Articles in this section

CPU Consumption Throttling

Overview

Agents may compete with other applications for limited CPU resources. Through the JetPatch Agent Manager, you can limit the amount of CPU resources that each managed agent is allowed to consume.

Note: In addition to the parent process, all child processes are monitored, so they can all be throttled.

Global Throttling Configuration

The threshold for activating CPU control is configured centrally for all endpoints and managed agents in Settings → Throttling → Edit Configuration:

  • Engage managed agent CPU Utilization control – Activates throttling when the endpoint’s total machine CPU load is above the configured threshold for at least the configured duration.
  • Disengage managed agent CPU utilization control – Stops throttling when the endpoint’s total CPU load remains below the threshold for the configured number of seconds.

Screen_Shot_2020-02-14_at_1.07.12_PM.png

Once the global CPU consumption exceeds the configured threshold, the policies limiting the CPU consumption of the endpoints and managed agents will be deployed. 

If the CPU consumption returns within its configured limit, JetPatch will stop throttling.

Policy Levels

You can configure policy rules at two levels:

  • Per Endpoint (Connector Level) – Configured in the connector management services.
  • Per Managed Agent – Configured in the agent management service.

These policies throttle the CPU consumption of managed agents to their configured limits, provided those limits are being exceeded.

Note: When Connector-level throttling is active, it supersedes any agent-level settings if it is lower than the agent limit.

Scenario 1: Connector-Level Throttling Off

Setup:

  • Global throttling threshold: 60% with a 5-minute disengage time.
  • Connector-level throttling: Off.
  • AlertLogic cap: 80%.
  • Tanium cap: 25%.

Real-time CPU usage: 80% (exceeding the 60% global threshold).

The system executes its policies to reduce CPU utilization by at least 20%, bringing total usage back below 60%.

Agent Current Usage Cap Throttle Effect
AlertLogic 30% 80% None (not exceeding cap).
Tanium 50% (over cap) 25% 50% − 25% = 25%.
Total 80% (over cap) 60% 80% − 25% = 55% (under 60%).
Result: Global usage drops to 55%. Once CPU utilization remains below 60% for 5 minutes, throttling disengages.

Scenario 2: Connector-Level Throttling On

Setup:

  • Global throttling threshold: 60% with a 5-minute disengage time.
  • Connector-level throttling: On, capped at 40%.
  • AlertLogic cap: 90%.
  • AlertLogic current usage: 70%.

Real-time CPU usage: 80% (exceeding the 60% global threshold).

The system executes its policies to reduce CPU utilization by at least 20%. Although AlertLogic is not exceeding its own 90% cap, the Connector-level cap of 40% supersedes the agent-level setting.

Agent Current Usage Effective Cap Throttle Effect
AlertLogic 70% 40% (connector cap supersedes 90% agent cap) Throttled to 40%.
Result: AlertLogic is throttled to 40% because the Connector-level cap supersedes the agent-level cap whenever it is lower.

Related Articles:

Related articles

Comments

0 comments

Please sign in to leave a comment.