topic Re: High memory consumption on newer agent versions in Cortex XDR Discussions

High memory consumption on newer agent versions

CraigV123 — Mon, 26 Jul 2021 16:16:18 GMT

Hello everyone,

I have sporadic servers in our environment producing high memory consumption with the XDR agent. Cyserver.exe will climb to 350-400mb in some instances until the service is rebooted and it brings it down to an acceptable level. Has anyone else had this issue before? It's not on all devices either which makes it a pain to troubleshoot. Any ideas on what to look at? All agents are on 7.3.1 currently. Thank you.

Re: High memory consumption on newer agent versions

jcandelaria — Mon, 26 Jul 2021 17:17:12 GMT

Hi CraigV123,

Is there a specific function/purpose on those servers that you observe?
Like AD, SQL or specific task happening during that time of the day its
causing high cpu?

Re: High memory consumption on newer agent versions

CraigV123 — Tue, 27 Jul 2021 13:49:40 GMT

Thanks for the response. It's a backup server and doesn't get a lot of traffic throughout the day but I'm awaiting the owning engineers confirmation on that. I'll update when I know more. Thanks again.

Re: High memory consumption on newer agent versions

CraigV123 — Mon, 13 Sep 2021 12:24:39 GMT

My apologies on the delayed response. We couldn't find any rhyme or reason exactly. Ended up updating the agent and it has been working alright since. Not sure what happened exactly but I did the same on other servers experiencing the same symptoms and it didn't help.

Re: High memory consumption on newer agent versions

jcandelaria — Mon, 13 Sep 2021 15:31:08 GMT

Hi CraigV123,

So server is still an issue on high memory? how much memory are you seeing constantly on that backup servers?

Re: High memory consumption on newer agent versions

CraigV123 — Mon, 13 Sep 2021 19:27:32 GMT

Doesn't seem to be an issue anymore. The engineer just said "it's running fine." It's been extremely rare that I've heard of issues with XDR in terms of memory consumption. I had some servers that process medical images that would cause the XDR process to spike then return to normal. Not an "issue" but XDR was being blamed for crashing the boxes.