CSA causes cpu utilization spike in enforcement mode?

[piltze]

I am experiencing a problem where two servers (specifically a file a server and a Citrix server) are experiencing spikes in CPU utilization (maxing out at 100% util) whenever we take them out of "Test" mode.

These systems are running CSA v4.5-1 build 616 agents. In order to stop the CPU issue, we had to stop the agent (which dropped the processor util immediately), put the system back into a "Test" state, restart the agent, and poll the server.

Now that the server is back in a Test state, the CPU problem doesnt exist.

Any thoughts or suggestions would be greatly appreciated.

[tsteger1]

What groups, policies and events are associated with the servers?

Are there corresponding Windows events?

What other processes are running on the servers?

Are there other similar servers in different groups that aren't having the issues?

One thing you could try is to put one of the servers in a group with minimal policies (Required Windows?) and see how it behaves.

The other thing would to put different policies in test mode...

Tom S

[piltze]

I put the server in (the default group), and it is still experiencing the same problem.

It is currently not running any other policies/group associations.

There are other servers experiencing the same problem. I have tried putting them into the only, and they have the same problem.

No Windows events worth mentioning.

[tsteger1]

CSA is trying to do a lot of work but it isn't logging anywhere because it's set not to.

1. Create a new group called "Windows test".

2. Clone the policies in the group and add them to the new group.

3. Change all the rules in those cloned policies to log.

4. Put the group in test mode.

5. Put a problem server in the group and see what events are generated.

You should see what's causing the problem without killing the server in the process.

Then you'll be able to either except the process or disable the rule causing it (if that's safe).

You also didn't mention what process is spiking the CPU.

Tom S

[piltze]

Thanks for the tip, I will try this.

The okclient is actually what is spiking -- its taking up 40+% of the CPU utilization.