Forum Discussion
ATP sensor Consume most server CPU (60%)
DearEliOfek ,
The issue is still there even after increasing the server capacity.
We re-ran the sizing tool, and here are the results:
| DC | Sensor Supported | Failed Samples | Max Packets/sec | Avg Packets/sec | Busy Packets/sec | Busy Packets/sec Start Time | Busy Packets/sec End Time | Min Avail MB | Avg Avail MB | Busy Avail MB | Busy RAM Start Time | Busy RAM End Time | Total MB | Max % CPU Time | Avg % CPU Time | Busy % CPU Time | Busy CPU Start Time | Busy CPU End Time | Logical processors | Processor Groups | Core Count | VM Indicator | AD Site | Time Zone Name | Is DST | OS Caption | OS Build Number | OS Installation Type | OS Server Levels |
| XXXXX.local | Yes | 0 | 2,264 | 139 | 181 | 09:51:47 | 10:06:45 | 4,623 | 5,193 | 4,725 | 04:03:52 | 04:18:49 | 10,239 | 100 | 11 | 69 | 12:58:17 | 13:13:20 | 4 | 1 | 4 | VMWare | HXXXX | (UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi | Microsoft Windows Server 2019 Standard | 17763 | Server | Remote Registry Query Failed |
Appreciate if you can provide some more insights around this.
Thanks,
Saqib
Microsoft- EliOfek
aafar Your description is too generic to spot the root cause.
This is something that would best be handled via a support ticket, as given the machine details we can track it's telemetry remotely to better understand what is happening and why.
General note: assuming this is not a standalone sensor you are talking about (in which case it's normal for it to consume all available resource), the sensor is designed to throttle it's cpu and memory consumption to make sure the server has at least 15% free cpu/memory at all times.
So while high cpu can be "by design" if traffic on the machine is high, exhaustion should not really happen unless something really bad happen and the resource manager fail to do it's job, which is unlikely. - Has anyone else seen this issue? I've been experiencing high CPU usage/exhaustion due to tri.sensor and tri.sensor updater over the last week or so. I followed links in this thread but did not see anything that helps the issue.
- EliOfekCheck the local logs of the sensor and updater to see if there is any clue to why it fails to start.
Also make sure you have the WmiApSrv service starting correctly.
If no clues, you need a support ticket to go forward... EliOfek Well after upgrading the capacity the usage was pretty high and we were even getting the "Some network traffic could not be analyzed" alert. However, we are now unable to see the trend as the Sensor service is not starting. On trying to manually start it, we are getting the below error:
We have tried rebooting the server and re-installed the sensor, but the service is still not running. Shall we contact support to have a detailed look or you got any further suggestions?
Thanks,
Saqib
