ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

High CPU utilization spikes are occurring at the same time every day on Linux Server running the DCS Agent

book

Article ID: 238297

calendar_today

Updated On:

Products

Data Center Security Server Advanced

Issue/Introduction

High CPU utilization spikes were being reported to be occurring at, or near the same time every day-- on two separate Linux Servers. The utilization spikes were lasting anywhere from 30 seconds to five minutes. 

The problem seemed to be happening after the DCS agent was installed on the RHEL 8 server(s)

Cause

An examination of the sisamdaemon logs showed that, at the time the CPU spike occurred (on both servers) the anti-malware program (AMD) was scanning the Oracle database folders which each of the two servers had installed on them.

Both servers had details gathered from sisamdaemon log found in .\var\log\sdcsslog\amdlog\

Details: 

computer-508   Feb. 11   23:41  (11:41pm)  Process: sisamdaemon 25% CPU           1.14GB Memory     

Anti-Malware scan (sisamdaemon) starts at 11:31:48pm and runs until 11:42:30pm               

At 11:31pm it starts heavy scanning in SQL and Oracle folders. In fact the last folders being scanned when the process completed were Oracle.   Oracle is the second item in the process tree at 1.98 CPU and 1,002MB of Memory.

At the time of the CPU spike (as per the screenshot that was uploaded) the following error was thrown:

Environment

Release : 6.9.1

 

Resolution

Modifying the exclusion policy for AMD and antivirus to exclude the folders containing the Oracle database files eliminated the problem. The CPU spike did not occur again.