This content has been marked as final. Show 5 replies
it certainly sounds like the spike you are seeing seems to be tied into the Agent to server comms (ASCI),
out of interest, what is the server spec ? ePO and SQL server.
when you say it is doing a wakeup every hour, do you mean via an agent wakeup task ? , or just the default agent policy that is configured ,
the agent has algorithms that should cause the ASCI to randomise, it sounds like they are being brought back into synchronising, which obviously isnt what you want sad , so something is going wrong here,
if i remember correctly, there are perfmon counters for ePO HTTP connections, might be interrested to see the trending of the connections,
Thanks for your reply, the wakeup is performed by a scheduled task. I've just checked the settings (i didn't set it up)
The wakeup task is set to perform a wakeup every hour starting at 08:30 until 18:30. The randomization box is not ticked. I assume I should tick the box and set a time.
Taking into account we have approx 9000 agents, an average of 6000 connecting on a daily basis, do you think a full property wakeup every hour is too extreme? Is there a standard mcafee practice?
ok, its worth asking around what the rationale is for the agent wakeup call. every hour is excessive ( at least to my mind)
i personally use a task set to run at startup, and then not again( it closes the 1 hr policy enforcement gap). the agent will automatically connect to the ePO Server every 60 secs , configured as the Agent to server communication interval, and this is exactly what you are doing with the wakeup call task , so in effect you are doing way too much work.
as you have noticed, there is randomisation, which is a start, but im thinking,unless you have a need for the wakeup call task, ditch it?
Your right, there is no point scheduling a task every 1 hour as the agent to server communication interval is set to 60 minutes.
So that would mean the ASCI is performing a wakeup every 60 minutes AND the scheduled task is doing the same thing every 60 minutes!?
To decrease network traffic and stop agents performing 2 wakeups every hour and maxing out the CPU on the server I'm thinking of implementing the below.
Turn off the ASCI (Stopping the agents communicating to the server every hour)
Create 1 task to perform DAT update 10 minutes after start up. (All machines will get update when log on)
Create 1 task to perform a wakeup 20 minutes after start up. (All machines will update to ePO after update)
Create 1 task to perform wakeup at 13:00 randomization set to 4 hours with the task finishing at 19:00. (All machines will perform a wakeup in the afternoon)
Create 1 task to perform DAT update at 11:00 (All machines will get update even if a user has not logged onto it)
What do you think? Or shall i leave the ASCI communciation turned on but increase the interval to 4 hours and leave out the task for the afternoon wakeup?
to be honest, i suspect when you remove the rigid scheduling of the wakeup call task, the problem will go away with no further changes necessary,
you can add an update task to update in the morning, and its a good idea, but even if you dont add a wakeup task, you will have the results within the hour, via the ASCI.
again, in the afternoon, if the machines are switched on, then you will have the results within the hour anyway - if they are not on, then they wont run the update task anyways..
i would try just disabling the wakeup task, and see how you get on.