CSA causes cpu utilization spike in enforcement mode?

I am experiencing a problem where two servers (specifically a file a server and a Citrix server) are experiencing spikes in CPU utilization (maxing out at 100% util) whenever we take them out of "Test" mode.
These systems are running CSA v4.5-1 build 616 agents. In order to stop the CPU issue, we had to stop the agent (which dropped the processor util immediately), put the system back into a "Test" state, restart the agent, and poll the server.
Now that the server is back in a Test state, the CPU problem doesnt exist.
Any thoughts or suggestions would be greatly appreciated.

CSA is trying to do a lot of work but it isn't logging anywhere because it's set not to.
1. Create a new group called "Windows test".
2. Clone the policies in the group and add them to the new group.
3. Change all the rules in those cloned policies to log.
4. Put the group in test mode.
5. Put a problem server in the group and see what events are generated.
You should see what's causing the problem without killing the server in the process.
Then you'll be able to either except the process or disable the rule causing it (if that's safe).
You also didn't mention what process is spiking the CPU.
Tom S

Similar Messages

Verity on MX7 causing CPU to spike to 100%

We have just migrated our sites from CF5 to CFMX7. I
recreated the collections on the new server and everything appeared
to be fine. Now seeing CPU utilization spike to 100% when a search
is run. Any ideas as to what to look for or why this would be
happening? Thanks in advance for any help.

mDNSResponder is a process that searches and publishes content automatically. It's normal for it to be going non-stop in scanning IP networks. However, it should never take more than a 2-10% of your total CPU.
The MDNSResponder is just doing what's being asked of it. In short, there's an appllication/widget/etc. that's working at elevated rates. I was surprised, for example, that by signing up for Veoh, a small amount of bandwidth was being used - continually, without my knowing it - to support their whole network. The MDNSResponder helps achieve that. A network filter does the same thing. There is some service which is doing the same thing with your computer. It's magnified if you operate in Low Power Mode, since the stream of data just doesn't stop. It operates at elevated levels when an application (like iTunes) boots.
Find the application, and then decide if you're paying a fair price. You can do your own policework by playing around with Activity Monitor (which also uses it).

Airport Process utilizing high CPU utilization

I currently have a 13 inch MacBook Pro i7 (2012 version). Recently I upgraded to Mavericks. After using the computer for a day after the upgrade, I began to notice it becoming very hot and the fans running very high. Looking at the running processes i noticed that a process called "airport" was running and utilizing high CPU times causing the heating up and fans running. Once I stopped this process, the laptop went back to operating at normal levels.
Unfortunately this issue began to come back several times....the "airport" process starting at any time and utilizing high CPU utilization....again only by killing this process fixed this issue.
After seeing this behavior over several days, I decised to wipe the drive and install a clean copy of Mavericks in the computer. Thought here was that possibly something did not carry over correctly from the upgrade from Mountain Lion to Mavericks. Unfortunely this did not correct the issue with the "airport" process as it still is continiung to launch at any time and spike the processor until I manually kill the process.
I do not recall this issue occuring while running Mountain Lion so it seems to be specific to Mavericks at this point.
I was hoping to hear if any other have experienced this type of issues while running Mavericks.

You should be able to find the information you are looking for from the default Total CPU Utilization Percentage monitor. This monitor has a built in diagnostic task that will kick off when an alert is triggered to list the top cpu consuming processes.
To find which processes were causing CPU to spike, simply review the State Change Events history in health explorer for the machine that was affected, for the Total CPU Utilization Percentage monitor. I have modified my second screen shot
to remove machine names, but you should get the idea. If a cpu monitor went from green to red, it will run the diagnostic task and list the process information and cpu usage at the time of the alert under state change events.

After migration Exchange 2013, MBX server, CPU utilization is so high

CPU utilization become so high this morning after migration into Exchange 2013,
Some healthy DBs is getting disccounetced with growing replay Queue length, mounted DB is no issue.
It seems that's short of CPU performance,
Are there any processes to limit or set up to reduce the load of CPU, MBX servers? It's temporary treatment...

