High CPU usage in WmiPrvSE.exe observed with PIA Split Tunnel

[std-move]

Hello,

I have noticed that WmiPrvSE.exe's CPU usage is relatively high when Private Internet Access Service is running and Split Tunnel is enabled (there is at least one split tunnel rule configured). PIA looks to make heavy use of WMI.

The usage seems to vary, but is generally around 1/5 of a performance core on an Intel 13th gen laptop CPU. That might not seem like much, but makes a big difference to thermals, fan activity and power usage.

To put things in perspective, when monitoring usages via resmon over time, WmiPrvSE.exe dominates. "Idle" browsers like Firefox and Chrome, with plenty of tabs open, seem to use less CPU in total (yes, I am aware of multiprocessing) even though there's plenty of background activity.

Observed on Win10 22H2/PIA 3.3.1 and Win11 22H2/PIA 3.5.1.

Is there a way something could done about this?

[kp-john-mair]

Hi, sorry about that.

Would you be able to set Name Servers in split tunnel config to"use vpn dns" and tell me if that improves it?

[std-move]

Hello, I don't see any significant difference between 'Follow app rules' and 'VPN DNS only', CPU usage seems to be high in either case.

[Jerico815]

Same problem here.
PIA 3.5.3, Win10 22H2, Intel i9-9900K.
~ 2% load (WMI Provider Host) in idle.
If I remove apps from split tunnel option in pia or stop pia service, problem is gone.
Reinstall PIA or switch between 'Follow app rules' and 'VPN DNS only' didnt solved the problem.

[kp-john-mair]

Thanks guys - sorry about that. Unfortunately we don't have any time allotted to look into the windows split tunnel for a while, until about Q2 or Q3 of 2024 at the earliest. But when i get time, i'll jump in. Feel free to add more info to this ticket as you discover it.

[marcelxl]

Same problem here.
PIA x64 - 3.5.3-07926
Windows 11 23H2 , Intel core i5

With the WMI Provider host using about 6% to 10% CPU usage while idle, the performance loss (and sluggish of the system) is significant.

Suggested changes did not change the behavior, only stopping the PIA NT service does.

Observations: If Split Tunnel is turned "on" , but no (active) applications are yet added (so the default rules All Other Apps and Name Servers are the only ones in the list), the problem doesn't appear. CPU usage goes up the minute you add ("+ Add Application") an (active) application to the list of "Your Split Tunnel Rules"

For now as a work-around I have created two .BAT files on my desktop for running a few commands
(pia_quit.bat)
net stop "Private Internet Access Service"

and the other one
(pia_start.bat)
net start "Private Internet Access Service"
"C:\Program Files\Private Internet Access\pia-client.exe"

(took a look at the source code here on Github kapps_net/src/win/win_appmonitor.cpp)

// 'WITHIN 0.1' specifies the aggregation interval for these events.
//
// Although the doc discourages using intervals smaller than a few seconds,
// a small interval is needed to correctly detect applications with
// "launchers" like Opera.
//
// Opera's start menu shortcut points to 'launcher.exe', which starts up
// 'opera.exe' (and probably checks for updates and such). We have to
// observe 'opera.exe' as a child of 'launcher.exe' for this to work.
//
// 'launcher.exe' is very short-lived though - some repeated measurements on
// a Ryzen 7 VM show that it runs for ~0.5 seconds at the least, and
// 'WITHIN 1' fails to observe it in time. (We see the PPID, but the
// process object is gone, so we can't figure out who the parent was.)
// 'WITHIN 0.1' reliably detects it.
//
// We could add specific rules for Opera, but it's unlikely to be the only
// app doing this. If WITHIN 0.1 is not sufficient to detect some app, we
// probably need to move this into kernel mode using
// PsSetCreateProcessNotifyRoutineEx() in a driver.
HRESULT queryErr = _pSvcs->ExecNotificationQueryAsync(
_bstr_t{L"WQL"},
_bstr_t{L"SELECT * FROM __InstanceCreationEvent WITHIN 0.1 WHERE "
"TargetInstance ISA 'Win32_Process'"},
WBEM_FLAG_SEND_STATUS,
nullptr,
pNewSinkStubSink);

As the coder already mentions, 0.1 is the culprit. The thread now polls WMI at a very high rate (every 10th of a second), hence the high CPU usage on the WMI provider host.

Fixing this is probably not straighforward (as mentioned using PsSetCreateProcessNotifyRoutineEx() in a driver that probably needs to be written first)

[ossnorry]

Issue is still sucking up 40% of my CPU, any updates on this?

[Code-Vlue]

Surface Laptop 3, i7-1065G7 and Windows 11 24H2, Issue is still present. When Split Tunnel is enabled and Administrator Rights prompt is accepted immediately get WMI service CPU usage which generally idles at around 6%. Usage will persist through restart even if Split Tunneling is tuned off in settings. Once the original admin prompt has been accepted the only way to remove WMI usage is to uninstall PIA all together and reinstall making sure you don't enable split tunneling again or you will have to reinstall again. General system responsiveness when issue is present is vastly decreased and battery usage noticeably increases.

[Code-Vlue]

Update: Found a patchy work around, if you run the winmgmt /resetrepository command in the CMD as admin then the problem goes away however it seems like you need to do it on every boot. I made a boot task to run it every time but seems like the issue might be due to PIA causing WMI corruption due to split tunneling.

Update: Even though WMI usage is gone with this there still seems to be a slight effect on system responsiveness and stability of connection.

[Average-GH-Enjoyer]

I can confirm it is present on my PC as well. I couldn't figure out which app was causing this and had to reinstall Windows to find out. It's very frustrating. With a 7% CPU usage on my laptop, it doesn't do any good for the battery life.