol analyzer information in them. I'm
looking for specific keyword(s) within the text files, using FINDSTR. It's all good;
I get the expected results. However, when I run the batch file, the Windows
process CSRSS.exe immediately starts using more CPU than when the batch
isn't run. If I cancel the batch, CSRSS.exe settles back down immediately.

The batch:

::FindType.bat
@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION

IF NOT EXIST "REQ_Types.txt" TYPE NUL>"REQ_Types.txt"
FOR %%A IN (*-*-1*.txt) DO (
    SET filename=%%A
    FOR /F "tokens=* delims=" %%B IN (%%A) DO (
        FOR /F "tokens=* delims=" %%C IN ('ECHO %%B^|FINDSTR /C:"RequestType:"') DO (
            SET string=%%C
            SET string=!string:"=!
            CALL :FindIt !filename! !string!
        )
    )
)

EXIT /B

:FindIt
SET args=%*
SET args=!args:%1 =!
FIND "!args!" < "REQ_Types.txt" > NUL
IF /I !ERRORLEVEL! EQU 1 (
    ECHO !args! >> "REQ_Types.txt"
    ECHO Filename = "%1"
    ECHO Writing to file. 
)
GOTO :EOF

The source text files (zipped): http://www.mediafire.com/?636hz9tb0...
Is there something in my batch file that seems out of the ordinary, and would cause
CSRSS.exe to ramp up it's duties?!

Further information:
I've confirmed that CSRSS.exe is running from the correct location and is not a virus
by using another batch file that uses WMIC.exe and TASKLIST to get process
information:

::Processes.bat
@ECHO OFF
SETLOCAL ENABLEDELAYEDEXPANSION
MODE CON: COLS=132 LINES=9999

FOR /F "tokens=1* delims==" %%u IN ('WMIC Process GET Name^, CommandLine^, ProcessId^, ParentProcessId /FORMAT:LIST') DO (
    IF /I "%%u" EQU "CommandLine" (
        CALL :Set_CL CommandLine? %%v
    )
    IF /I "%%u" EQU "Name" (
        CALL :Set_NM Name "%%v"
        SET Name=!Name:~0,26!
    )
    IF /I "%%u" EQU "ParentProcessId" (
        CALL :Set_PP ParentProcessId %%v
        FOR /F "tokens=1* delims=:" %%w IN ('TASKLIST /V /FO LIST /FI "PID eq !ParentProcessId!"') DO (
            IF "%%w" EQU "Image Name" ( 
                CALL :Set_NM ParentName %%x
                SET ParentName=!ParentName:~0,26!
            )
        )
        SET ParentProcessId=!ParentProcessId:~-5!
    )
    IF /I "%%u" EQU "ProcessId" (
        CALL :Set_PI ProcessId %%v
        SET ProcessId=!ProcessId:~-5!
        ECHO !ProcessId! - !Name! : !CommandLine?!
        ECHO !ParentProcessId! - !ParentName! 
        ECHO.
        SET ProcessId=
        SET Name=
        SET CommandLine?=
        SET ParentProcessID=
        SET ParentName=
    )
)

EXIT /B

:Set_CL
SET CL=%*
SET CL=!CL:%1=!
SET %1=!CL!
GOTO :EOF

:Set_NM
SET %1=%~2                         
GOTO :EOF

:Set_PI
SET %1=     %2
GOTO :EOF

:Set_PP
SET %1=     %2
GOTO :EOF

When your only tool is a hammer, every problem looks like a nail.


See More: Batch and CSRSS.exe relationship?

Report •


#1
June 14, 2011 at 10:27:40
✔ Best Answer
The csrss.exe process is involved with quite a few system activities, console windows being a major part of it's responsibilities. I expect that is the reason for it's increased CPU usage.

