Server process hogs (or NLM programs that use a lot of server processes) are indicated on the Health Monitor page by a suspect or bad status for the Available Server Processes indicator.
To find server process hogs:
Under the heading, click the link.
This displays the Profiling and Debug Information page that shows information about active and suspended threads, their states, the owning NLM program, and execution times.
On the Profiling and Debug Information page, click one of the thread name links that has a status.
This displays the Thread Information page.
On the Thread Information page, view the Suspend Description field.
This information should indicate what method the thread last used to yield the processor. A short trace of stack information that the server was executing at the time the thread suspended is also displayed.
Click the stack address and perform some basic stack tracing (if you are familiar with interpreting assembly code).
You can trace the service process that is in use by the NLM to see how it is actually using the process and you can look at the stack and see what the thread is using the service process for.