topic Re: High CPU Consuming on Endpoint Security on Windows Server in Endpoint

High CPU Consuming on Endpoint Security on Windows Server

Frank_Aguilieri — Wed, 12 Jan 2022 13:29:44 GMT

Hello,

We have some Windows Server 2016 scenarios with high CPU usage by EndPoint Forensic Recorder service. Apparently this only happens on servers that have more simultaneous connections or more network traffic.

Endpoint version 86.10

Can someone help me?

Thanks

Re: High CPU Consuming on Endpoint Security on Windows Server

G_W_Albrecht — Thu, 13 Jan 2022 11:19:00 GMT

Better contact CP TAC to discover the reason for this behaviour !

Re: High CPU Consuming on Endpoint Security on Windows Server

Frank_Aguilieri — Tue, 18 Jan 2022 17:04:39 GMT

Thanks G_W_Albrecht

Re: High CPU Consuming on Endpoint Security on Windows Server

the_rock — Tue, 18 Jan 2022 17:30:43 GMT

I use E86.20 and had not seen this issue. Are you using just vpn endpoint or sandblast suite (harmony endpoint)?

Andy

Re: High CPU Consuming on Endpoint Security on Windows Server

djhornby — Fri, 11 Feb 2022 07:13:26 GMT

Any update on this as I am seeing the same on some 2019 Servers.

Re: High CPU Consuming on Endpoint Security on Windows Server

lucas-ferreira — Sat, 12 Feb 2022 14:24:12 GMT

Hey guys!

We were facing the same problem. In contact with Check Point's TAC, a developer generated a new EPS.msi where he disabled the Interface, and changed some parameters. Unfortunately he did not provide us with the commands executed to generate this (.msi).

The problem happened on Windows Servers 2012 and 2019, today I have the endpoints installed thanks to this file that the developer generated.

Because it is a Terminal Server (TS). The endpoint analyzed each connection that communicated with TS and ended up increasing the CPU a lot and even crashing to the point where we restarted the server.

Re: High CPU Consuming on Endpoint Security on Windows Server

rmsource_dotcom — Mon, 25 Apr 2022 16:20:14 GMT

If anyone finds a solution please post as we are seeing same symptoms with a customer with same scenario. Happens everyday multiple times a day for last couple weeks. We have a TAC case open.

Re: High CPU Consuming on Endpoint Security on Windows Server

Chris_Atkinson — Mon, 25 Apr 2022 23:18:39 GMT

Are you running E86.25 or newer?

Re: High CPU Consuming on Endpoint Security on Windows Server

Frank_Aguilieri — Tue, 26 Apr 2022 17:28:48 GMT

Hello Chris,

I am running 86.10 and 86.25

Re: High CPU Consuming on Endpoint Security on Windows Server

G_W_Albrecht — Mon, 09 May 2022 08:53:16 GMT

This is EFRService.exe - Forensics Recorder, part of SandBlast...

Re: High CPU Consuming on Endpoint Security on Windows Server

Chris_Atkinson — Mon, 09 May 2022 09:59:35 GMT

In such cases we have sk178706 in particular for Exchange Servers...

Re: High CPU Consuming on Endpoint Security on Windows Server

G_W_Albrecht — Mon, 09 May 2022 10:15:51 GMT

Please provide a link - sk178706 is not found...

Re: High CPU Consuming on Endpoint Security on Windows Server

Chris_Atkinson — Mon, 09 May 2022 11:06:53 GMT

sk178706: Endpoint Security Client policy optimization for Microsoft Exchange Server

Re: High CPU Consuming on Endpoint Security on Windows Server

G_W_Albrecht — Mon, 09 May 2022 11:26:25 GMT

Thanx - looks good...

Re: High CPU Consuming on Endpoint Security on Windows Server

Ruan_Kotze — Mon, 09 May 2022 16:22:06 GMT

Might be worthwhile testing version E86.40. There is a fix for high CPU usage on Windows Servers.

Re: High CPU Consuming on Endpoint Security on Windows Server

rmsource_dotcom — Tue, 24 May 2022 20:26:48 GMT

We had the exact same symptoms with one of our clients. The underlying issue was due to a network ACL blocking traffic. We initially found logs that indicated an issue with Forensics data not being uploaded. This pointed us towards checking connections from the CPHE clients with the Connectivity Tool ("C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\bin\CheckConnectivity.exe"). After seeing multiple fails we had our Network team whitelist the proper domains based off SK116590.

After adding the domains we no longer see CPU performance issues from the "Endpoint Forensic Recorder service". Hope this helps at least one person.

Re: High CPU Consuming on Endpoint Security on Windows Server

John_Richards — Tue, 05 Mar 2024 18:12:23 GMT

Any luck finding a solution? We had a case open with TAC for 6 months. After much back and forth it seemed to improve somewhat. 3 months later and we are now back to square one (100% cpu on the recorder). We are opening another ticket with TAC today. Server exclusions, latest recommended version and following a number of SK's has not helped. Any ideas appreciated.

Re: High CPU Consuming on Endpoint Security on Windows Server

djhornby — Wed, 06 Mar 2024 07:03:01 GMT

What version are you running?

We were seeing this occasionally on random Machines (PC's & Servers) quick fix was a reboot.

87.31 & 87.51 has been quite stable though.

I'm currently trialling 88.1 & 87.57

Re: High CPU Consuming on Endpoint Security on Windows Server

John_Richards — Wed, 06 Mar 2024 15:21:24 GMT

Thanks, we are on the latest "recommended DHS" version. It seems the only solution is to reboot (not a solution) or wait for another upgrade. I think we have tried 7-8 different versions over 6 months. We have reopened a TAC case.

Re: High CPU Consuming on Endpoint Security on Windows Server

G_W_Albrecht — Wed, 06 Mar 2024 15:36:38 GMT

This EFRService issue on MS Servers is ongoing for a long time now. Several customers complained during the last two years, and although R&D is fixing and excluding, the issue still can appear.