RE: esmproc.exe cpu and memory usage (Full Version)

All Forums >> [Networking & Security] >> GFI EventsManager



Message

mblinde -> RE: esmproc.exe cpu and memory usage (23.Jun.2009 10:30:59 AM)

I'm looking for any advice at all other then the canned, turn on debuging, upload to our FTP server, etc. There has to be something we can do to real this thing back in to something reasonable. We currently only collect Windows Events logs and W3C logs, no SNMP and no SYSLOG events. The SQL database is sitting on a separate SQL 2005 server with more then enough resources to handle this database amongst numerous others. I have verified connectivity to the database, made sure all of the rule sets are the same as our previous installation that was running on a Windows 2003 64x server, disabled data execution prevention, disabled anti-virus products, monitored the EventsManager job activity log for errors but there are none.

I'm stumped



DrewE -> RE: esmproc.exe cpu and memory usage (23.Jun.2009 10:39:55 AM)

Here is a small list of items I would be interested in knowing, not having debug logs available:

  • Is the SQL database "Auto Growth" setting set to grow by percent instead of MB ?This is very bad as a 10GB database can take a lot of time to grow 1GB (10%) before GFI can use the database again?
  • Is the SQL database "Recovery Model" (Properties of the Database, Options Page) Set to Full? This is also very bad for our software in most cases.
  • Are all machines trying to collect events in "real-time" (Under Configration -> Event Sources -> Properties of a GROUP of machines (Not the machine itself) - Ensure these groups are not set to real-time and have a setting closer to 2 - 5 minutes. It would be ideal if each group had a different time (1 - 5 minutes) to help stagger event collection.



imatone -> RE: esmproc.exe cpu and memory usage (24.Jun.2009 5:53:42 AM)

I'm running ESM8.2 Build20090302 on W2K8SP1 w/ E2K7SP1 using SQL2K8 Express and it's collecting events from half a dozen of servers w/o CPU & Memory hog. Well, that's a quad-core E5x00 server. I'm interested to see what you have in ur evtextractor_YYMMDD_xxxxxx.csv and vistacollector_YYMMDD_xxxxx.csv. There's gotta be some error there.



mblinde -> RE: esmproc.exe cpu and memory usage (24.Jun.2009 8:42:40 AM)

SQL database auto growth is set to MB not %, SQL datbase revoery model is simple, all of the collections groups are either set to 5 minutes, 10 minutes or 15 minutes.



mblinde -> RE: esmproc.exe cpu and memory usage (24.Jun.2009 8:55:13 AM)

There is a evtextractor*.csv but no vistacollector*.csv. Inside of the evtextractor*.csv almost every entry is information entries. Nothing glaring or sticking out at all. I've parse through the entire 38677 rows of entries and there is mainly nothing but information events that the collection started, logs were found etc ...



mblinde -> RE: esmproc.exe cpu and memory usage (24.Jun.2009 11:00:44 AM)

I noticed one of the servers was taking a very long time to collect W3C logs in the job monitor. I trimmed down some of the rules for W3C logs and it made a slight change. I removed the source and the CPU immediately dropped to 5% to 40% max. I added the resource back and everything is fine now. There are no errors in the .csv file about this server and no errors displaying in the job activity window. Not sure why this one resource was causing this but I'm just glad the thing is fixed!



DrewE -> RE: esmproc.exe cpu and memory usage (24.Jun.2009 4:33:20 PM)

I'm glad this is working well for you.  There were a few known issues a while ago about W3C Log collection, but I was under the impression these were resolved. If you see this issue again, please open a support form at http://support.gfi.com/Support/support.aspx?lcode=en so we can investigate.



Page: <<   < prev  1 [2]