7 Replies Latest reply on Apr 11, 2016 9:21 AM by brett.chadwick

    LMdetection CPU 100%




      During automatic system scan on some endpoints LM detection process takes 100% CPU and it results some angry users. It is possible to set some limits to this process? And how to schedule this automatic scan to run it for example on 3 AM when system is woken by WOL? Any suggestions?

        • 1. Re: LMdetection CPU 100%
          brett.chadwick Apprentice

          This is strange and not a normal occurrence.

          You have a few options as it relates to the DAU scan on endpoints.

          You may define limits in terms of CPU use through the intensity of the scanning in the agent policy set.


          The top three options are as follows.


          The agent scan mode, this determines how intense the scanning and thus how fast it will complete.

          For most the normal setting is best, however you may experiment to see if reducing this to initial makes it completes with less resource use. Note: The Fast setting means the DAU will use more resources but will complete faster on the endpoint.



          The second setting to reduce impact is to reduce the number of items being detected. Normally you don't need to change these as they are using WMI and on a standard system will complete in MS to seconds. But you may experiment with reducing those being detected.


          Lastly you may find it necessary to have scanning performed out of hours to reduce impact to end users or on servers. You can do this by changing the hours of operation inside the agent policy set. This means the agent will only work during specific defined times, by work this includes the DAU or detection process that executes each day on the endpoint.



          Finally make sure the DAU is scheduled to execute every 26 hours inside the agent policy set. Some customers might set this higher and this means when the DAU does run it has much more work to do so running every 26 hours through scheduling effectively runs every day.

          2 of 2 people found this helpful
          • 2. Re: LMdetection CPU 100%
            toddblaese Rookie

            In addition to the settings that Brett outlined, make sure that the detection and agent processes are excluded from your AV engine scanning. Often times if the AV is scanning what the detection agent is scanning it will result in higher CPU consumption. Have a look at the recommended exclusions for the various agent components.

            829 Recommended Anti-Malware exclusions for Lumension Endpoint Security Products - L.E.M.S.S.

            2 of 2 people found this helpful
            • 3. Re: LMdetection CPU 100%

              Thanks guys,


              now need a couple days to test new settings. Thank you one more time

              • 4. Re: LMdetection CPU 100%

                Yesterday I made some changes as was recommended but today LM detection took 100% again

                • 5. Re: LMdetection CPU 100%
                  brett.chadwick Apprentice

                  Does this happen on all systems or just specific builds?

                  What is the OS that it is occurring on?


                  In some cases we have observed issues with WMI, and/or the Windows Update engine causing issues.

                  Can you check the Windows Update engine can be successfully started and possibly repairing WMI on the machine?


                  As mentioned before some AV engines can also cause issues as they lock files or are performing a scan at the same time.

                  Looks like we may need support to perform some more troubleshooting to get to the bottom of the issues.

                  • 6. Re: LMdetection CPU 100%

                    Now I'm testing on Windows 7 32 OS but there are more endpoints with this problem.

                    Should I create a support ticket for this issue?

                    • 7. Re: LMdetection CPU 100%
                      brett.chadwick Apprentice

                      Yes, please create a support ticket so we can track and get to the bottom of this issue.

                      Strange, the detection is very rarely a problem process so likely we can quickly get to the bottom of what is causing it in the build or configuration of other installed software.

                      1 of 1 people found this helpful