cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2885
Views
0
Helpful
4
Replies

Cisco AMP Issues

Quintin.Mayo
Explorer
Explorer

The Cisco AMP client is causing some of my server to go unresponsive. The behavior is indicated by exceptionally long login times, excessive handle count of the sfc.exe process and it eventually failing communication with the AMP dashboard. I'm currently new to AMP and any assistance in this matter will greatly be appreciated.

 

 

 

 

 

 

4 Replies 4

Marvin Rhoads
VIP Community Legend VIP Community Legend
VIP Community Legend

There are profiles for both Domain controllers as well as a generic server profile that should be used for the AMP for Endpoints connector.

 

Did you install the server-specific endpoint connector profile?

Hi,

When investigating further we are showing the AMP connector accumulating large amounts of handles. The number of handles increases over time.  I have attached a screenshot for review, cany you tell me what will cause excessive handles from the sfc.exe application? Thanks.

Was this question ever solved? Cheers

Vinay3goyal3
Beginner
Beginner

I have a similar issue where my servers have millions of open handles. Also it looks like it is a handle leak coz I restarted my server and observed it over a period of time and I observed that sfc.exe opens 100+ handles every minute. which makes ~144000 handles in a day and 1,440,000 handles in 10 days at which the server essentially becomes unusable. 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers