Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

CSA causes cpu utilization spike in enforcement mode?

I am experiencing a problem where two servers (specifically a file a server and a Citrix server) are experiencing spikes in CPU utilization (maxing out at 100% util) whenever we take them out of "Test" mode.

These systems are running CSA v4.5-1 build 616 agents. In order to stop the CPU issue, we had to stop the agent (which dropped the processor util immediately), put the system back into a "Test" state, restart the agent, and poll the server.

Now that the server is back in a Test state, the CPU problem doesnt exist.

Any thoughts or suggestions would be greatly appreciated.

4 REPLIES
Blue

Re: CSA causes cpu utilization spike in enforcement mode?

What groups, policies and events are associated with the servers?

Are there corresponding Windows events?

What other processes are running on the servers?

Are there other similar servers in different groups that aren't having the issues?

One thing you could try is to put one of the servers in a group with minimal policies (Required Windows?) and see how it behaves.

The other thing would to put different policies in test mode...

Tom S

New Member

Re: CSA causes cpu utilization spike in enforcement mode?

I put the server in (the default group), and it is still experiencing the same problem.

It is currently not running any other policies/group associations.

There are other servers experiencing the same problem. I have tried putting them into the only, and they have the same problem.

No Windows events worth mentioning.

Blue

Re: CSA causes cpu utilization spike in enforcement mode?

CSA is trying to do a lot of work but it isn't logging anywhere because it's set not to.

1. Create a new group called "Windows test".

2. Clone the policies in the group and add them to the new group.

3. Change all the rules in those cloned policies to log.

4. Put the group in test mode.

5. Put a problem server in the group and see what events are generated.

You should see what's causing the problem without killing the server in the process.

Then you'll be able to either except the process or disable the rule causing it (if that's safe).

You also didn't mention what process is spiking the CPU.

Tom S

New Member

Re: CSA causes cpu utilization spike in enforcement mode?

Thanks for the tip, I will try this.

The okclient is actually what is spiking -- its taking up 40+% of the CPU utilization.

102
Views
7
Helpful
4
Replies