Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
This discussion is archived
686 Views 4 Replies Latest reply: Apr 4, 2013 12:52 PM by jenkinski RSS
jenkinski Newcomer 27 posts since
Mar 4, 2013
Currently Being Moderated

Mar 13, 2013 7:14 PM

RSD 4.5 Dashboard and Detected Systems Queries 'Expensive' (High CPU)

I've been encountering intermittent database performance issues where basically the CPU spikes to 90+ percent somewhat randomly.

 

After running activity monitor I'm noticing when the CPU is spiked high there are a few queries that seem extremely higher than the rest of the queries in terms up CPU, and Executions/min. They all were quering various RSD Tables/Views.

 

Didn't put two and two together until I realized this activity is from the RSD Dashboard. It's unreasonably slow if we take into consideration the amount of data that is being queried. Event data and queries should be way more expensive if we think of shear amount of data. So delving into it more I've noticed that the RSDSubnet view runs two functions RSDFN_SubnetContainsRogueSystems and RSDFN_IsSubnetCovered... It turns out the IsSubnetCovered appears to be the culprit. Without going further I can't say whether this is the main reason for the CPU spikes, but it's just one obvious expensive query that I believe could be streamlined.

 

My primary questions are:

1. Is everyone experiencing 'slow' downs when the dashboard or related 'covered' systems queries are run?

2. If we have a suggestion on speeding up the RSDFN_IsSubnetCovered function has anyone seen them implement things in the 'idea's forum?

 

-KJ

  • HawkEye4077 Newcomer 8 posts since
    May 28, 2010

    Hi,

     

    Yes we are also seeing the expensive RSD queries. We have had to go as far as putting ePO on it's own DB server and instance as it was causing major problems with other databases that were on the same server. This only started happening relatively recently.  I can't say for certain when but I think one of the 4.6 release introduced this issue. It would be nice to have it fixed.

     

    Did you manage to resolve this or does anyone else have any ideas or suggections for resolving this ?

     

    Neil

     

    Message was edited by: HawkEye4077 on 4/3/13 3:35:00 AM CDT
  • JoeBidgood McAfee SME 2,877 posts since
    Sep 11, 2009

    I haven't heard of anything particularly related to those two functions... the first thing that springs to mind is index fragmentation: if you reindex the DB, does it improve matters?

     

    HTH -

     

    Joe




    (Please post questions to the forum, as I am unable to respond to private messages. Thanks!)



  • HawkEye4077 Newcomer 8 posts since
    May 28, 2010

    Hi Joe,

     

    We recently ran an idex rebuild and that didn't seem to make any real difference. The affect can be clearly seen when entering the Detected Systems page as the subnets box (top left) takes much longer to populate, sometimes it takes almost as long as the default page refresh i.e. the box completes and seconds later the page refreshes.

     

    This only seemed to start after a relatively recent upgrade. Maybe it is related to upgrading through several versions ?

     

    Neil

More Like This

  • Retrieving data ...

Bookmarked By (2)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points