Global Protect high CPU usage

[Daedalus]

Hello to everyone,

I'm a radiologist working in Spain. I use Global Protect to access the hospital network from home, since we are working from home in this period to avoid coronavirus exposition.

Since I have Global Protect installed in my laptop, it happens often (around 10 times per day or more) that the process

PanGpHip.exe start using a lot of CPU (15-20% on a Intel i7-8750H CPU) for a period of 10-20 minutes, then stops only to start again after some time. This happens always right after I connect to the VPN, but also happen again after some time that I'm connected and even randomly happens when Global Protect is disconnected.

The VPN is working well, but the issue is annoying because it causes the laptop fans to activate with the maximum speed.

I asked to IT department of my hospital, but they weren't able to figure out what is causing the problem.

Do anyone have any suggestion?

My Global Protect version is 5.0.7-2, 64 bit.

Thank you,

Giovanni

[reaper]

your GlobalProtect client is configured to periodically perform a HIP check, this is to ensure your system is not infected and properly patched etc

Your IT (security) team can finetune these checks but it's not advisable to pursue 'turning this off' as it could open the hospital up to threats if your laptop does get infected (much more impactful than fans turning on)

If your IT team finds that the performance impact is too great, they could call into support to have this investigated, maybe a process check is taking up more resources than expected or there could be a configuration error

[Daedalus]

Thank for the explanation.

I would not want to turn off this check, but I think that I may be dealing with a bug.

I don't know how deep is this security check, but it looks strange that it has to last up to 20 minutes using all this processing power.

I will try to convince my IT team to call into support.

Thank you

[BenWorrell]

I work in support for a small (< 1000) employee company).  About 500 are remote using GlobalProtect.  We had have some users notice something causing their system's fans to run more than what they feel is normal and are convinced that something it is slowing their systems down.   When they checked TaskManager they found PANGPHIP.exe getting the highest CPU percentage - in the cases where I was provided screen shots this was between 15% and 20%  of the CPU, overall CPU for these was less than 50%. 

I have found disk utilization by processes more likely to be a performance drain, however Task Manager doesn't break down Disk Utilization by process but in the screen shots provided - the total utilization was less than 40% 

My understanding is this process is used to ensure that the system's AV is active and current.   That process shouldn't take 15 minutes to run unless it was doing some sort of AV scan itself.   

5.2.4 is the most prevalent version installed on our systems and is also the version in question on these systems.

Anyone at PaloAlto have any additional information they can share on this?  

[Daedalus]

I solved the problem killing the process every time I noticed the fan's noise. My laptop have good hardware that NEVER needs this amount of cooling unless I'm using 100% CPU (as in gaming). So it looked pretty ridiculous that I had to stand that noise for a process that obviously is not behaving as it should.

I can see the problem is still present.

[Avinash1]

If the client has any antivirus installed on his system then it might be possible that antivirus has some conflict with GP software.

Also, make sure you have only allowed the stable version of GP at the firewall side for end-users to connect.