What's the CU level you have for your Exchange 2013? Also, please check node runner processor as Node Runner process can cause CPU utilization issue. I would also suggest to check your disk IOPs as it looks like disk IOPs issue to me as well. Thanks.
Regards, Riaz Javed Butt | Consultant Microsoft Professional Services MCITP, MCITP (Exchange), MCSE: Messaging, MCITP Office 365 | mstechtalk.com

Swiping causes spikes in CPU utilization.

Using app to monitor CPU on iPhone 5 and iPad mini. Swiping causes spikes in CPU utilization from 5% to 65% for every swipe. Heavy swiping causes processor to run near 100%. Seems abnormal.
Reduce Motion turned on.
IOS 7.1
Anything to make this not run so high? Battery drain seems much faster with just general usage.

Hey Apple. This is likely a major issue with battery drain. Constant CPU spikes will cause the CPU to heat which increases battery drain. Swiping should not peg the CPU. I suspect it has to do with how The screen is rendered to the user.somebody needs to look into this from Apple. This is been an issue for at least the last few iOS versions.

Space designer causing cpu spike overload

Hope you guys can help with this, it's beginning to annoy me. I'm currently unable to use space designer reliably. I had this problem in Logic 8 and it's still happening in 9. I have one instance of SD in my current project and it's causing cpu spikes that are giving me errors. The funny thing is that the error happens just after a region that is being sent to the reverb has ended. the cpu meter then gradually rises until the error stops playback. If I turn SD off i don't get these problems or if I disable SD via automation when it's not needed it seems ok also. What the **** is this about? The thing is I really like the sound of SD and miss it when I have to use different reverbs. Anyone else having these issues? I read on another thread that setting all your inputs to "no input" helps but for me it doesn't. What else can I try?
cheers
p

Thanks for your input.
Just to clarify, I am getting the spike once the audio data stops sending through the SD plugin (whilst the song is still playing). So, for example I may send a 10 second bit of audio through the plug - this works fine. Then once the audio stops sending and the reverb trail finishes....I then get the CPU going mad - and yet there is complete silence within the song - there is nothing else playing!
This has got to be a bug or conflict of some kind - my computer spec is massive and should be able to cope with a stereo bit of audio through one plugin! (Hope this makes sense.)
There have been a couple of posts similar but no answers as yet...
Wondering whether it is a conflict with UAD plugins or something which limits the reproduction of this bug...I have noticed that if I remove all UAD plugins from the channel strip in question, the error tends not to reappear - but the issue is unique to the SD plugin.
Danny

ITunes causing CPU spikes

Ever since I upgraded to the most recent version of iTunes, my laptop has gone extremely slow when iTunes is running (i'm now using winamp). The CPU usage spikes from 80% up to 95-100%.
My music is stored on an external hard drive, the laptop is an Inspiron 9100 (Pentium 4, 3.20GHz, 1024MB RAM) and had no problems whatsoever before upgrading.
I did a complete wipe of my laptop a couple of days ago and all other applications are running much faster, but i've downloaded iTunes again and the same problem occurs. I've also tried downgrading the version to see if that helps but it doesn't.
Anyone suggest anything or experience similar?

I have to agree that there is some major problem with iTunes - I'm totally unimpressed having never used it before and just having bought my first ipod.
Windows XP SP2, 1.6 Ghz, 2Gb RAM
Insert any music CD and RIP via iTunes = 100% CPU utilization
Insert any music CD and RIP via Windows Media Player = 40% CPU utilization
So I need a dedicated machine to support the ripping of my music? What a joke.

