Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 5489 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Enterprise Console using lots of CPU and not functional anymore

nduda78

I can't pinpoint why this is happening all of a sudden, but navigating the EC and trying to do anything just hangs for long periods of time or just hangs period. We use an external MS-SQL database. Running DebugView i see lots of this:

[2220] log4net:ERROR [RollingFileAppender] Unable to acquire lock on file C:\Users\daNduda\AppData\Local\Sophos\Sophos Endpoint Management\5.0\log\sophos-ui-framework.log. The process cannot access the file 'C:\Users\daNduda\AppData\Local\Sophos\Sophos Endpoint Management\5.0\log\sophos-ui-framework.log' because it is being used by another process. [2220] [2220] *** HR originated: -2147024774[2220] ***   Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302[2220] [2220] [2220] *** HR propagated: -2147024774[2220] ***   Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144[2220] [2220] [2220] *** HR originated: -2147024774[2220] ***   Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302[2220] [2220] [2220] *** HR propagated: -2147024774[2220] ***   Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144[2220] [1324] 1324: 2012-05-15 10:40:33.629 [CBS]                       IsCacheStillGood: True. [1324] 1324: 2012-05-15 10:42:35.813 [CBS]                       IsCacheStillGood: True. [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] Trace Start:0End Index:28 [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] RenderEventToBuffer failed because of insufficient memory.-122-The data area passed to a system call is too small [1324] 1324: 2012-05-15 10:44:36.448 [CBS]                       IsCacheStillGood: True. [2220] Warning     [0x000013E0] This group was not constructed from the group heirachy tree, it will be slower [2220] Warning     [0x000013E0] This group was not constructed from the group heirachy tree, it will be slower [1324] 1324: 2012-05-15 10:46:37.140 [CBS]                       IsCacheStillGood: True. [1324] 1324: 2012-05-15 10:48:37.972 [CBS]                       IsCacheStillGood: True. [1324] 1324: 2012-05-15 10:50:38.598 [CBS]                       IsCacheStillGood: True. 

:24769


This thread was automatically locked due to age.
Parents
  • 0

    Ahh, makes more sense...  What happens if you stop the router service on the server?

    If it levels off shortly after it would suggest, that it is working on message processing, rather than other tasks much a servicing the GUI.  Note: the Management service might be busy for a while after stopping the router as it may have taken on a large number of messages it needs to stick in the database.  So you may want to stop the router, and restart the management service to prove this.

    The "msgn" logs under:

    C:\ProgramData\Sophos\Sophos Endpoint Management \

    will show the number of messages being sent to the management service and from it.  Does it seem high?

    Maybe worth looking at the database also (counts per table for example, any of them, particularly the errors, events and threats table seem high?), is the sqlservr.exe process also show it's performing some work?  

    Looking at performance counters on the machine maybe also be worth while, average disk queue length for example.

    Jak

    :24867
Reply
  • 0

    Ahh, makes more sense...  What happens if you stop the router service on the server?

    If it levels off shortly after it would suggest, that it is working on message processing, rather than other tasks much a servicing the GUI.  Note: the Management service might be busy for a while after stopping the router as it may have taken on a large number of messages it needs to stick in the database.  So you may want to stop the router, and restart the management service to prove this.

    The "msgn" logs under:

    C:\ProgramData\Sophos\Sophos Endpoint Management \

    will show the number of messages being sent to the management service and from it.  Does it seem high?

    Maybe worth looking at the database also (counts per table for example, any of them, particularly the errors, events and threats table seem high?), is the sqlservr.exe process also show it's performing some work?  

    Looking at performance counters on the machine maybe also be worth while, average disk queue length for example.

    Jak

    :24867
Children
No Data