MonitorWare Knowledge Base

Server
Dual 2.8 GHz Xeon
1 GB RAM

EventReporter Version 6.3.216
Client Version 6.3.148

I'm watching my CPU usage systematically jump from 0% to 50-60%. This is not a problem on this server. I'm concerned about what will happen on my exchange server where I have a high CPU utilization.

Thanx
sbg31

Hi,

it depends on how EventReporter is configured. But it should create such CPU usage bursts. By default the overrun prevention is set to 5 milli seconds which also avoids CPU bursts during processing.

As you say it is systematically, can you check the following in the taskmanager:
- Does kernel CPU usage also increases?
- In Processes list when you sort by CPU usage (Descending), which process do you see on top when these CPU burst occur?

regards,
Andre

To add to Andre's comments: a CPU burst can occur if you have a relatively large sleep time (larger in respect to events logged per minute) and set the overrun protection to a very low value, e.g. 0. A shorter sleep interval creates very little additional overhead but allows for smoother operation. Also, setting the overrun prevention to a value of 1 (or higher) should avoid any CPU bursts.

Finally, the process priority setting can be configured (in general options). If you set it to "low", Windows will ensure that EventReporter is only executed when the "normal" applications have left idle time. So it actually does not take any CPU cycles away from your applications (like exchange).

I hope this is helpful.

Best regards,
Rainer Gerhards
Adiscon

Andre and Rainer,

Thank you both for your quick response.

The Kernel CPU does increase.

When viewing the processes, I don't believe that evntslog.exe is ever at the top. It's usually second or third in the list. I have a HIDS agent that usually runs at the top.

During the burst evntslog.exe will jump over the HIDS agent for a brief second.

Thanx,
sbg31

Hi,

hrm kernel usage could lead to some driver.
Could you post a screenshot of taskmanager? This would help to get a better picture

Oh and how does your configuration look like (just approx what services and rulesets are configured)?

regards,
Andre