SDK-based Management Pack causes 100% CPU utilization for HealtService.exe

We developed an MP that uses SDK to create SCOM objects and insert a large number of performance counters ~ 2000 every 5 minute interval.
On SCOM side the MP has about 2000 instances of UnitMonitor (only ~20 per class but there are lots of actual objects). In these monitors we use
DataSource based on Microsoft.SystemCenter.TargetEntitySdkPerformanceDataProvider. All worked fine for a year but lately added a bunch of new objects/counters and CPU utilization for the MonitoringHost.exe started to spike
to 100% a few seconds after the Performance Counters were posted via SDK. The spike lasts for up to 3 minutes. No DB or Network spikes observed. We suspect SCOM does not deal efficiently with SDK Performance data - as if a separate SdkPerformanceDataProvider
is started for every UnitMonitor when the counters are posted rather than having cooked-down - one per Target instance.
Can anyone shed some light on this? I suspect only the Microsoft engineers would know.
Our environment is like this:
SCOM 2012 R2 UR4
Windows Server 2012 8 Core, 16 GB Ram
Thanks,
Dave

Hi Dave,
is there a way that you can reduce the number of performance insertions? Regardless of even fixing the performance issue, the impact from a database standpoint may be something to consider in the long term. My point is that fixing one issue, will take us
to the next one, etc etc.
I would reduce the number of insertions, only to the either insertion of the "most critical" or "top #". Also, aren't those counters already captured out of the box?
hth
Jose

Multiple Adobe Readers causing High CPU utilization

Recently I've had a couple of instances where my system performance degraded significantly. I checked Task Manager and discovered two Adobe processes accounted for + 80% CPU utilization. Adobe Reader was not showing as an open application. I had closed the application earlier. I rebooted and things went back to normal. The processes were no longer active.
Note: Recently I had a problem with Nitro Pro hijacking my ability to open PDFs. It even removed Adobe Reader from my list of options for opening a PDF.
Has anyone had similar issues? Cause? Fix?

Hi keeperdan ,
Thank You for posting on the forums. Which version of Adobe Reader are you working with? My suggestion would be to use the latest Adobe Reader 11. Also, if you are already using Reader 11 kindly update it to 11.0.06.
Kindly reply if this does not resolve the issue.
Thanks,
Vikrantt Singh

BTServer causing high CPU utilization

Just got a new MacBook Pro with OS X Lion and updated to 10.7.1. I've seen the BTServer process cause high CPU utilization twice now. One morning I also noticed that the fan was running loudly while the lid was closed and the computer was locked up; I had to force power it off. Anyone seeing similar issues? Doing a search for BTServer on Google or even here in the Apple Support Communities does not bring up anything related to Lion at all, only iPhone-related articles.

yup, i had this problem too. i have a new 2.2ghz macbook pro and while at a coffee shop, i noticed my battery draining very quickly, and a look at activity monitor showed that BTServer was running away with high-cpu utilization. i killed off the process and didn't notice any loss of functionality.
not sure what it was supposed to do with so much freaking cpu cycles!!!
is this for bluetooth? i dont even have bluetooth on. im not happy about this having to be something i'd need to keep a eye on when i'm trying to maximize my battery life.

