Forum Discussion

Nashaat Sorial's avatar
Nashaat Sorial
Copper Contributor
Dec 23, 2018

ATP sensor Consume most server CPU (60%)

It is observed after installing ATP sensor, on domain controller, that more than 60 % of 16 cores CPU are consumed by microsoft.tri.sensor.exe component

  • The sensor (if installed on a DC) will make sure at least 15% of RAM and CPU are free at all time.

    other wise it will try to utilize any free resources to reduce data latency.
    if the machine will get more busy, the limits will be adjusted and it will utilize less resources.

    (It will auto adjust within ~ 10 sec)

     

    Plus, if it's a new deployment, and this instance is a synchronizer candidate, it's expected to work harder during the first few hours until the initial AD sync completes.  

     

    For a standalone sensor, it assumes it can use all the machine resources without limits.

    • mesaqee's avatar
      mesaqee
      Copper Contributor

      EliOfek We are facing very high CPU usage with one of our DCs. The sensor process seems to occupy most of the resources on this DC. COuld you please share some insight on remediating this? Also, we are seeing too many 8.8.8.8 connections on this server, not sure if this is linked! Any leads would be appreciated as always!

      • EliOfek's avatar
        EliOfek
        Icon for Microsoft rankMicrosoft

        mesaqee , it seems that the total CPU on the machine is 74%, so technically speaking there is no issue, and the sensor is not even throttling at this point.

        Such consumption might be expected for high traffic scenarios.

        What did the sizing tool had to say about this machine?
        What is the hardware spec ? what is the busy packets/sec and max packets/sec ?

         

        the sensor itself won't initiate connections specifically to 8.8.8.8, but if you are running a DNS service on the machine that will except connections from 8.8.8.8, then it is expected that the sensor will try to get  back to this endpoint to try and resolve it. most likely it's not related to the CPU usage.

      • Nashaat Sorial's avatar
        Nashaat Sorial
        Copper Contributor

        Dear All,

        Thanks for your support, it is observed after updating the current version to 2.60.6070.18946 the issue of CPU has been resolved.

Resources