ATP sensor Consume most server CPU (60%)

%3CLINGO-SUB%20id%3D%22lingo-sub-306097%22%20slang%3D%22en-US%22%3EATP%20sensor%20Consume%20most%20server%20CPU%20(60%25)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-306097%22%20slang%3D%22en-US%22%3E%3CP%3EIt%20is%20observed%20after%20installing%20ATP%20sensor%2C%20on%20domain%20controller%2C%20that%20more%20than%2060%20%25%20of%2016%20cores%20CPU%20are%20consumed%20by%20microsoft.tri.sensor.exe%20component%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-310217%22%20slang%3D%22en-US%22%3ERe%3A%20ATP%20sensor%20Consume%20most%20server%20CPU%20(60%25)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-310217%22%20slang%3D%22en-US%22%3E%3CP%3EDear%20All%2C%3C%2FP%3E%3CP%3EThanks%20for%20your%20support%2C%20it%20is%20observed%20after%20updating%20the%20current%20version%20to%26nbsp%3B%3CFONT%3E2.60.6070.18946%3C%2FFONT%3E%20the%20issue%20of%20CPU%20has%20been%20resolved.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-307626%22%20slang%3D%22en-US%22%3ERe%3A%20ATP%20sensor%20Consume%20most%20server%20CPU%20(60%25)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-307626%22%20slang%3D%22en-US%22%3E%3CP%3EWhat%20Eli%20described%20is%20documented%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure-advanced-threat-protection%2Fatp-architecture%23azure-atp-sensor-features%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E%2C%20under%20the%20%22%3CSPAN%3EResource%20limitations%3C%2FSPAN%3E%22%20bullet%20item.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-306105%22%20slang%3D%22en-US%22%3ERe%3A%20ATP%20sensor%20Consume%20most%20server%20CPU%20(60%25)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-306105%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20sensor%20(if%20installed%20on%20a%20DC)%20will%20make%20sure%20at%20least%2015%25%20of%20RAM%20and%20CPU%20are%20free%20at%20all%20time.%3C%2FP%3E%0A%3CP%3Eother%20wise%20it%20will%20try%20to%20utilize%20any%20free%20resources%20to%20reduce%20data%20latency.%3CBR%20%2F%3Eif%20the%20machine%20will%20get%20more%20busy%2C%20the%20limits%20will%20be%20adjusted%20and%20it%20will%20utilize%20less%20resources.%3C%2FP%3E%0A%3CP%3E(It%20will%20auto%20adjust%20within%20~%2010%20sec)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPlus%2C%20if%20it's%20a%20new%20deployment%2C%20and%20this%20instance%20is%20a%20synchronizer%20candidate%2C%20it's%20expected%20to%20work%20harder%20during%20the%20first%20few%20hours%20until%20the%20initial%20AD%20sync%20completes.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20a%20standalone%20sensor%2C%20it%20assumes%20it%20can%20use%20all%20the%20machine%20resources%20without%20limits.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

It is observed after installing ATP sensor, on domain controller, that more than 60 % of 16 cores CPU are consumed by microsoft.tri.sensor.exe component

3 Replies
Highlighted

The sensor (if installed on a DC) will make sure at least 15% of RAM and CPU are free at all time.

other wise it will try to utilize any free resources to reduce data latency.
if the machine will get more busy, the limits will be adjusted and it will utilize less resources.

(It will auto adjust within ~ 10 sec)

 

Plus, if it's a new deployment, and this instance is a synchronizer candidate, it's expected to work harder during the first few hours until the initial AD sync completes.  

 

For a standalone sensor, it assumes it can use all the machine resources without limits.

Highlighted

What Eli described is documented here, under the "Resource limitations" bullet item. 

Highlighted

Dear All,

Thanks for your support, it is observed after updating the current version to 2.60.6070.18946 the issue of CPU has been resolved.