Get-MailboxExportRequest script causes high cpu utilization

Our Exchange configuration is as follows:
Exchange 2013 Ent on single server with 4 dbs
DB1 - 191 users
DB2 - 19 users
DB3 - 72 users
DB4 - 7 users
When I run a script that exports all of the users from each db to a pst file the CPU utilization peaks as expected, however DB1 never completes. Is there a way to throttle the performance somewhat or limit the number of users the script processes at
a time? Here is my script:
#Establish variables
$mailserver = "Exchange"
$path = "\\FileServer"
$userlist = Get-Mailbox -database DB1
$ReportShare = "\\FileServer\pst$\reports"
$file = "\\FileServer\pst$\reports\*.txt"
$SMTP = "smtp.domain.com"
#delete files from previous nights export
if (Test-Path $file)
Remove-Item $file
#Clear previously completed & failed tasks
Get-MailboxExportRequest | where {$_.status -eq "Completed"} | Remove-MailboxExportRequest -confirm:$false
Get-MailboxExportRequest | where {$_.status -eq "Failed"} | Remove-MailboxExportRequest -confirm:$false
#Perform Mailbox Export
foreach ($user in $userlist)
$useralias = $user.alias
New-MailboxExportRequest -Mailbox $useralias -filepath $path\pst$\$useralias.pst
#Create a loop which checks if the task has completed or not
$exstat = Get-MailboxExportRequest | Get-MailboxExportRequestStatistics | where {$_.status -eq 'inprogress'}
do {start-sleep -seconds 5; $exstat = Get-MailboxExportRequest | Get-MailboxExportRequestStatistics | where {$_.status -eq 'inprogress'}}
until ($exstat.percentcomplete -eq '100')
#Create a pause for the exports to finish before writing logfile output
start-sleep -seconds 7200
#Write output to a log file
if ($ReportShare)
Write-Output "Writing reports to $($ReportShare)"
$Completed = Get-MailboxExportRequest -BatchName $BatchName | Where {$_.Status -eq "Completed"} | Get-MailboxExportRequestStatistics | Format-List
if ($Completed)
$Completed | Out-File -FilePath "$($ReportShare)\$($BatchName)_Completed.txt"
$Incomplete = Get-MailboxExportRequest -BatchName $BatchName | Where {$_.Status -ne "Completed"} | Get-MailboxExportRequestStatistics | Format-List
if ($Incomplete)
$Incomplete | Out-File -FilePath "$($ReportShare)\$($BatchName)_Incomplete_Report.txt"
#Send a mail notification the task has completed
Get-ChildItem $ReportShare | where {-NOT $_.PSIsContainer} | foreach {$_.fullname} | Send-MailMessage -to "[email protected]" -from "[email protected]" -Subject "PST EXPORT REPORT DB1" -Body "Export of DB1 complete."
-SmtpServer $SMTP -BodyAsHtml

I have to ask why you have a nightly job that exports each mailbox to PST? It's unusual.
Anyway, you could split your script as follows:
Get-Mailbox -Database DB1 | ? {$_.samaccountname -like "[a-m]*"}
Get-Mailbox -Database DB1 | ? {$_.samaccountname -like "[n-z]*"}
Tony www.activedir.org Blog: www.open-a-socket.com

