[ossec-list] Re: Behavior of MS Windows "Agent"

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Ed,

That's very strange... Even when the agent starts and scans the system it should
not use that much CPU. Does this problem goes away after 20/30 minutes?
Are you using version 1.2? There are some ways to reduce the CPU usage on the
agent, but in your case it looks like a different issue...

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 5/23/07, Vazquez, Ed <evazquez@xxxxxxxxxxxx> wrote:
> Here's an odd one for you.
>
> Three different systems.
>
> One running Win2K3 Server on a quad Xeon, one running WinXP Pro x64 on
> a dual Athlon, one running Win2K3 Server x64 on a Core2 Duo.
>
> On all three, the OSSEC agent chewed up _minimum_ of 45% of the CPU
> cycles along with using /accessing lsass and services, accounting for
> the remaining 55%.  This lead to 100% CPU utilization on all
> platforms.
>
> Ouch.
>
> Is there some trick to the client that I'm missing?
> Incompatibilities?  Further debug data I can provide?
>
> Thanks,
>
> --
> Ed Vazquez
>
> New: It comes in different colors from the previous version.
> 23 May 2007 13:54:40
>
>