Submit a ticketCall us

WebinarFREE IT Monitoring Webcast

Don’t miss out on our webcast, Essential IT Monitoring with SolarWinds ipMonitor, where we will show you how to keep an eye on your IT environment from one centralized, affordable, and lightweight monitoring tool: SolarWinds® ipMonitor®.

Register now.

Home > Success Center > Network Performance Monitor (NPM) > NPM - Knowledgebase Articles > SolarWinds services consume 100% of CPU when HBSS HIPS is installed

SolarWinds services consume 100% of CPU when HBSS HIPS is installed

Created by Justin Wyllys, last modified by Su-Lyn Rosenberry-ret on Dec 12, 2016

Views: 1,747 Votes: 0 Revisions: 14


This article describes the issue when after HBSS/HIPS is installed on a SolarWinds server, the server's CPU usage heavily increases up to 100% and stays there. 


All Core products and modules


New government regulations may require HBSS HIPS to be installed on their servers. The Host Intrusion Prevention Software (HIPS) can do anything to applications, even injecting custom code to their process and participating in the execution flow. 


As the HBSS implementation is a new government requirement, they have to adjust their environments accordingly. It's not actually our products consuming their CPU power, rather it is the application protection feature.


They may just need to throw a lot more power at the machines to compensate, but if that is not possible they will need to make exclusions or uninstall the HBSS HIPS software. 


Note: HIPS-like products very often do not play well with virtualization – we recommend moving the Orion servers to physical hardware. 


Depending on the environment, you may have to do one or more of the following:

  • Increase hardware resources, including moving from a VM to a more powerful physical server
  • Exclude all SolarWinds processes, database files, and their dependencies from the Application Protection List (Not the Trust Application List, which is separate)​, details included below. 
  • All ports normally used by Orion must not be blocked and allow our traffic through.
  • Uninstall HBSS & HIPS.


SolarWinds Processes to exclude from the Application Protection List:

  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine.v2\SWJobEngineSvc2.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine.v2\SWJobEngineWorker2.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine\SWJobEngineSvc.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine\SWJobEngineWorker.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\Collector\SolarWinds.ManagementAgent.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\Collector\SolarWinds.DataProcessor.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\Collector\SolarWinds.PollingController.exe
  • C:\Program Files (x86)\SolarWinds\Orion\SyslogService.exe
  • C:\Program Files (x86)\SolarWinds\Orion\TrapService.exe


SolarWinds service dependencies to exclude from the Application Protection List:

  • C:\Windows\System32\mqsvc.exe    (MSMQ)
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe   (Net.Tcp Port Sharing Service)         
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe   (Net.Tcp Port Sharing Service)
  • C:\Windows\SysWOW64\inetsrv\w3wp.exe    (IIS)
  • C:\Windows\System32\inetsrv\w3wp.exe  (IIS)


SDF files (scheduled jobs and just-processed jobs) to exclude from the Application Protection List:

  • C:\ProgramData\Solarwinds\Collector\Data\JobsTracker.sdf
  • C:\ProgramData\Solarwinds\Collector\Data\PollingController.sdf
  • C:\ProgramData\Solarwinds\JobEngine.v2\Data\JobEngine35.sdf
  • C:\ProgramData\Solarwinds\JobEngine.v2.agent\Data\JobEngine35.sdf
  • C:\ProgramData\Solarwinds\JobEngine\Data\JobEngine35.sdf


Last modified