How Many CPU and Memory Resources Are Occupied by the Agent When It Performs Scans?

Maximum CPU Usage

A running agent occupies a maximum of 20% of a vCPU. The actual usage depends on your server specifications. For details, see Resource Usage of Different Specifications While the Agent Is Running.

If the CPU usage exceeds 20% of a vCPU, the agent will automatically reduce CPU usage, spending more time on scans. This does not affect your services. If the CPU usage exceeds 25% of a vCPU, the agent will be automatically restarted.

• The agent is scheduled to scan your servers from 00:00 to 04:00 every day. It does not affect the normal running of the server system.
• If an agent is performing a virus scan task, the virus scan program occupies an extra part of the CPU. The CPU usage cannot exceed 30% of the multi-core CPU. For details about virus scan, see Virus Scan.

Peak Memory Usage

A running agent occupies about 500 MB memory. If the agent memory usage exceeds the maximum memory limit 500 MB, the agent will be automatically restarted within 5 minutes.

If an agent is performing a virus scan task, the average memory usage is 800 MB. For details about virus scan, see Virus Scan.

You can view the run_mode field in the conf/framework.conf file to check the agent background status.

You can perform the following operations to restore the agent to the normal state:

If you have enabled the self-protection policy, disable it before performing the following operations. For details, see Disabling HSS Self-Protection.

1. (Optional) Expand the server capacity.

   Perform this operation only when the available memory of the server is less than 50 MB.

2. Modify the conf/framework.conf file in the agent installation directory and change the mode after the colon (:) of run_mode to normal.
3. Perform the following operations to delete the file that records the number of restart times.
   • Linux: Run the rm -f /usr/local/hostguard/run/restart.conf command.
   • Windows: Find C:\Program Files\HostGuard\run\restart.conf and delete it.
4. Perform the following operations to restart the agent.
   • Linux: Run the /etc/init.d/hostguard restart command.
   • Windows:
     • The agent version is 4.0.17 or earlier.
       1. Log in to the server as user administrator.
       2. Open the Windows Task Manager, choose Services.
       3. Right-click Hostwatch and choose Stop. After the status changes to Stopped, go to Step 4.
       4. Right-click Hostguard in and choose Stop.
       5. Right-click Hostwatch and choose Start.

          After Hostwatch is started, Hostguard is automatically started.

     • The agent version is 4.0.18 or later.
       1. Log in to the server as user administrator.
       2. Open the command-line interface (CLI). Run the following commands in sequence to stop the service:

          sc control hostwatch 198

          sc control hostguard 198

          As shown in the Figure 1, the sp_state.conf file is not generated on the server with self-protection enabled.

          Figure 1 Stopping the service
          
       3. Open the Windows Task Manager, choose Services.
       4. Right-click Hostwatch and choose Start.

          After Hostwatch is started, Hostguard is automatically started.

Resource Usage of Different Specifications While the Agent Is Running

The following table describes the CPU and memory usage of different specifications when the agent is running.