High CPU-utilization on TS-Server

Catweazle30169Catweazle30169
in TDR - General Questions

Hello.
We're running several Windows Server 2016 with Citrix Xenapp 7 Build 1912 CU1.
TDR is installed with settings for "Best performance". There several folders and files excluded. Here I followed the citrix recommandations for exceptions for AV-Programs and additionally I checked the documentaion of AV-Program. With this settings I hoped to get well performance running TDR. Durin logon users the TDR needs up to 25% cpu-util.
Is this normal, or do I forgot something here?

Here are my exclusions:
*\Citrix Resource Manager\LocalDB
*\ICAClient\Cache
*\Program Files (x86)\Citrix\Deploy
*\Program Files (x86)\Citrix\Independent Management Architecture
*\Program Files (x86)\Citrix\RadeCache
*\SoftwareDistribution\Datastore
*\System32\Spool
*\Users*\ShareFile
*\Users*\ShareFile\
*\Windows\System32\spool\PRINTERS
%allusersprofile%\NTUser.pol
%ProgramFiles(x86)%\Citrix\HDX RealTime Connector\AudioTranscoder.exe
%ProgramFiles(x86)%\Citrix\HDX RealTime Connector\MediaEngine.Net.Service.exe
%ProgramFiles(x86)%\Citrix\HDX RealTime Connector\MediaEngineService.exe
%ProgramFiles(x86)%\Citrix\HDX\bin\WebSocketService.exe
%ProgramFiles(x86)%\Citrix\System32\CtxSvcHost.exe
%ProgramFiles(x86)%\Citrix\System32\ctxxmlss.exe
%ProgramFiles(x86)%\Citrix\System32\mfcom.exe
%ProgramFiles(x86)%\Citrix\System32\WebSocketService.exe
%ProgramFiles(x86)%\Citrix\System32\wfshell.exe
%ProgramFiles(x86)%\Citrix\System32\wfshell32.exe
%ProgramFiles(x86)%\Norskale\Norskale Agent Host\AgentGroupPolicyUtility.exe
%ProgramFiles(x86)%\Norskale\Norskale Agent Host\Citrix.Wem.Agent.LogonService.exe
%ProgramFiles(x86)%\Norskale\Norskale Agent Host\Citrix.Wem.Agent.Service.exe
%ProgramFiles(x86)%\Norskale\Norskale Agent Host\VUEMCmdAgent.exe
%ProgramFiles(x86)%\Norskale\Norskale Agent Host\VUEMUIAgent.exe
%ProgramFiles%\Citrix\HTML5 Video Redirection\WebSocketService.exe
%ProgramFiles%\Citrix\ICAService\CpSvc.exe
%ProgramFiles%\Citrix\ICAService\picaSvc2.exe
%ProgramFiles%\Citrix\User Profile Manager\UserProfileManager.exe
%ProgramFiles%\Citrix\Virtual Desktop Agent\BrokerAgent.exe
%SystemRoot%\System32\csrss.exe
%SystemRoot%\System32\GroupPolicy\Machine\registry.pol
%SystemRoot%\System32\GroupPolicy\User\registry.pol
%systemroot%\System32\LogFiles\
%SystemRoot%\System32\smss.exe
%SystemRoot%\System32\spool\PRINTERS\
%SystemRoot%\System32\spoolsv.exe
%SystemRoot%\System32\winlogon.exe
%systemroot%\System32\Wins**.chk
%systemroot%\System32\Wins**.log
%systemroot%\System32\Wins**.mdb
%systemroot%\SysWow64\LogFiles\
%UserProfile%\AppData\Local\Temp\Citrix\HDXRTConnector**.txt
%UserProfile%\AppData\Local\Temp\Citrix\RTMediaEngineSRV\MediaEngineSRVDebugLogs**.txt
C:\Program Files (x86)\Citrix\HealthMon\HCAService.exe
C:\Program Files (x86)\Citrix\Streaming Client\RadeHlprSvc.exe
C:\Program Files (x86)\Citrix\Streaming Client\RadeSvc.exe
C:\Program Files (x86)\Citrix\System\32wfshell.exe
C:\Program Files (x86)\Citrix\System32\CitrixImaIMAAdvanceSrv.exe
C:\Program Files (x86)\Citrix\System32\CitrixImaImaSvc.exe
C:\Program Files (x86)\Citrix\system32\CpSvc.exe
C:\Program Files (x86)\Citrix\System32\CtxSession.exe
C:\Program Files (x86)\Citrix\System32\CtxSvcHost.exe
C:\Program Files (x86)\Citrix\System32\mfcom.exe
C:\Windows\System32\conhost.exe
C:Program Files (x86)\Citrixs\system32\ctxxmlss.exe
Pagefile.sys

AV exceptions for our AV-solution ist active.
From the av-solution there are also exceptions for TDR are active.

Do you have recommendations to reduce cpu-util here?

Thanks in advance for your tips.

Regards

Dirk Emmermcacher

Best Answer

  • Catweazle30169Catweazle30169
    Answer ✓

    Hello James.
    With your support we found a solution.
    We disabed the setting "Enable Kernel Registry Events".
    Addionally I checked all exclusions for this server group. Several settings, which are documented seems to be old. Comparing the settings shows, the docummention wasn't equal to the files and folders on my systems.

    For others, who have the same problems, here are some exclusions:
    C:\Program Files (x86)\Citrix\HDX RealTime Connector\
    C:\Program Files (x86)\Citrix\System32\
    C:\Program Files (x86)\Microsoft\Teams\current
    c:\Program Files (x86)\Norskale\Norskale Agent Host\
    C:\Program Files\Citrix\Group Policy
    c:\Program Files\Citrix\HDX\
    c:\Program Files\Citrix\System32\
    C:\Program Files\Citrix\User Profile Manager\
    c:\Program Files\Citrix\Virtual Desktop Agent\
    C:\Program Files\FSLogix\Apps\

    Exclusions for MS programs and services are also added.

    Regards

    Dirk

Answers

  • james.carsonjames.carson Moderator, WatchGuard Representative

    Hi Dirk,

    TDR's CPU consumption will vary, but a few things come into play:
    -The amount of traffic on the server -- the more traffic, the more things that need to be scanned, and the more CPU will be used to do this.
    -If the host sensor was recently installed, it may still be doing a baseline scan.
    -If you did not exclude the AV software directories on the server from TDR. and vice versa, they may get stuck scanning things that each other move.

    If you continue to run into issues, I'd suggest opening a support ticket where someone can take a look at your logs more in-depth.

    -James Carson
    WatchGuard Customer Support

  • james.carsonjames.carson Moderator, WatchGuard Representative

    @Catweazle30169
    Thanks for posting your solution. I'm glad they were able to help!

    -James Carson
    WatchGuard Customer Support

Sign In to comment.