Submit a ticketCall us

Solarwinds & Cisco Live! Barcelona
Join us from the 29th of January to the 2nd of February at Cisco Live 2018 in Barcelona, where we will continue to show how monitoring the network with SolarWinds will keep you ahead of the game. At our booth (WEP 1A), we will demonstrate how SolarWinds network solutions can help. As a bonus, we are also hosting a pre-event webinar - Blame the Network, Hybrid IT Edition with our SolarWinds Head Geek™, Patrick Hubbard on January 24th - GMT (UTC+0): 10:00 a.m. to 11:00 a.m. There's still time to RSVP.

Home > Success Center > Network Performance Monitor (NPM) > SolarWinds services consume 100% of CPU when HBSS HIPS is installed

SolarWinds services consume 100% of CPU when HBSS HIPS is installed

Created by Justin Wyllys, last modified by Su-Lyn Rosenberry-ret on Dec 12, 2016

Views: 1,521 Votes: 0 Revisions: 14

Overview

This article describes the issue when after HBSS/HIPS is installed on a SolarWinds server, the server's CPU usage heavily increases up to 100% and stays there. 

Environment

All Core products and modules

Cause 

New government regulations may require HBSS HIPS to be installed on their servers. The Host Intrusion Prevention Software (HIPS) can do anything to applications, even injecting custom code to their process and participating in the execution flow. 

 

As the HBSS implementation is a new government requirement, they have to adjust their environments accordingly. It's not actually our products consuming their CPU power, rather it is the application protection feature.

 

They may just need to throw a lot more power at the machines to compensate, but if that is not possible they will need to make exclusions or uninstall the HBSS HIPS software. 

 

Note: HIPS-like products very often do not play well with virtualization – we recommend moving the Orion servers to physical hardware. 

Resolution

Depending on the environment, you may have to do one or more of the following:

  • Increase hardware resources, including moving from a VM to a more powerful physical server
  • Exclude all SolarWinds processes, database files, and their dependencies from the Application Protection List (Not the Trust Application List, which is separate)​, details included below. 
  • All ports normally used by Orion must not be blocked and allow our traffic through.
  • Uninstall HBSS & HIPS.

 

SolarWinds Processes to exclude from the Application Protection List:

  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine.v2\SWJobEngineSvc2.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine.v2\SWJobEngineWorker2.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine\SWJobEngineSvc.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine\SWJobEngineWorker.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\Collector\SolarWinds.ManagementAgent.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\Collector\SolarWinds.DataProcessor.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\Collector\SolarWinds.PollingController.exe
  • C:\Program Files (x86)\SolarWinds\Orion\SyslogService.exe
  • C:\Program Files (x86)\SolarWinds\Orion\TrapService.exe

 

SolarWinds service dependencies to exclude from the Application Protection List:

  • C:\Windows\System32\mqsvc.exe    (MSMQ)
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe   (Net.Tcp Port Sharing Service)         
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe   (Net.Tcp Port Sharing Service)
  • C:\Windows\SysWOW64\inetsrv\w3wp.exe    (IIS)
  • C:\Windows\System32\inetsrv\w3wp.exe  (IIS)

 

SDF files (scheduled jobs and just-processed jobs) to exclude from the Application Protection List:

  • C:\ProgramData\Solarwinds\Collector\Data\JobsTracker.sdf
  • C:\ProgramData\Solarwinds\Collector\Data\PollingController.sdf
  • C:\ProgramData\Solarwinds\JobEngine.v2\Data\JobEngine35.sdf
  • C:\ProgramData\Solarwinds\JobEngine.v2.agent\Data\JobEngine35.sdf
  • C:\ProgramData\Solarwinds\JobEngine\Data\JobEngine35.sdf

 

Last modified

Tags

Classifications

Public