Submit a ticketCall us

WebinarUpcoming Webinar: Know What’s Changed – with NEW Server Configuration Monitor

Change management in IT is critical. But, even with a good change management process, changes are too often not correctly tracked, if at all. The configuration of your servers and applications is a key factor in their performance, availability, and security. Many incidents can be tracked back to an authorized (and sometimes unauthorized) configuration change, whether to a system file, configuration file, or Windows® Registry entry. Join SolarWinds VP of product management Brandon Shopp to discover how the new SolarWinds® Server Configuration Monitor is designed to help you.

Register now.

Home > Success Center > Network Performance Monitor (NPM) > SolarWinds services consume 100% of CPU when HBSS HIPS is installed

SolarWinds services consume 100% of CPU when HBSS HIPS is installed

Created by Justin Wyllys, last modified by Su-Lyn Rosenberry-ret on Dec 12, 2016

Views: 1,656 Votes: 0 Revisions: 14


This article describes the issue when after HBSS/HIPS is installed on a SolarWinds server, the server's CPU usage heavily increases up to 100% and stays there. 


All Core products and modules


New government regulations may require HBSS HIPS to be installed on their servers. The Host Intrusion Prevention Software (HIPS) can do anything to applications, even injecting custom code to their process and participating in the execution flow. 


As the HBSS implementation is a new government requirement, they have to adjust their environments accordingly. It's not actually our products consuming their CPU power, rather it is the application protection feature.


They may just need to throw a lot more power at the machines to compensate, but if that is not possible they will need to make exclusions or uninstall the HBSS HIPS software. 


Note: HIPS-like products very often do not play well with virtualization – we recommend moving the Orion servers to physical hardware. 


Depending on the environment, you may have to do one or more of the following:

  • Increase hardware resources, including moving from a VM to a more powerful physical server
  • Exclude all SolarWinds processes, database files, and their dependencies from the Application Protection List (Not the Trust Application List, which is separate)​, details included below. 
  • All ports normally used by Orion must not be blocked and allow our traffic through.
  • Uninstall HBSS & HIPS.


SolarWinds Processes to exclude from the Application Protection List:

  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine.v2\SWJobEngineSvc2.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine.v2\SWJobEngineWorker2.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine\SWJobEngineSvc.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\JobEngine\SWJobEngineWorker.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\Collector\SolarWinds.ManagementAgent.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\Collector\SolarWinds.DataProcessor.exe
  • C:\Program Files (x86)\Common Files\SolarWinds\Collector\SolarWinds.PollingController.exe
  • C:\Program Files (x86)\SolarWinds\Orion\SyslogService.exe
  • C:\Program Files (x86)\SolarWinds\Orion\TrapService.exe


SolarWinds service dependencies to exclude from the Application Protection List:

  • C:\Windows\System32\mqsvc.exe    (MSMQ)
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe   (Net.Tcp Port Sharing Service)         
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe   (Net.Tcp Port Sharing Service)
  • C:\Windows\SysWOW64\inetsrv\w3wp.exe    (IIS)
  • C:\Windows\System32\inetsrv\w3wp.exe  (IIS)


SDF files (scheduled jobs and just-processed jobs) to exclude from the Application Protection List:

  • C:\ProgramData\Solarwinds\Collector\Data\JobsTracker.sdf
  • C:\ProgramData\Solarwinds\Collector\Data\PollingController.sdf
  • C:\ProgramData\Solarwinds\JobEngine.v2\Data\JobEngine35.sdf
  • C:\ProgramData\Solarwinds\JobEngine.v2.agent\Data\JobEngine35.sdf
  • C:\ProgramData\Solarwinds\JobEngine\Data\JobEngine35.sdf


Last modified