Collect Performance Logs for CBX Agent

Products

• CBX Complete
• CBX Essentials

Issue/Introduction

Steps to collect specialized performance logs for the CBX Agent to help diagnose system performance degradation, such as high CPU or memory usage.

Environment

• CBX Agent
• Microsoft Windows: All Supported Versions

Resolution

Prerequisite: Windows Performance Recorder (WPR) must be installed on the endpoint. Confirm WPR is installed by running the command: wpr -status If installed: It will return the message "WPR recording is not running." If not installed: It will return the message "wpr is not recognized as an internal or external command..." Download Debugging Tools for Windows and at the "Select the features you want to download" install prompt deselect all other options except "Windows Performance Toolkit" which will include WPR

Generate WPR trace and verbose WPP logs

1. Download SymDiag v3 and open SymDiagwin.exe
2. The application will automatically check for and install any available updates when it opens.
3. Click I accept the EULA to proceed.
4. Select Task (Step 1): Leave the default option selected (Collect Product Data with Optional Product Logging) and click Next.
5. Select Products (Step 3):
   1. Set Endpoint Security Agent and Data Security logging to Enabled
   2. Under Endpoint Security Agent > Logging Options Click Advanced
   3. Set Trace Level to Verbose
   4. Click Ok, then click Next.
6. Scan Options (Step 4):
   • Set Run Logging to 5 minutes
   • Do not click next yet. Prepare to immediately reproduce the issue
7. Open an administrative command prompt
8. Paste the following WPR commandinto the command prompt, but do not press enter yet

   wpr -start GeneralProfile -start CPU -start Registry -start FileIO -start DiskIO -start Minifilter -start Network -filemode

9. Return to SymDiag and Click Next
10. Immediately switch back to the command prompt and press Enter to start the WPR trace.
11. Reproduce the behavior. Do not capture more than 5 minutes of logging.
    
    • Document exact steps taken to reproduce the issue
    • Note exact timestamps of any pertinent information (e.g., CPU Spike, clicked X button, delayed application window finally launches)
12. Stop WPR (Command prompt)

    wpr -stop c:\temp\wpr-%computername%.etl
    -- Replace c:\temp with desired path

13. Return to SymDiag and Click Next
14. Customer Information (Step 6): Fill out the Name, Company, Case, Contact, and Issue fields. Type or browse to the folder where you want to save the final .sdz3 diagnostic file, then click Next.

Optional - Collect a Procmon

If requested, separately collect a Low Altitude Procmon Capture while reproducing the issue again.