topic As David stated, there are in Endpoint Security

High CPU after upgrading to AMP 5.0.x

STUART RUSSELL — Fri, 21 Feb 2020 05:02:56 GMT

Hi ..

Anyone else been experiencing issues with high CPU after upgrading to version 5 of the AMP connector? I upgraded one of our environments of 40 servers (DC, SQL, APP ...) to version 5 when it came out. Ever since random servers at random times hit 100% CPU and have to be power cycled to recover functionality.

Hello,

David Janulik — Wed, 07 Dec 2016 08:50:02 GMT

Hello,

do you have 5.0.9 on Windows server installed? I suggest to open a support ticket via TAC to help you sort this out.

David

As David stated, there are

Matthew Franks — Wed, 07 Dec 2016 11:55:07 GMT

As David stated, there are some issues that may cause high CPU until version 5.0.9 in the 5.x series. Try upgrading to 5.0.9 if you haven't already. If that doesn't work, please open a TAC case so they can further troubleshoot.

Hi Frank

STUART RUSSELL — Wed, 07 Dec 2016 23:59:27 GMT

Hi Frank

Yes we started at 5.0.1 and then as new releases came out we upgraded. So all connectors are 5.0.9. All servers were running OK with version 4.x.x.

I have had a TAC case open for a month now.

Hi David,

STUART RUSSELL — Thu, 08 Dec 2016 00:02:41 GMT

Hi David,

Yes all 5.0.9. Have just downgraded 2 servers to 4.1.4 to make sure the issues is the version 5 upgrade.

I have had a TAC case open for a month now.

Regards,

I opened BUG for this issue.

David Janulik — Thu, 08 Dec 2016 14:42:08 GMT

I opened BUG for this issue. https://cdetsng.cisco.com/webui/#view=CSCvc42521

Can we get the ticket escalated to Tier 3?

Hi David,

STUART RUSSELL — Fri, 09 Dec 2016 08:47:02 GMT

Hi David,

TAC have come back saying the connector looks a bit noisy so advised to add more exclusions, which I have done. The current exclusions have been in place for over 12 months without issue on V4 connectors. Have to wait and see.

Regards

Another DC had to be rebooted

STUART RUSSELL — Mon, 12 Dec 2016 22:31:21 GMT

Another DC had to be rebooted due to 100% CPU this morning. It only has a c drive and the following Exclusions;

<exclusions>
<info>
<item>256|2|1|0|CSIDL_APPDATA</item>
<item>256|2|1|0|CSIDL_BASEDIR</item>
<item>256|2|1|0|CSIDL_COMMON_APPDATA</item>
<item>256|2|1|0|CSIDL_LOCAL_APPDATA</item>
<item>256|2|1|0|CSIDL_PROGRAM_FILES</item>
<item>256|2|1|0|CSIDL_PROGRAM_FILESX86</item>
<item>256|2|1|0|CSIDL_SYSTEM</item>
<item>256|2|1|0|CSIDL_WINDOWS</item>
<item>256|6|1|0|[A-Za-z]:\\System Volume Information\\tracking.log$</item>
</info>
</exclusions>

I have had CPU issues too

Rick Rowe — Wed, 21 Dec 2016 15:54:50 GMT

I have had CPU issues too with 4.4.2 versions.

Been through TAC and they have recommended 'for Servers' not to install the Tetra and DFC drivers. If you didnt use the cmd line switches, then you need a total uninstall, reboot, and reinstall with: /skiptetra 1 and /skipdfc 1

FYI, Rick

Thanks for the FYI Frank,

STUART RUSSELL — Fri, 23 Dec 2016 00:39:56 GMT

Thanks for the FYI Frank,

We have rolled two thirds of the server back to version 4 to try to get back some stability in the environment. The rest of the servers will be rolled back in the coming days.

When you had CPU issues did you have to reboot the server to recover? All our issues were a CPU 100% utilisation loop that the server never recovered from, a reboot is all we could do to get functionality back.

Regards

Stuart

Hi All,

STUART RUSSELL — Fri, 06 Jan 2017 20:42:08 GMT

Hi All,

We have completed downgrading all servers to 4.4.4 and have not had any CPU issues since. TAC have filed a bug for v5, at this stage with no workaround.

Regards,

Stuart

Hi All,

STUART RUSSELL — Fri, 06 Jan 2017 20:44:16 GMT

Hi All,

We have completed downgrading all servers to 4.4.4 and have not had any CPU issues since. TAC have filed a bug for v5, at this stage with no workaround.

Regards,

Stuart