topic Re: CSA causes cpu utilization spike in enforcement mode? in Network Security

CSA causes cpu utilization spike in enforcement mode?

piltze — Sun, 10 Mar 2019 09:53:06 GMT

I am experiencing a problem where two servers (specifically a file a server and a Citrix server) are experiencing spikes in CPU utilization (maxing out at 100% util) whenever we take them out of "Test" mode.

These systems are running CSA v4.5-1 build 616 agents. In order to stop the CPU issue, we had to stop the agent (which dropped the processor util immediately), put the system back into a "Test" state, restart the agent, and poll the server.

Now that the server is back in a Test state, the CPU problem doesnt exist.

Any thoughts or suggestions would be greatly appreciated.

Re: CSA causes cpu utilization spike in enforcement mode?

tsteger1 — Wed, 08 Feb 2006 22:13:53 GMT

What groups, policies and events are associated with the servers?

Are there corresponding Windows events?

What other processes are running on the servers?

Are there other similar servers in different groups that aren't having the issues?

One thing you could try is to put one of the servers in a group with minimal policies (Required Windows?) and see how it behaves.

The other thing would to put different policies in test mode...

Tom S

Re: CSA causes cpu utilization spike in enforcement mode?

piltze — Wed, 15 Feb 2006 17:55:43 GMT

I put the server in (the default group), and it is still experiencing the same problem.

It is currently not running any other policies/group associations.

There are other servers experiencing the same problem. I have tried putting them into the only, and they have the same problem.

No Windows events worth mentioning.

Re: CSA causes cpu utilization spike in enforcement mode?

tsteger1 — Wed, 15 Feb 2006 19:20:33 GMT

CSA is trying to do a lot of work but it isn't logging anywhere because it's set not to.

1. Create a new group called "Windows test".

2. Clone the policies in the group and add them to the new group.

3. Change all the rules in those cloned policies to log.

4. Put the group in test mode.

5. Put a problem server in the group and see what events are generated.

You should see what's causing the problem without killing the server in the process.

Then you'll be able to either except the process or disable the rule causing it (if that's safe).

You also didn't mention what process is spiking the CPU.

Tom S

Re: CSA causes cpu utilization spike in enforcement mode?

piltze — Wed, 15 Feb 2006 20:17:18 GMT

Thanks for the tip, I will try this.

The okclient is actually what is spiking -- its taking up 40+% of the CPU utilization.