Closed as program error.
Environment: CM 4.2.3 fixpack 3 or 4. When enabling signature scan on Windows endpoints, the wscansw process consuming high CPU usage for hours. This cause the endpoint system performance to degrade. Worked with CIT and INV L3 folks and discovered the config.xml file has an issue with the following attribute: <Attribute name="filter" value="([FILENAME] == "*.EXE" || [FILENAME] == "*.DLL" || [FILENAME] == "*.COM" || [FILENAME] == "*.NLM" || [FILENAME] == "*.SIG") && ( [FILEATTR] & 8 )"/> ======================= Test binary provided and it changes the config.xml file with the following attribute: <Attribute name="filter" value="([FILENAME] == "*.EXE" || [FILENAME] == "*.DLL" || [FILENAME] == "*.COM" || [FILENAME] == "*.NLM" || [FILENAME] == "*.SIG") && (( [ATTR] & 584 ) == 584)"/> So far so good with this test binary to reduce the period of high CPU usage from hours to mins. However keep in mind that the wscansw process is still taking high CPU usage while it is starting up and parsing the signature file on the endpoint. This is normal behavior.
none. Unless you are provided with a test binary.
The fix for this APAR is contained in or will be included in the following maintenance packages: fix pack 4.2.3-TIV-TCM-FP0005
Reported component name
INVENTORY & CIT
Reported component ID
Last modified date
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fixed component name
INVENTORY & CIT
Fixed component ID
Applicable component levels
Rate this page:
Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.