XDR CPU Spikes and logging levels

[S.Howard118149]

Hi

Has anyone else come across this? I keep seeing CPU spikes on production web servers running v9.3 and 9.3 that has an impact on the end users. They come in roughly 45 minute bursts and running procmon indicates the cyserver.exe is causing them. One suggestion ive had is to clear the content cache in the possibility that a bad update is trying to correct itself. Beofre I try that I want to find out how to lower the logging level for an agent policy. Has anyone tried that and if so what did you do?

[susekar]

Hello @S.Howard118149 ,

Greetings for the day.

-No, there is no option in the Cortex XDR Management Console to configure or lower the agent logging level via an Agent Settings Profile. Logging levels cannot be managed through policy rules in the UI.

Please find below the recommended approach for the logging, cache, and CPU utilization concerns.

1. Agent Logging Level:

-The logging level cannot be configured through the Cortex XDR Agent Settings Profile. It must be changed locally using cytool.

The default logging level is Level 6 (Information). If required, it can be set using:

cytool log set_level 6 all

-Please note that this change is temporary and may revert after an agent service restart.

2. Clearing Local Content/Verdict Cache:

-For remote endpoints, the preferred option is to use Clear Agent Database from the Cortex XDR console.

-If local access is available, the cache can be cleared using cytool after stopping the agent runtime. Before deleting any database files, please take a backup of the Persistence folder.After cleanup, restart the agent and force a check-in to synchronize the latest policy and content.

3. cyserver.exe CPU Spikes

-The recurring CPU spikes may be related to high EDR activity, scheduled scans, or interaction with third-party security/monitoring tools.

-As an initial isolation step, during the CPU spike you can temporarily disable EDR event collection:

cytool event_collection disable

If CPU usage drops significantly, this would indicate that the spike is likely related to the volume of EDR events being generated.

4. Recommended Diagnostics:

Please review trapsd.log around the time of the CPU spike for high_cpu_processes entries. If the issue continues, capture a short ProcMon trace during the spike and collect a Cortex XDR TSF using:

cytool log collect

-These logs will help identify the specific process or Cortex component contributing to the CPU utilization.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[susekar]

Hello @S.Howard118149 ,

Greetings for the day.

-No, there is no option in the Cortex XDR Management Console to configure or lower the agent logging level via an Agent Settings Profile. Logging levels cannot be managed through policy rules in the UI.

Please find below the recommended approach for the logging, cache, and CPU utilization concerns.

1. Agent Logging Level:

-The logging level cannot be configured through the Cortex XDR Agent Settings Profile. It must be changed locally using cytool.

The default logging level is Level 6 (Information). If required, it can be set using:

cytool log set_level 6 all

-Please note that this change is temporary and may revert after an agent service restart.

2. Clearing Local Content/Verdict Cache:

-For remote endpoints, the preferred option is to use Clear Agent Database from the Cortex XDR console.

-If local access is available, the cache can be cleared using cytool after stopping the agent runtime. Before deleting any database files, please take a backup of the Persistence folder.After cleanup, restart the agent and force a check-in to synchronize the latest policy and content.

3. cyserver.exe CPU Spikes

-The recurring CPU spikes may be related to high EDR activity, scheduled scans, or interaction with third-party security/monitoring tools.

-As an initial isolation step, during the CPU spike you can temporarily disable EDR event collection:

cytool event_collection disable

If CPU usage drops significantly, this would indicate that the spike is likely related to the volume of EDR events being generated.

4. Recommended Diagnostics:

Please review trapsd.log around the time of the CPU spike for high_cpu_processes entries. If the issue continues, capture a short ProcMon trace during the spike and collect a Cortex XDR TSF using:

cytool log collect

-These logs will help identify the specific process or Cortex component contributing to the CPU utilization.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar