Forum Discussion
ATP sensor Consume most server CPU (60%)
MicrosoftThe sensor (if installed on a DC) will make sure at least 15% of RAM and CPU are free at all time.
other wise it will try to utilize any free resources to reduce data latency.
if the machine will get more busy, the limits will be adjusted and it will utilize less resources.
(It will auto adjust within ~ 10 sec)
Plus, if it's a new deployment, and this instance is a synchronizer candidate, it's expected to work harder during the first few hours until the initial AD sync completes.
For a standalone sensor, it assumes it can use all the machine resources without limits.
EliOfek We are facing very high CPU usage with one of our DCs. The sensor process seems to occupy most of the resources on this DC. COuld you please share some insight on remediating this? Also, we are seeing too many 8.8.8.8 connections on this server, not sure if this is linked! Any leads would be appreciated as always!
- EliOfek
mesaqee , it seems that the total CPU on the machine is 74%, so technically speaking there is no issue, and the sensor is not even throttling at this point.
Such consumption might be expected for high traffic scenarios.
What did the sizing tool had to say about this machine?
What is the hardware spec ? what is the busy packets/sec and max packets/sec ?the sensor itself won't initiate connections specifically to 8.8.8.8, but if you are running a DNS service on the machine that will except connections from 8.8.8.8, then it is expected that the sensor will try to get back to this endpoint to try and resolve it. most likely it's not related to the CPU usage.
Dear EliOfek ,
The server is based on a VM, attached are the complete hardware specs. The busy packets/sec=511 and max packets/sec=32,295.
Please see below the complete sizing tool output:
DC Sensor Supported Failed Samples Max Packets/sec Avg Packets/sec Busy Packets/sec Busy Packets/sec Start Time Busy Packets/sec End Time Min Avail MB Avg Avail MB Busy Avail MB Busy RAM Start Time Busy RAM End Time Total MB Max % CPU Time Avg % CPU Time Busy % CPU Time Busy CPU Start Time Busy CPU End Time Logical processors Processor Groups Core Count VM Indicator AD Site Time Zone Name Is DST OS Caption OS Build Number OS Installation Type OS Server Levels XXXXX Yes, but additional resources required: +1GB; +1 core 8 32,295 105 511 19:51:52 20:21:50 2,366 4,349 3,323 17:12:16 17:42:14 8,191 100 50 98 2:17:12 2:47:30 2 1 2 VMWare XXXXX (UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi Microsoft Windows Server 2019 Standard 17763 Server ServerCore; ServerCoreExtended; Server-Gui-Mgmt; Server-Gui-Shell - EliOfekWas one core added as suggested?
While the busy packets are low, the max is pretty high...
Is the high CPU you noticed is constant or spikes on certain hours ?
