Every endpoint population is unique. Trellix recommends that you test CPU limiting values on machines representative of your production environment and workloads. Finding the right balance between CPU limits, system performance, and agent performance requires tuning, and preferences vary by customer.
At minimum, TrellixEndpoint Security Agent (HX) version requires a computer with a Pentium-class processor. In addition, TrellixEndpoint Security Agent (HX) version 11.8 and later require that the processor support Intel SIMD (Single Instruction, Multiple Data) processor supplementary instruction set SSE2.
If you are using Endpoint Security Agent (HX) version 20 or later, CPU limits can be set for the entire agent population or a subset of the population. Limits can be set using Web UI, using the API, or in the agent configuration file.
Important
CPU limiting only impacts main agent processes and the acquisition process. It does not apply to real-time event monitoring, the AV engine, or MalwareGuard engine detection processes as this would increase the risk of missed detections.
Note
The imposed CPU limit is measured as an average over a period of a few seconds. Actual CPU usage may rise above the limit for a short time.
Important
A physical processor can simultaneously run a limited number of threads. Trellix recommends setting a CPU limit greater than the quotient of 1/# of threads. For example, for an Intel i5 processor, which can run 4 threads at a time, set the CPU limit to 25% (1/4) or higher. If you set the CPU limit below this guideline, the Full Disk and Full Memory data acquisitions may not have enough resources to complete.
In addition to testing before enterprise-wide deployment, the following information about how the agent's CPU limiting feature works may help you determine what values to set and the expected behavior.
Operating system differences in CPU limiting
The behavior of CPU limiting depends on the version of Windows you are running. This is due to differences in the underlying operating system.
In Windows 8 and later environments, the CPU limit set on the Endpoint Security (HX) server applies to the main agent processes and the acquisition process. This limit is enforced across two measures of CPU use:
Cumulative user time of all agent processes
Combined user and kernel time for an individual audit process
In Windows 7 and earlier environments, the CPU limit set on the Endpoint Security (HX) server is applied per agent process. The combined user and kernel CPU use per process is limited. The combined CPU use of all agent processes may exceed the CPU limit.
Note
macOS and Linux environments do not support CPU limiting.
Effect of CPU limiting on agent performance
There is an inherent trade-off between the CPU limit set for an agent and the amount of time it takes the agent to perform tasks such as data acquisitions, Enterprise Searches, and triages. In most cases, a lower CPU limit setting will increase the expected time for the agent to complete tasks.