topic Cortex XDR high CPU on a windows VDI workstation in General Topics

Cortex XDR high CPU on a windows VDI workstation

marlon333 — Wed, 09 Aug 2023 18:47:18 GMT

We are having some performance issues, with cortex xdr eating up cpu during VDI bootup. We installed agent on a non-persistant VDI, and followed recommended config settings and also followed appvolume recommendation.

I checked task manager and found that during boot up, it seems cortex xdr is competing with Defender in cpu consumption, defender is in passive mode. How do I make an exception in cortex to not compete with defender.

Re: Cortex XDR high CPU on a windows VDI workstation

BPry — Fri, 11 Aug 2023 13:01:38 GMT

@marlon333,

Little lost in what you mean by XDR is competing with Defender? At boot, Cortex XDR and Defender both naturally utilize higher CPU resources as they start and analyze everything else your machine is doing as parent processes spawn child processes all over the place. What exactly are you seeing on these machines?

Re: Cortex XDR high CPU on a windows VDI workstation

marlon333 — Tue, 15 Aug 2023 17:58:16 GMT

Thanks for the input BPry, I apologize for the misunderstanding. Our VDI desktop environment is having issues with CPU consumption at 100% during bootup. Defender is in passive mode but consuming 25% of cpu and Cortex is CPU consumption is very high above 50%, bootup is taking a longtime. I was wondering if there is an exemption solution for example, defender process exe and or folder paths for defender.

Re: Cortex XDR high CPU on a windows VDI workstation

BPry — Wed, 16 Aug 2023 13:37:02 GMT

@marlon333,

So I just want to point out that PAN actually recommends disabling or removing Windows Defender to avoid performance issues. This should happen automatically for everything except servers where it can't disable it automatically and you need to manually do that.

You can add an exception through a global process exception if you want to give that a go. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-Global-Endpoint-Policy-Exception

Re: Cortex XDR high CPU on a windows VDI workstation

RyanBarrickCDI — Mon, 11 Sep 2023 12:52:18 GMT

We were seeing the same issue. We had services that were not starting, defender service was stuck on stopping, the CPU usage was really high and the VDI's would not register.

I saw in the release notes for 8.1.1 that it included this fix (which was released August 14th, not long after the August 1st release)

CPATR-20862

Fixed an issue that may impact performance on VDI systems during boot up.

Since upgrading the agent to 8.1.1 we are no longer seeing the issue.

Thanks