High CPU utilization spikes are occurring at the same time every day on Linux Server running the DCS Agent

Products

• Data Center Security Server Advanced

Issue/Introduction

High CPU utilization spikes were being reported to be occurring at, or near the same time every day-- on two separate Linux Servers. The utilization spikes were lasting anywhere from 30 seconds to five minutes. 

The problem seemed to be happening after the DCS agent was installed on the RHEL 8 server(s)

Environment

Release : 6.9.1

 

Cause

An examination of the sisamdaemon logs showed that, at the time the CPU spike occurred (on both servers) the anti-malware program (AMD) was scanning the Oracle database folders which each of the two servers had installed on them.

Both servers had details gathered from sisamdaemon log found in .\var\log\sdcsslog\amdlog\

Details: 

computer-508   Feb. 11   23:41  (11:41pm)  Process: sisamdaemon 25% CPU           1.14GB Memory     

Anti-Malware scan (sisamdaemon) starts at 11:31:48pm and runs until 11:42:30pm               

At 11:31pm it starts heavy scanning in SQL and Oracle folders. In fact the last folders being scanned when the process completed were Oracle. Oracle is the second item in the process tree at 1.98 CPU and 1,002MB of Memory

Resolution

Modifying the exclusion policy for AMD and antivirus to exclude the folders containing the Oracle database files eliminated the problem. The CPU spike did not occur again.