CPU Consumption Throttling

Agents may compete with other applications for limited CPU resources. 

Through the JetPatch Agent Manager, you can limit the amount of CPU resources that each managed agent is allowed to consume.

Note: In addition to the parent process, we monitor all child processes, so they all can be throttled.

The threshold for activating CPU control is configured centrally, for all endpoints and managed agents, in Settings > Throttling > Edit Configuration:

• Engage managed agent CPU Utilization control: Activate throttling when the endpoint's Total machine CPU load is above this threshold for a period of at least this duration.
• Disengage managed agent CPU utilization control when CPU load is back to normal for at least: Stops above throttling when the endpoint's total CPU load remains below the above threshold for this number of seconds.

Once the Global CPU consumption exceeds the configured threshold, the policies limiting the CPU consumption of the endpoints and managed agents will be deployed. 

You can configure policy rules at two levels:

-Per endpoint via connector (configured in the connector management services

-Per Managed agent (configured in the agent management service)

These policies can throttle the CPU consumption of the managed agents to their configured limits, provided the limits are being exceeded.

If the CPU consumption of the endpoint returns back within its configured limit, JetPatch will stop throttling the CPU consumption of the managed agents.

------------------------------------------------------------------------------------------------------

Take an example where the Global level throttling is at 60% with a 5 minute disengage time, and connector level throttling is turned off. 

You are managing AlertLogic, which is capped at 80%, and Tanium, which is capped at 25%

• AlertLogic is currently using 30%
• Tanium is currently using 50% 

If Real time CPU usage is at 80% (exceeding the global throttle) the system will execute its policies in order to limit CPU utilization of its managed agents by at least 20%, to bring the total CPU usage back below 60% 

Since AlertLogic is not exceeding its limit at 80% utilization, it will not be Thorttled

Tanium is using 50%, exceeding its limit at 25%, prompting the agent manager to initiate the policy and reducing its CPU utilization to 25%

 Now Global usage is back to 55%, once the CPU utilization remains beneath 60% for 5 minutes the throttling disengages. 

The below table recaps the scenario

------------------------------------------------------------------------------------------------------

Now take an example where the Global level throttling is at 60% with a 5 minute disengage time, and connector level throttling is turned on to 40%

When the Connector level throttling is active, it supersedes any agent level settings if it’s lower than the agent 

You are managing AlertLogic, which is capped at 90% 

If Real time CPU usage is at 80% (exceeding the global throttle) the system will execute its policies in order to limit CPU utilization of its managed agents by at least 20%, to bring the total CPU usage back below 60% 

AlertLogic is currently using 70%.

It is not exceeding its CPU utilization. However, since the Global CPU utilization threshold is being exceeded, and the endpoint CPU utilization is capped at 40%, then the threshold at which the managed agents must also be limited to is 40%.

In this case, AlertLogic will only use 40%

Related Articles:

• How to generate logs & alerts report