Server process hogs (or NLM programs that use a lot of server processes) are indicated on the Server Health Monitoring page by a suspect or bad status for the Available Server Processes indicator.
To find server process hogs, do the following:
Under the Diagnose Server heading, click the Profile/Debug link.
This displays the Profiling and Debug Information page that shows information about active and suspended threads, their states, the owning NLM program, and execution times.
On the Profiling and Debug Information page, click one of the thread name links that has a Delayed status.
This displays the Thread Information page.
From the Thread Information page, view the Suspend Description field.
This information should indicate what method the thread last used to yield the processor. A short trace of stack information that the server was executing at the time the thread suspended is also displayed.
Click the stack address and perform some basic stack tracing (if you are familiar with interpreting assembly code).
You can trace the service process that is in use by the NLM to see how it is actually using the process and you can look at the stack and see what the thread is using the service process for.