Every endpoint population is unique. Trellix recommends that you test CPU limiting values on machines representative of your production environment and workloads before you deploy the limit to all agents throughout your enterprise. Finding the right balance between CPU limits, system performance, and xAgent performance requires tuning, and preferences vary by customer.
At minimum, Trellix Endpoint Security (HX) xAgent version 29 requires a computer with a Pentium-class processor. In addition, Trellix Endpoint Security (HX) xAgent version 11.8 and later require that the processor support Intel SIMD (Single Instruction, Multiple Data) processor supplementary instruction set SSE2.
If you are using Endpoint Security (HX) version 20 or later, CPU limits can be set for the entire xAgent population or a subset of the population. Limits can be set using , using the API, or in the xAgent configuration file.
Important
CPU use limits only apply to acquisition scripts run on the xAgent. Other feature processes are not limited by this setting. Trellix does not recommend changing this setting except in instances where the CPU on the agent is very limited, such as a single core.
Note
The imposed CPU limit is measured as an average over a period of a few seconds. Actual CPU usage may rise above the limit for a short time.
Important
A physical processor can simultaneously run a limited number of threads. Trellix recommends setting a CPU limit greater than the quotient of 1/# of threads. For example, for an Intel i5 processor, which can run 4 threads at a time, set the CPU limit to 25% (1/4) or higher. If you set the CPU limit below this guideline, the Full Disk and Full Memory data acquisitions may not have enough resources to complete.
In addition to testing before enterprise-wide deployment, the following information about how the agent's CPU limiting feature works may help you determine what values to set and the expected behavior.
Operating system differences in CPU limiting
The behavior of CPU limiting depends on the version of Windows you are running. This is due to differences in the underlying operating system.
In Windows 8 and later environments, the CPU limit set on the Endpoint Security (HX) server applies to the main agent processes and the acquisition process. This limit is enforced across two measures of CPU use:
Cumulative user time of agent processes
Combined user and kernel time for an individual audit process
In Windows 7 and earlier environments, the CPU limit set on the Endpoint Security (HX) server is applied per agent process. The combined user and kernel CPU use per process is limited. The combined CPU use of the xAgent processes may exceed the CPU limit.
Note
macOS and Linux environments do not support CPU limiting.
Effect of CPU limiting on xAgent performance
There is an inherent trade-off between the CPU limit set for an xAgent and the amount of time it takes the xAgent to perform tasks such as data acquisitions, Enterprise Searches, and triages. In most cases, a lower CPU limit setting will increase the expected time for the xAgent to complete tasks.