High CPU Usage By The SISIPS or SISIDS Service/Daemon on The Symantec Critical System Protection (SCSP) Agent.

Products

• Critical System Protection

Issue/Introduction

Why has the cpu usage gone up for the sisips or sisids service/daemon?

Symptoms
Slow running, sluggish OS. CPU spiking to 90-100%

 

Cause

This may be caused by a recently applied IPS or IDS policy

Resolution

The best way to determine which policy is causing high CPU activity is to remove each policy until the problem goes away. Then, slowly re-introduce all policies except for the last one you removed to determine if the effects are cumulative or actually due to the single policy. This can be a slow process, so if a record exists of the most recent policies that have been applied, it would be best to begin with the most recent applied policy and work backward.

Other things to consider is whether the high CPU activity is specific to certain OS's, or hardware platforms, or if the high CPU exists on all agents. Reviewing the agent logs and the system logs may also produce a clue that may assist in identifying a cause. Of course, verifying the resources on each agent that is having this problem would be the very first step in identifying the root cause. Some policies require more processing than others.