Report •

#2
June 14, 2011 at 11:27:04
I'm just curious why this one in particular. I have other batch files that deal with large numbers of other files, mostly on UNC paths, and csrss.exe hardly raises a brow. I would think that working with "network" files would put more strain on the Client/Server aspect of csrss.exe than a locally running batch file dealing with local files (something I omitted in the original post). I'm using a command window, changing directory to where the text files live (the batch file also lives in the same directory), and executing the batch from the command line.

Google tells me that a bad user profile can have adverse effects on csrss.exe, but the solution seems like a sledgehammer approach: Delete the profile! I don't look forward to re-doing all of the customizations I've done in my current profile if it comes down to that. I've been working on copying my (usual) profile to a new location when logged on as Administrator, but I continue to use the same old profile, despite changing the "Permitted to Use" option.

When your only tool is a hammer, every problem looks like a nail.


Report •

#3
June 14, 2011 at 16:56:19
It's not a broken profile. I created a brand new user that now has a brand new profile, and tried running the batch file. Immediately, csrss.exe jumped upto +50% CPU. I don't get it. A couple FOR loops, FIND and FINDSTR shouldn't be that complicated! I'm going to move most of the text files to a different folder to see if it's just sheer volume that's causing the problem...

When your only tool is a hammer, every problem looks like a nail.


Report •

Related Solutions

#4
June 14, 2011 at 20:35:16
So yeah, I opened Process Explorer and looked at the threads csrss.exe had, found that
CsrValidateMessageString was very active. A google search lead me to:
http://social.msdn.microsoft.com/fo... which echo's LMiller7's answer:

"An additional job of csrss.exe is to manage the console windows (cmd.exe).

You will see a high CPU spike in csrss.exe if you create a batchfile.bat with the 
following content, and start in cmd.exe with "batchfile.bat". To end the Job, close 
the window [x]. This do not describe a virus.

endless.bat content:
:LOOP
   @ECHO  looping - causes high CPU utilization in csrss.exe!CsrValidateMessageString and probably in cmd.exe
   @ECHO  looping - causes high CPU utilization in csrss.exe!CsrValidateMessageString and probably in cmd.exe
   @ECHO  looping - causes high CPU utilization in csrss.exe!CsrValidateMessageString and probably in cmd.exe
   @ECHO  looping - causes high CPU utilization in csrss.exe!CsrValidateMessageString and probably in cmd.exe
   @ECHO  looping - causes high CPU utilization in csrss.exe!CsrValidateMessageString and probably in cmd.exe
   @ECHO  looping - causes high CPU utilization in csrss.exe!CsrValidateMessageString and probably in cmd.exe
   @ECHO  looping - causes high CPU utilization in csrss.exe!CsrValidateMessageString and probably in cmd.exe
   @ECHO  looping - causes high CPU utilization in csrss.exe!CsrValidateMessageString and probably in cmd.exe
   @GOTO LOOP"

Although I don't execute a loop exactly like this, I do have nested loops with an
embedded CALL. I guess I need to rework the process!

When your only tool is a hammer, every problem looks like a nail.


Report •

#5
June 16, 2011 at 00:24:11
Maybe this will cause less lag:

@ECHO OFF

IF NOT EXIST "REQ_Types.txt" TYPE NUL>"REQ_Types.txt"
FOR /f "tokens=1,2* delims=:" %%A IN ('findstr /C:"RequestType:" "%cd%\*-*-1*.txt" ') DO (
    FIND "%%C" < "REQ_Types.txt" > NUL || (
        >> "REQ_Types.txt" echo %%C
        for %%D in ("%%A:%%B") do ECHO Filename = "%%~nxD"
        ECHO Writing to file. 
    )
)
pause


Report •

#6
June 16, 2011 at 05:00:48
Thanks Judago! Indeed it does! Both cmd.exe and csrss.exe still eat up the cpu cycles when executing, but the actually execution time is substantially reduced. I guess I never used masks/wildcards in the search target for the FINDSTR command before! It makes me wonder what other command options have I neglected to exploit due to ignorance?

When your only tool is a hammer, every problem looks like a nail.


Report •

Ask Question