Check Top CPU Queries in 45 Seconds. From Symptoms to Root Clause. The "45 Seconds DBA Series" – What Real DBAs Check First | Part 7 🥇

Before we dive into today's topic, if you missed my previous post you can take a look at Check Memory Grants in 45 Seconds. From Symptoms to Root Clause. The "45 Seconds DBA Series" – What Real DBAs Check First | Part 6 🥇.

👉 If you found this deep-dive helpful, feel free to check out the ads—your support helps me keep creating high-quality SQL Server content for the community.

Identifying high CPU pressure is step one; finding the specific query pulling the trigger is where the real work begins. In this post, I’ll show you how to unmask the top CPU killers in your plan cache in under 45 seconds.

TL;DR

✔️ Worker Time vs. Elapsed Time: High worker time relative to duration indicates a CPU-bound query or heavy parallelism. 🛠️
✔️ Plan Cache Mining: Use sys.dm_exec_query_stats to find the highest cumulative CPU consumers since the last restart. 📦
✔️ Focus on Execution Count: A query that runs 1 million times consuming 10ms is often more dangerous than one running once consuming 10s. 🚀
✔️ Root Cause Analysis: Excessive sorting, hashing, and Scalar UDFs are the usual suspects for CPU spikes. ✔️

Hi SQL SERVER Guys,

In my previous post, we talked about distinguishing between a busy CPU and a backlogged one. But once you've confirmed that your schedulers are indeed choked, you need to find the "Who." As a Senior Expert, I don't believe in guessing. We need to go straight to the Plan Cache. 

If your queries are poorly written—using non-sargable predicates or row-by-row logic—SQL Server has no choice but to burn CPU cycles. Let's find the truth in 45 seconds.

What It Really Is: Worker Time Breakdown

In SQL Server terminology, Worker Time is the actual time the CPU spent executing the query. Elapsed Time is the total time the user waited.

💣 The Problem: When total_worker_time is significantly higher than total_elapsed_time, it's a clear sign of high parallelism (multiple cores working on one query). While parallelism can be good, excessive parallelism on small queries creates a "death by a thousand cuts" scenario for your CPU schedulers.

  • 🔍 sys.dm_exec_query_stats: The DMV that tracks performance metrics for every cached plan.
  • 🔍 Execution Context: Identifying if the CPU load is coming from a few large batches or millions of small, inefficient calls.

🧪 The 45-Second Top CPU Query Script

Use this script to pull the top 10 queries currently eating your CPU alive. This looks at the total worker time across all executions:

SELECT TOP 10
    SUBSTRING(st.text, (qs.statement_start_offset/2) + 1,
    ((CASE statement_end_offset 
        WHEN -1 THEN DATALENGTH(st.text) 
        ELSE qs.statement_end_offset END 
            - qs.statement_start_offset)/2) + 1) AS [Query Text],
    qs.execution_count,
    [Avg CPU Time] = qs.total_worker_time / qs.execution_count,
    [Total CPU Time] = qs.total_worker_time,
    qp.query_plan
FROM sys.dm_exec_query_stats AS qs
CROSS APPLY sys.dm_exec_sql_text(qs.sql_handle) AS st
CROSS APPLY sys.dm_exec_query_plan(qs.plan_handle) AS qp
ORDER BY qs.total_worker_time DESC;

According to Microsoft Documentation, total_worker_time is measured in microseconds, giving us the precision needed to find even the smallest inefficiencies.

🚀 My REAL Strategy

Stop add CPUs just to have them eaten by Scalar User Defined Functions (UDFs).

  1. Identify UDFs: If you see a Scalar UDF in your top CPU queries, it’s likely forcing row-by-row processing (RBAR). Convert them to Inline Table-Valued Functions (iTVFs).
  2. Check for Excessive Parallelism: If Total CPU Time >> Elapsed Time, look at your Cost Threshold for Parallelism. If it's still at the default of 5, change it to 50 immediately.
  3. The "Plan" is the Key: Click the query_plan link in the results above. Look for Hash Match or Sort operators. These are CPU-intensive. Replacing a Hash Match with a Nested Loop via better indexing can drop CPU usage by 80%.

Related Posts

📢 Support the Blog: Did you find this deep-dive helpful? The ads you see here are selected to reflect your interests. If a partner's offer catches your eye, give it a look! Your engagement helps me continue publishing premium SQL Server content for the community.

Biondi Luca @2026 - Sharing over 25 years of Gained Knowledge for Passion. Share if you like my posts!

Comments

Post a Comment

I Post più popolari

Speaking to Sql Server, sniffing the TDS protocol

Image
Hello friends!  If yesterday you read my post and found it definitely boring (for the topic of course and not for how it was written to the author 😁) well today I promise you that the topic will be much more interesting! Let's talk about Sniffing , let's talk about going to see what happens when we "log in" or when we send a Query to SQL Server.  We will do this by taking a look to the little known tabular data stream (TDS) protocol built on top of the TCP/IP protocol. Ready! The TDS protocol What is the Tabular data stream (TDS) protocol?  The TDS is the protocol used by the SQL Server client Net-Library to communicates with SQL Server . TDS is specific to SQL Server and it is a low-level protocol that specifies both commands and data in a specific arrangement.  TDS encapsulate the TCP/IP protocol. Sniffing TDS packets you can read from the network the requests that your application do to the SQL Server and read the answer .   How to Sniff data from the ne...
Read more

SQL Server, find text in a Trigger, Stored Procedures, View and Function. Two ways and what ways is better

Image
Hi guys, Welcome back! Today a light post about a question that has been asked to me several times. The question is: how to  search for text inside a trigger or a stored procedure ? We have two different ways. A first way using a system view called syscomments: SELECT obj.xtype, text , * FROM sysobjects obj JOIN syscomments com on obj.id = com.id WHERE TEXT like '%text_that_i_am_searching_for%' A second way using a system view called sql_module: SELECT o. name AS Object_Name, o. type_desc , m. definition FROM sys.sql_modules m JOIN sys.objects o ON m. object_id = o. object_id WHERE m. definition Like '%text_that_i_am_searching_for%' ;   Another question is? What differences do we have in using one way instead of the other? Which solution is better? You have to consider that the system view sys.syscomment is obsolete and will be removed sooner or later. So don't use it in production enviroiments. The sys.sql_m...
Read more

SQL Server, Avoid that damn Table Spool!

Image
Hi guys, Welcome back for another post! A light one inspired from what i do during my work: many times I optimize queries rewriting them or adding index and i like it very much! Sometimes you need to use a little imagination, but everything you learn ... sooner or later it will come in handy! Enjoy the reading mates! Avoid the Table Spool, when you can A few days ago I came across a query whose execution time was very high ... or so it was for the client complaining about the problem. Before recreating it, let's create the structures and fill the tables with some data Create table PriceList (Id int identity (1,1) primary Key ,Code Varchar (20)) Insert into PriceList (code) select top 1000 right( '0000' + cast ( row_number () over ( order by id) as varchar (4)),4) from artico Insert into PriceList (code) select top 4000 right( '1000' + cast ( row_number () over ( order by id) as varchar (4)),4) from artico Create table OrdersList (Id int identity...
Read more