Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

CSA spiking CPU in Test Mode

I have installed CSA 5.1 onto two web servers (farm) and two SQL servers that work together. I simply installed the default Windows "Test Mode Server" and left it at that.

Under load (Mercury load test) the SQL servers experienced about 1-2% increase in cpu utilization but the web servers experienced >10% increase.

The servers are HP DL360 G3 with dual Xeon HT >3Ghz processors & 2G RAM. They are running Win Svr 2003 SP1.

The baseline cpu for the two servers was: min/avg/max

0/20.388/88.542 & 0/20.953/73.567 respectively.

The cpu with CSA was:

0/31.857/97.941 & 0/30.362/93.751.

These test results will prevent me from deploying CSA to production. Especially with the peaks approaching 100%.

Do you think ...? -

a) There is a problem

b) This is normal and can be configured to perform better

c) This is normal and it can't be avoided

I may be able to post the test result graphs if that could help.

-Oh, and the testers also saw network output increase by 100 to 500k per second. Does that sound right?

Thanks, Scott


Re: CSA spiking CPU in Test Mode

There is a good chance the answer is "b" but it's based on the version of CSA you are running. What is it?

Here are a couple of things to try:

Remove the servers from the "Servers - All types" group and leave them in the test mode group. They should have no policies attached. Let them run and benchmark them again.

If they don't show any appreciable hit in performance, then it's the rules causing the slowdown (and it may be because it's in test mode).

If that's the case, the next step is to put them in their respective groups (SQL and IIS) but leave them out of the "Servers - All types" group for now.

Benchmark them again and check the event logs to see what's triggering.

Basically it's going to take some tuning based on what the servers do.

If putting them in the test mode group only does not fix the performance issue then it's the agent (and maybe the shim) causing the problem. I'm guessing these are dual NIC machines?

Tom S

New Member

Re: CSA spiking CPU in Test Mode

Tom, thanks a lot for your response. I have to reserve time in our staging environment so it's taken a few days to get back to this.

When I simply remove the machines from the "Servers - All types" group they remain in the "Systems - Test Mode" group. They also still have the policies "Application Classification" (3 modules) and "Operating System - Base Permissions - Windows" (2 modules). Are you suggesting that I remove these two policies as well?

Also, these are dual NIC machines but each currently has its second NIC disabled (unlike in production).

Thanks a lot! Scott


Re: CSA spiking CPU in Test Mode

Hi Scott. Yes, I am suggesting you run those hosts in test mode with no policies. Maybe create a group just for that purpose.

I think the key for now is going to be finding out what is NOT causing the problem.

If they function OK with no policies then you can start adding things.

If that works OK then try them in protect mode. Even if it doesn't work, try them in protect mode. I could be that test mode is overwhelming the system.

Good luck!

Tom S

New Member

Re: CSA spiking CPU in Test Mode

Ok. To review: the IIS servers had a cpu spike and the sql servers did not.

So: I took the IIS servers out of the "Servers - All Types" group and left them in "Systems - Test Mode."

We still saw the increased cpu utilization (from no-csa = 20% to with-csa = 30%).

One thing I noticed is that once I removed them from any group with policies attached I could no longer run the agent console. The icon even left the system tray.

Now I have removed the servers from the "Systems - Test Mode" group but they now show up as "Test mode: yes" and Send Polling Hint: On (unavailable). I also can't ask the agent to poll because I can't run the agent console. I tried stopping/starting the service but nothing happened.

So, is it true...

-That you must have some policy attached to use the agent console?

-That an agent will never poll again if it has no policies attached?

-That I'm just missing something?

Thanks a lot,



Re: CSA spiking CPU in Test Mode

I ran in to the same issue. Apparently you need to have an Agent UI policy in order to get access to the UI.

Here is the text from page 6-7 of the 5.1 manual:

Use the Agent UI rule to control how the agent user interface is displayed to end

users. See Figure 6-2. In the absence of this rule, end users have no visible agent


Sorry for throwing that into the mix...

Tom S

CreatePlease to create content