Uncorrelated GC STW pauses in ParNew + sys cpu time spikes from jvm calls

Hi, JVM experts.
GC is not an easy subject to grab all its subtleties, so I'm looking for some advice with my situation where to dig further.
The overall picture:
1) Linux smp (2.6.5) x86_64 host with 8G memory, 2x2Ghz xeon (HT) CPUs
Java HotSpot(TM) 64-Bit Server VM (build 1.6.0_02-b05, mixed mode)
2) Heap: -Xms4500M -Xmx4500M -XX:MaxNewSize=128m -XX:NewSize=128m -XX:MaxPermSize=128m -XX:PermSize=128m
3) GC: -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:MaxTenuringThreshold=0 -XX:SurvivorRatio=128 -XX:CMSInitiatingOccupancyFraction=60 -XX:+UseCMSInitiatingOccupancyOnly -XX:+CMSParallelRemarkEnabled -XX:+DisableExplicitGC -XX:+PrintGCApplicationStoppedTime -XX:+PrintClassHistogram
4) Application is running under consistent traffic for two weeks.
5) I monitor the system with "sar"
6) Once or twice a week I observe the kernel-space cpu usage spike to ~90% for a duration <10 seconds.
7) I detect the cpu spike and dump a snapshot of the system situation. It's the JVM which consumes the syscpu time. JVM is sent SIGQUIT at the same instant.
There are two points, I'm rather vague about.
1) All cpu load situations have the following similar pattern in GC log file:
195098.019: [GC 195098.019: [ParNew
Desired survivor size 491520 bytes, new threshold 0 (max 0)
: 129152K->0K(130112K), 0.0754030 secs] 1549718K->1448253K(4607040K), 0.0755550 secs]
Total time for which application threads were stopped: 0.0758180 seconds
Application time: 0.5316910 seconds
Total time for which application threads were stopped: 0.0003550 seconds
Application time: 0.0695990 seconds
Total time for which application threads were stopped: 0.0001620 seconds
Application time: 0.1657730 seconds
Total time for which application threads were stopped: 0.0001780 seconds
Application time: 0.0000350 seconds
Total time for which application threads were stopped: 0.0000440 seconds
Application time: 0.2738210 seconds
Total time for which application threads were stopped: 0.0003530 seconds
Application time: 0.3108570 seconds
195099.448: [GC 195099.448: [ParNew
Desired survivor size 491520 bytes, new threshold 0 (max 0)
: 129151K->0K(130112K), 0.0712390 secs] 1577405K->1476947K(4607040K), 0.0713980 secs]
Total time for which application threads were stopped: 0.0716750 seconds
Application time: 0.0364560 seconds
Total time for which application threads were stopped: 8.2666520 seconds
Application time: 0.0000700 seconds
Total time for which application threads were stopped: 0.0055730 seconds
Application time: 0.0069140 seconds
Total time for which application threads were stopped: 0.0017350 seconds
Application time: 0.0011930 seconds
Total time for which application threads were stopped: 0.0064760 seconds
Application time: 0.0000720 seconds
Total time for which application threads were stopped: 0.0001120 seconds
Application time: 0.0001010 seconds
Total time for which application threads were stopped: 0.0000650 seconds
Application time: 0.0001570 seconds
195107.840: [Full GC 195107.840: [CMS: 1476947K->1092516K(4476928K), 7.6193100 secs] 1488921K->1092516K(4607040K), [CMS Perm : 46862K->46641K(131072K)], 7.6194800 secs]
num #instances #bytes class name
1: 1962568 306032400 [Ljava.util.HashMap$Entry;
2: 1962446 125596544 java.util.HashMap
The "delay" of the SIGQUIT/Histogram dump can be ~1-2 seconds from the CPU overload detection. I'm curious about the "suspeciously spurious" SWT preceding the cpu spike. What could be the possible reasons?
2) Per thread analysis of the JVM threads hinted me to one thread which sometimes monopolized ~60% of the cpu time in kernel space. This is the native posix thread which "calls back into" JVM on certain events. Could it somehow cause the aforementioned STW?
My attempts to get a gdb stack dump at cpu load event failed (gdb can't resolve the stack in some of the jvm threads and enters infinite loop)
Any advice is greatly appreciated
regards,
- andrey

Just to close my "ticket" with some findings on the way hopefully to be useful for somebody else.
Since the problem manifested itself only on Linux box (have tried two different enterprise production kernels 2.6), I couldn't use dtrace, so my choice was limited to systap and /proc/profile.
The pattern when cpu usage was spiking was the following:
15 get_stack 0.1042
31 unhandled_signal 0.6458
34 stub_rt_sigreturn 0.2297
49 copy_siginfo_to_user 0.1021
70 find_vma 0.6250
94 retint_signal 0.7705
100 do_sigaltstack 0.2604
138 is_prefetch 0.3920
211 __up_read 1.1989
252 system_call 1.9535
292 __down_read 1.9730
552 save_i387 2.8750
1501 do_page_fault 0.9381
2266 do_signal 1.3488
2427 get_signal_to_deliver 1.9700
2452 force_sig_info 11.7885
3715 sys_rt_sigreturn 5.1597
14260 total 0.0057
It has been always the extensive number of signals generated. systap is lacking dtace java probes (as well as any u-level probes for that matter), so I could tap only in the kernel on syscalls:
force_sig_info= 10209 – 10230
0xc043681b : force_sig_info+0x1/0x86
0xc04230d3 : force_sig_info_fault+0x24/0x28
0xc0404670 : sys_rt_sigreturn+0x0/0xff
0xc061e3d8 : kprobe_exceptions_notify+0x164/0x386
0xc061f043 : notifier_call_chain+0x2a/0x47
0xc061f07e : atomic_notifier_call_chain+0x17/0x1a
0xc061f011 : do_page_fault+0x5e7/0x5ef
0xc0400000 : startup_32+0x0/0xb4
sys_rt_sigreturn= 10209 – 10235
0xc0404671 : sys_rt_sigreturn+0x1/0xff
0xc040518a : syscall_call+0x7/0xb
0xc0400000 : startup_32+0x0/0xb4
sys_rt_sigreturn() is tricky (it is designed to return to the kernel from the u-space signal handler), but the force_sig_info() is the result of the do_page_fault(). The swap was disabled and I assumed that page faults were "minor"-s. Looking at the comments in the OpenJDK JVM sources I could see that there are cases for non-mapped regions singal handling (like dynamic stack growth), so I suspected it's something very JVM specific. I could not correlate it precisely to GC events.
The end of the story is that I didn't find out exactly what was the real trigger of this event, but JVM1.6.05 does not produce such CPU spilkes.
- a.

