IY98365: WSCANSW PROCESS CONSUMES HIGH CPU USAGE FOR HOURS IF SIGNATURE SCAN IS ENABLED.

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • Environment:
    
    CM 4.2.3 fixpack 3 or 4.
    
    When enabling signature scan on Windows endpoints, the wscansw
    process consuming high CPU usage for hours.   This cause the
    endpoint system performance to degrade.
    
    
    Worked with CIT and INV L3 folks and discovered the config.xml
    file has an issue with the following attribute:
    
    
    <Attribute name="filter" value="([FILENAME] == &quot;*.EXE&quot;
    || [FILENAME] == &quot;*.DLL&quot; || [FILENAME] ==
    &quot;*.COM&quot; || [FILENAME] == &quot;*.NLM&quot; ||
    [FILENAME] == &quot;*.SIG&quot;) &amp;&amp; ( [FILEATTR] &amp;
    8 )"/>
    
    
    =======================
    
    Test binary provided and it changes the config.xml file with the
    following attribute:
    
    
    
    
    <Attribute name="filter" value="([FILENAME] == &quot;*.EXE&quot;
    || [FILENAME] == &quot;*.DLL&quot; || [FILENAME] ==
    &quot;*.COM&quot; || [FILENAME] == &quot;*.NLM&quot; ||
    [FILENAME] == &quot;*.SIG&quot;) &amp;&amp; (( [ATTR] &amp; 584
    ) == 584)"/>
    
    
    So far so good with this test binary to reduce the period of
    high CPU usage from hours to mins.
    
    However keep in mind that the wscansw process is still taking
    high CPU usage while it is starting up and parsing the signature
    file on the endpoint.  This is normal behavior.
    

Local fix

  • none.  Unless you are provided with a test binary.
    

Problem summary

  • n
    

Problem conclusion

  • The fix for this APAR is contained in or will be included in
    the following maintenance packages:
     fix pack   4.2.3-TIV-TCM-FP0005
    

Temporary fix

  • n
    

Comments

APAR Information

  • APAR number

    IY98365

  • Reported component name

    INVENTORY & CIT

  • Reported component ID

    5724C06IN

  • Reported release

    423

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2007-05-10

  • Closed date

    2007-06-13

  • Last modified date

    2007-06-13

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Modules/Macros

  • N
    

Fix information

  • Fixed component name

    INVENTORY & CIT

  • Fixed component ID

    5724C06IN

Applicable component levels

  • R423 PSY

       UP



Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

Tivoli Configuration Manager

Software version:

423

Reference #:

IY98365

Modified date:

2007-06-13

Translate my page

Machine Translation

Content navigation