IY98365: WSCANSW PROCESS CONSUMES HIGH CPU USAGE FOR HOURS IF SIGNATURE SCAN IS ENABLED.

APAR status

• Closed as program error.

Error description

• Environment:
  
  CM 4.2.3 fixpack 3 or 4.
  
  When enabling signature scan on Windows endpoints, the wscansw
  process consuming high CPU usage for hours.   This cause the
  endpoint system performance to degrade.
  
  
  Worked with CIT and INV L3 folks and discovered the config.xml
  file has an issue with the following attribute:
  
  
  <Attribute name="filter" value="([FILENAME] == &quot;*.EXE&quot;
  || [FILENAME] == &quot;*.DLL&quot; || [FILENAME] ==
  &quot;*.COM&quot; || [FILENAME] == &quot;*.NLM&quot; ||
  [FILENAME] == &quot;*.SIG&quot;) &amp;&amp; ( [FILEATTR] &amp;
  8 )"/>
  
  
  =======================
  
  Test binary provided and it changes the config.xml file with the
  following attribute:
  
  
  
  
  <Attribute name="filter" value="([FILENAME] == &quot;*.EXE&quot;
  || [FILENAME] == &quot;*.DLL&quot; || [FILENAME] ==
  &quot;*.COM&quot; || [FILENAME] == &quot;*.NLM&quot; ||
  [FILENAME] == &quot;*.SIG&quot;) &amp;&amp; (( [ATTR] &amp; 584
  ) == 584)"/>
  
  
  So far so good with this test binary to reduce the period of
  high CPU usage from hours to mins.
  
  However keep in mind that the wscansw process is still taking
  high CPU usage while it is starting up and parsing the signature
  file on the endpoint.  This is normal behavior.
  

Local fix

• none.  Unless you are provided with a test binary.
  

Problem summary

• n
  

Problem conclusion

• The fix for this APAR is contained in or will be included in
  the following maintenance packages:
   fix pack   4.2.3-TIV-TCM-FP0005
  

Temporary fix

• n
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• N
  

Fix information

• Fixed component name

  INVENTORY & CIT

• Fixed component ID

  5724C06IN

Applicable component levels

• R423 PSY

     UP