ISA 100% CPU usage !!!
|
Logged in as: Guest
|
|
Users viewing this topic:
none
|
|
Login  | |
|
ISA 100% CPU usage !!! - 18.May2006 11:54:47 AM
|
|
|
adamsville2k
Posts: 5
Joined: 18.May2006
Status: offline
|
Hi,
Since last week, downloading file makes the ISA CPU usage at 100% because of engine scanning feature! Because of that, even browsing the web is a lot slower for clients. What went wrong? I did any changes last week but installing latest MS hotfixes which I do every time there are availables! Site Rating is enable and Web traffic scanning uses the 3 engines.
Server facts:
Win2k SP4 ISA 2000 SP2 running WEBGFIMonitor 3.1.421 build 20060130
Thanks in advance.
Adam
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 19.May2006 4:13:06 AM
|
|
|
Patrizia
Posts: 8474
Joined: 18.Aug.2003
From: Malta
Status: offline
|
Hello Adam,
Are you running any anti-virus software on the ISA server machine? If so, can you ensure that the downloads and thw WebMonitor folder are not being scanned by the Anti-Virus software?
_____________________________
Patrizia Caruana
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 19.May2006 9:03:24 AM
|
|
|
adamsville2k
Posts: 5
Joined: 18.May2006
Status: offline
|
Thanks for relpying. I noticed that comment yesterday in another topic and yes I did remove Webmonitor folder from scanning but it did not work. This morning, I did check again and added subfolder in the exclusion which in fact solved the problem. You were right, by doing this, it won't affect CPU anymore BUT I still have the 100% CPU usage while the file is downloaded and being scanned by the 3 engines! Can you tell me were is located the temporairy download file while it's being scanned so I can add that folder in the Anti-Virus exclusion list? Another thing I don't understand, though removing the Webmonitor folder from th AV scanning process solve the CPU usage problem now, there was no problem till last week and Webmonitor folder wasn't and the exclusion list?
Thanks in advance.
Adam
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 22.May2006 6:52:14 AM
|
|
|
Nicks
Posts: 2741
Joined: 17.Mar.2003
Status: offline
|
Adam,
The scanning of the GFI folders by 3rd party virus scanning software produces strange results. Also, an update to your file virus scanner may have started the problem.
The files are downloaded to a sub-folder of the WebMonitor directory. I would recommend that you exclude all the WebMonitor directory and all sub-directoriees.
Which process is taking up the CPU usage?
Thank you.
_____________________________
Nicholas Sciberras
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 23.May2006 8:39:30 AM
|
|
|
adamsville2k
Posts: 5
Joined: 18.May2006
Status: offline
|
Hi Nicholas,
Yes you are right about this.I had a similar problem with Mcafee in an previous version and Win98 years ago. I removed Webmonitor and subfolders from scanning though it still takes CPU usage... I can't tell you what process is now taking all CPU usage because when scanning the downloaded file, the server is so slow it takes forever to get response from it... I'll try to find it though.
Steve
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 24.May2006 8:53:57 AM
|
|
|
adamsville2k
Posts: 5
Joined: 18.May2006
Status: offline
|
HI,
I first disabled Mcafee and noticed that there was no change regarding the CPU usage while scanning downloaded files. Running Perfomance Monitor on processes I saw that both Kavss and WMonAvScan were taking all the CPU processing time so I disabled Kavss and WMonAvScan still uses all the CPU time. This is the latest notes I got from the testing process.
Steve
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 25.May2006 8:18:52 AM
|
|
|
Nicks
Posts: 2741
Joined: 17.Mar.2003
Status: offline
|
Hi,
What are the machine specifications?
Also, you may want to use Task Manager (processes tab) to check which processes are using the CPU mostly.
Thanks
_____________________________
Nicholas Sciberras
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 25.May2006 3:33:43 PM
|
|
|
adamsville2k
Posts: 5
Joined: 18.May2006
Status: offline
|
Hi Nicks,
I mentionned the programs that are taking up the most CPU time while scanning downloaded files in the previous post. You may be right on the hardware though. So far the ISA server was doing the job properly but it's an old server and it maybe time to replace it with a more powerfull machine.
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 31.May2006 10:41:40 AM
|
|
|
RayPesek
Posts: 246
Joined: 7.May2004
Status: offline
|
Here's what I'm seeing:
System:
--------
Windows 2003 Server Standard SP1 on SCSI RAID 1
ISA 2004 SP2 + post SP2 hotfix
3 GB of RAM
Dual 1.2 GHz Pentium III processors
All three virus scanners running
Even with me as the sole user, I can drive the total CPU utilization to 100% simply by downloading a large file, say 200+ MB (think SAP patches, AV downlaods, etc.) Normal CPU utilization is less than 10%.
