High System Interrupts on Azure VM even when not under heavy load

Hi @Christian Bryan

Thank you for reporting the high system interrupts observed on your Azure VM running the OpenEdge Database with Trend Micro antivirus. To help us investigate and diagnose the issue effectively, could you please provide further details on the following points:

1. What is the exact VM size and operating system version currently in use?
2. How long has the VM been operating on this configuration without any issues?
3. Have there been any recent updates applied to the operating system, drivers, or Azure platform components?
4. Have there been any recent updates or configuration changes to Trend Micro, the OpenEdge database, or other installed applications?
5. Are the system interrupt spikes continuous, or do they occur during specific operations or times?
6. Can you share CPU, disk I/O, and network performance metrics captured during periods of high interrupts?
7. Are there any scheduled tasks, backups, or maintenance jobs that coincide with the high interrupt activity?
8. Have any new security policies, kernel-level system features, or changes related to device drivers been recently implemented?
9. Could you provide recent Windows Event Logs (especially System and Device Manager logs) related to hardware or driver errors?

Collecting this information will help us determine the exact issue. Additionally, could you please check private message and provide the necessary details.

Hi

1. What is the exact VM size and operating system version currently in use?
   1. Windows 2019 Datacenter Standard E20as v4 vCPUs 20 RAM 160 GiB
2. How long has the VM been operating on this configuration without any issues?
   1. Several years
3. Have there been any recent updates applied to the operating system, drivers, or Azure platform components?
   1. Nothing that i am aware of the server is regularly patched with the MS updates etc.
4. Have there been any recent updates or configuration changes to Trend Micro, the OpenEdge database, or other installed applications?
   1. Nothing that i am aware of
5. Are the system interrupt spikes continuous, or do they occur during specific operations or times?
   1. They are continuous but in proportion to load on the server i.e. They increase when the server is under load, so for example at mid-morning on a weekday they are around 20 CPU cycles which causes the server to max out at 100% or at least hover around 98%
6. Can you share CPU, disk I/O, and network performance metrics captured during periods of high interrupts?
   1. We are not seeing Disk I/O performance issues or Network performance issues. I can send you these tomorrow if that helps when the system is busy we use Logic Monitor.
7. Are there any scheduled tasks, backups, or maintenance jobs that coincide with the high interrupt activity?
   1. We have checked that and managed to rule this out as the backup happens out of hours and system interrupts are constant when the system is in heavy use 9am - 5pm regardless of what jobs start and finish during the day.
8. Have any new security policies, kernel-level system features, or changes related to device drivers been recently implemented?
   1. Not that i am aware of.
9. Could you provide recent Windows Event Logs (especially System and Device Manager logs) related to hardware or driver errors?
   1. yes i can provide these if this will help.

Thank you for the detailed information. Based on the behavior described, the high System Interrupts are likely caused by a kernel-level or driver-level component, rather than application CPU usage. Since the issue scales with load and began recently without major configuration changes, our focus will be on validating the underlying drivers, virtual hardware interfaces, and security filter components.

To help isolate and resolve the issue, we recommend the following steps:

1. Please run Azure Performance Diagnostics (PerfInsights) to gather detailed CPU and interrupt analysis. This will help identify if the interrupts originate from Kernel drivers,System interrupt handlers

Reference: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/troubleshoot-high-cpu-issues-azure-windows-vm

2.Check System and Application logs (Event Logs) for any warnings or errors related to hardware or drivers. Inspect Device Manager for outdated, missing, or faulted drivers.

3.Temporarily disable or test Trend Micro AV (with exclusions applied) to rule out antivirus kernel hooks contributing to interrupts.

4.Verify that all drivers, integration components, and firmware are up to date, particularly network and storage drivers, and consider a VM restart after maintenance.

5.Collect Diagnostic Logs During High Interrupt Periods

Run a Windows Performance Recorder (WPR) trace for 60–90 seconds to capture interrupt activity. This generates a trace file for deeper analysis of interrupt sources.

wpr -start CPU -filemode
wpr -stop C:\Temp\interrupt_trace.etl

6.Collect driver and network adapter details using PowerShell

driverquery /v > C:\Temp\driverquery.txt
Get-NetAdapter | Get-NetAdapterAdvancedProperty > C:\Temp\netadapter.txt

Could you please share the relevant details via private message? Additionally, could you please check private message and provide the necessary details.