Safari 4 - 102% CPU utilization!?

ever since safari 4 and its update were made available i noticed that my macmini (early 09) with 4GB ram slows down when i have a few opened pages with safari.
I've checked the system monitor as well as on unix command (e.g. top) and discovered that when browsing, safari tops 100% CPU utilization and often goes way above the hundred mark.
Navigating the web pages becomes a joke. everything is terribly slow and i often have to quit safari and re-open it to get acceptable performance. I put emphasis on "ACCEPTABLE"

HI,
*"I happen to be using SL and safari 4 is best "optimized" for the later OS X release."*
You are correct. Not only that, 10.6 includes malware and anti-virus protection that no previous Mac OS X has... read here.
http://www.apple.com/macosx/security/
Sorry to hear you are having problems with Safari. Let's see if we can get you going in the right direction as Safari 4.0.4 on 10.6.2 is running fine for me and many other Safari users.
If Safari unexpectedly quits, it could be a 3rd party plugins causing the problem. Go to ~/Library/Internet Plugins. Move any 3rd party plugins to the Trash and restart your Mac.
Also, if you are running Safari in 64 bit mode, try running in 32-bit mode instead. Right or control click the Safari icon in the Applications folder, then click: Get Info In the Get Info window click the black disclosure triangle next to General so it faces down. Select 32 bit mode. While you have the Get Info window open, make sure the boxes is Unchecked next to: Open using Rosetta
Quit Safari then relaunch.
The 10.6.2 combo update might help also.
http://support.apple.com/kb/DL959
You can download and install the Snow Leopard Cache Cleaner here if you like.
http://www.apple.com/downloads/macosx/systemdiskutilities/snowleopardcachecleaner.html
Carolyn

High CPU Utilization on ASA 5540

I have a remote site customer with a Cisco ASA 5540 running SSLVPN (Anyconnect)(8.03). It currently only serves about 450 SSLVPN clients. Since last friday, they've seen the CPU utilization go up to high 90% while only serving 400+ remote users. I saw some high cpu utilization bugs, but none looked to be relevant. Any ideas on how I can find the root cause of the CPU high utilization?

Hi rlortiz,
I ran into this issue as well on an ASA 5540 with only about 150 users. In the case if you are using large modulus operations including large key size certificates and a higher Diffie-Hellman group, it will cause for high processing.
Since the default method of processing these operations is software-based, it will cause higher CPU usage and also slower SSL/IPsec connection establishment.
If this is the scenario for you, use hardware-based processing by using the following configuration:
"crypto engine large-mod-accel"

High CPU utilization with JDesktopPane.OUTLINE_DRAG_MODE

Hello there,
since I updated from Java SDK 1.4.0 to 1.4.1_01 I recognized a problem with MDI Java applications using a JDesktopPane with JInternalFrames. When the drag mode of the internal frames is set to OUTLINE_DRAG_MODE, which should have a better performance than the LIVE_DRAG_MODE the cpu utilization goes nearly up to 100% an the drag of the frame is quite slow.
Does anybody else experience this problem?
(The problem exists in the application I develop and also in the IDE Netbeans, I use for development)
I am not sure if this is the right place for my problem, so if there is a better one to post it to, please tell me.
Thanks
R�diger

Hi,
I've also noticed this. It happens on Windows 2000 with 1.4.1, but not with version 1.4.0. Have you found a solution yet?
Martin

CSA causes cpu utilization spike in enforcement mode?

Similar Messages

Maybe you are looking for