I see:
WMonAVNScan.exe as high as 45%
WMonAVScan.exe usually at 50%
At least one of the KVASS around 35%
although obviously not at the same time. It's usually the last two that catch my eye.
It strikes me as odd that I never see the GFI processes over 50%. It's like it's not multi-processor aware. When I right-click on any of the WM* or KV* process in Task Manager, they're all set for Normal priority and all of them have both CPU-0 and CPU-1 checked for the processor affinity.
Is it safe to maybe restrict the GFI processes to just one processor using the affinity setting? If so, does it matter which one? I'm using the May 15th beta.
I'm thinking that if I restrict WebMonitor to just one CPU, the download scanning will take longer but it won't shut down ISA's responsiveness for everyone else.
Thanks,
Ray
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 1.Jun.2006 5:40:30 AM
|
|
|
Nicks
Posts: 2741
Joined: 17.Mar.2003
Status: offline
|
Hi,
When a large file file is being scanned, it would be expected that WebMonitor makes use of as much CPU as possible to scan the file quickly. If it is a smaller file, it will still make use of the CPU, but for less period of time.
The problem will arise if both WebMonitor and ISA server are running on a machine which is not very powerful so as to allow both WebMonitor and ISA server to do their job simultenously.
I'll check further regarding dual processors, and get back to you later.
Thank you.
_____________________________
Nicholas Sciberras
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 1.Jun.2006 5:54:32 AM
|
|
|
Nicks
Posts: 2741
Joined: 17.Mar.2003
Status: offline
|
Hi again,
WebMonitor does make use of multiple processors for the monitoring of web access, however when doing Anti-Virus scanning for files, each Anti-Virus has its own implementation on how and when to take advantage of multiple processors.
_____________________________
Nicholas Sciberras
GFI Software - www.gfi.com
Messaging, Content Security & Network Security Software
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 1.Jun.2006 8:18:00 AM
|
|
|
RayPesek
Posts: 246
Joined: 7.May2004
Status: offline
|
Thanks. I have all of the NICs bound just to CPU-0, so I'd like to push the scanners off to CPU-1. Are these assumptions correct as to which process is doing what?
WMonAVNScan.exe - Norman
WMonAVScan.exe - BitDefender
4 ea. KVASS - Kaspersky
If so, I might just push just the first one to only one CPU first, since that's the one that usually locks itself at 50%.
Thanks,
Ray
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 2.Jun.2006 9:39:30 PM
|
|
|
RayPesek
Posts: 246
Joined: 7.May2004
Status: offline
|
I removed *.microsoft.com from the scan exclusions because I wanted to see how WebMonitor (the new version) handled a large download. I downloaded Server 2003 SP1, all 329 MB of it.
The offending process is one of the four kvass.exe scanners. While three of them were running about 5.8 MB to 6.1 MB of RAM during the scan, the third one in the list kept the processor nailed to very near 100% and it also kept increasing its memory usage throughout the 10+ minutes it took to scan the file. It reached a maximum memory usage of 380 MB (not a typo).
I could tell when the scan ended because all of a sudden its memory usage dropped to about 13 MB versus about 1 MB for each of the other three. I've got screen captures of the task list as the scan neared its end as well as after it ended if you need to see them.
Thanks,
Ray
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 2.Jun.2006 10:07:06 PM
|
|
|
RayPesek
Posts: 246
Joined: 7.May2004
Status: offline
|
Several minutes after the download ended, three of the kvass.exe processes were sitting at 200 K of RAM usage, while the offending one was at 6 MB.
I killed that one off so only three kvass.exe's were running. After another 329 MB download, it took less than ten seconds for Norman and BitDefender to report "success" and a "threat" that the Kaspersky engine had failed. It did not give me the option to save the file. Will a failed engine generate an email alert?
So I tried it again, except this time I disabled Kaspersky through the web interface. The other two scanners completed the scan of the 329 MB file in about five seconds.
FWIW,
Ray
|
|
|
|
|
RE: ISA 100% CPU usage !!! - 3.Jun.2006 11:07:44 AM
|
|
|
RayPesek
Posts: 246
Joined: 7.May2004
Status: offline
|
I forgot to mention that these tests using the Server 2003 SP1 download were done on my test system, with just me using it. It's a single processor box.
After re-reading it I thought people would be confused by my previous comment that the WebMonitor processes only went to 50% (that was the dual processor box) but kvass.exe went to the high 90's in the test (the single processor box).
Ray
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
Printable Version
