High CPU usage in WmiPrvSE.exe observed with PIA Split Tunnel

[std-move]

Hello,

I have noticed that WmiPrvSE.exe's CPU usage is relatively high when Private Internet Access Service is running and Split Tunnel is enabled (there is at least one split tunnel rule configured). PIA looks to make heavy use of WMI.

The usage seems to vary, but is generally around 1/5 of a performance core on an Intel 13th gen laptop CPU. That might not seem like much, but makes a big difference to thermals, fan activity and power usage.

To put things in perspective, when monitoring usages via resmon over time, WmiPrvSE.exe dominates. "Idle" browsers like Firefox and Chrome, with plenty of tabs open, seem to use less CPU in total (yes, I am aware of multiprocessing) even though there's plenty of background activity.

Observed on Win10 22H2/PIA 3.3.1 and Win11 22H2/PIA 3.5.1.

Is there a way something could done about this?

[kp-john-mair]

Hi, sorry about that.

Would you be able to set Name Servers in split tunnel config to"use vpn dns" and tell me if that improves it?

[std-move]

Hello, I don't see any significant difference between 'Follow app rules' and 'VPN DNS only', CPU usage seems to be high in either case.

[Jerico815]

Same problem here. PIA 3.5.3, Win10 22H2, Intel i9-9900K. ~ 2% load (WMI Provider Host) in idle. If I remove apps from split tunnel option in pia or stop pia service, problem is gone. Reinstall PIA or switch between 'Follow app rules' and 'VPN DNS only' didnt solved the problem.

[kp-john-mair]

Thanks guys - sorry about that. Unfortunately we don't have any time allotted to look into the windows split tunnel for a while, until about Q2 or Q3 of 2024 at the earliest. But when i get time, i'll jump in. Feel free to add more info to this ticket as you discover it.

[marcelxl]

Same problem here. PIA x64 - 3.5.3-07926 Windows 11 23H2 , Intel core i5

With the WMI Provider host using about 6% to 10% CPU usage while idle, the performance loss (and sluggish of the system) is significant.

Suggested changes did not change the behavior, only stopping the PIA NT service does.

Observations: If Split Tunnel is turned "on" , but no (active) applications are yet added (so the default rules All Other Apps and Name Servers are the only ones in the list), the problem doesn't appear. CPU usage goes up the minute you add ("+ Add Application") an (active) application to the list of "Your Split Tunnel Rules"

For now as a work-around I have created two .BAT files on my desktop for running a few commands (pia_quit.bat) net stop "Private Internet Access Service"

and the other one (pia_start.bat) net start "Private Internet Access Service" "C:\Program Files\Private Internet Access\pia-client.exe"

(took a look at the source code here on Github kapps_net/src/win/win_appmonitor.cpp)

// 'WITHIN 0.1' specifies the aggregation interval for these events. // // Although the doc discourages using intervals smaller than a few seconds, // a small interval is needed to correctly detect applications with // "launchers" like Opera. // // Opera's start menu shortcut points to 'launcher.exe', which starts up // 'opera.exe' (and probably checks for updates and such). We have to // observe 'opera.exe' as a child of 'launcher.exe' for this to work. // // 'launcher.exe' is very short-lived though - some repeated measurements on // a Ryzen 7 VM show that it runs for ~0.5 seconds at the least, and // 'WITHIN 1' fails to observe it in time. (We see the PPID, but the // process object is gone, so we can't figure out who the parent was.) // 'WITHIN 0.1' reliably detects it. // // We could add specific rules for Opera, but it's unlikely to be the only // app doing this. If WITHIN 0.1 is not sufficient to detect some app, we // probably need to move this into kernel mode using // PsSetCreateProcessNotifyRoutineEx() in a driver. HRESULT queryErr = _pSvcs->ExecNotificationQueryAsync( _bstr_t{L"WQL"}, _bstr_t{L"SELECT * FROM __InstanceCreationEvent WITHIN 0.1 WHERE " "TargetInstance ISA 'Win32_Process'"}, WBEM_FLAG_SEND_STATUS, nullptr, pNewSinkStubSink);

As the coder already mentions, 0.1 is the culprit. The thread now polls WMI at a very high rate (every 10th of a second), hence the high CPU usage on the WMI provider host.

Fixing this is probably not straighforward (as mentioned using PsSetCreateProcessNotifyRoutineEx() in a driver that probably needs to be written first)

[ossnorry]

Issue is still sucking up 40% of my CPU, any updates on this?