Action Manager (acactmgr) service is consuming a high percentage of CPU usage.

Products

• CA Security Command Center
• CA Data Protection (DataMinder)
• CA User Activity Reporting

Issue/Introduction

Description

Important: This article contains information about modifying the registry. Before you modify the registry, make sure to create a back up of the registry and ensure that you understand how to restore the registry if a problem may occur.
For more information about how to back up, restore and edit the registry, please view the relevant Microsoft Knowledge Base articles on support.microsoft.com.

Solution

Important: This article contains information about modifying the registry. Before you modify the registry, make sure to create a back up of the registry and ensure that you understand how to restore the registry if a problem may occur.
For more information about how to back up, restore and edit the registry, please view the relevant Microsoft Knowledge Base articles on support.microsoft.com.

The purpose of the Action Manager is to complete the post processing of an event. The Action Manager reads the events from the queue files.

There are three queue files which are:

• AlertQueue
• CollectionQueue
• Default

There are several values that can be configured in order to tune the Action Manager to perform at its peak performance. See the Audit Reference Guide on registry settings to tune the Action Manager.

For CPU utilization, the major registry setting is the SleepTime value. The SleepTime is the amount of time in seconds the Action Manager will wait to reenter a queue directory to make another pass of the action manager queue files. The SleepTime value can be set to zero if necessary to keep up with a heavy load, but a value of zero runs the risk of using too much CPU time. If any one of the queue values is set to zero the Action Manager process will never go to sleep, no matter what the other queue values are. This could cause a high CPU utilization on a system. The default values for Audit SP2 are:

• AlertQueue = 1
• CollectionQueue = 1
• Default = 3

This value can be changed on Windows by editing a Registry key or on UNIX/LINUX by editing the eaudit.ini file.

Windows:

The following key contains the entry for the Action Manager:

My Computer\KEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\eTrust Audit\Client\Router\Queue Manager\Queues

The SleepTime can be set separately for each queue under the following three sub sections of the above registry key:

AlertQueue\Queue Parameters
CollectionQueue\Queue Parameters
Default\Queue Parameters

<Please see attached file for image>

In this example, the AlertQueue\Queue Parameters SleepTime value is set to 1. This is the default value of 1 second.

UNIX\LINUX:

The SleepTime value can be changed by editing the eaudit.ini file found in the following directory:
<AuditInstallDirectory>/ini
(i.e. /opt/CA/eTrustAudit/ini)

The settings are found in the eaudit.ini file in the Client { Router { Queue Manager { Queues. Each of the following parameters is set separately for each queue under the following three sub sections of the above eaudit.ini file:

AlertQueue { Queue Parameters
CollectionQueue { Queue Parameters
Default { Queue Parameters

<Please see attached file for image>

Modifying any of the Action Manager values requires the Action Manager to be recycled for the changes to take affect.

Environment

Release:
Component: ADTCTL