High CPU usage on ULM clients during Patch Assessment scans

Products

• IT Management Suite

Issue/Introduction

Administrators may observe elevated CPU usage on endpoint devices running the ULM agent with frequent patch assessments. This overhead is typically caused by the recurring evaluation of software bulletins and and package verifications.

Environment

Patch Management Solution 8.8 and earlier

Cause

By design

Resolution

To improve overall system responsiveness on ULM clients, Broadcom recommends increasing the patch assessment interval from the default setting. This reduces how often clients reassess their patch status, leading to improved performance with minimal impact on compliance.

 

To adjust the patch assessment frequency:

1. Open the Symantec Management Console.

2. Navigate to:
   Settings > Software > Patch Management > Linux System Assessment Scan

3. Increase the value (recommended: 24 to 72 hours depending on environment sensitivity) (Default 4 hours).

   • For typical environments: 24 hours is often a good balance.
   • For stable or low-change systems: Up to 72 hours may be appropriate.

   Separate policies can be created targeting different resources.

4. Click Save Changes.

 

Benefits

• Reduces CPU spikes on client endpoints during frequent assessments.
• Lowers background processing overhead without sacrificing timely patch compliance for most environments.

Considerations

•     Critical patching windows should still be managed with scheduled patch deployments and targeted compliance reporting.
•     For high-security environments, consult your internal risk policies before extending intervals beyond 24 hours.
•     Monitor patch compliance reports to ensure extended intervals do not introduce unacceptable exposure.