Defining the resource use policy

You can define the resource use policy for all of your host endpoints or for selected host sets in your environment using the Web UI or the API.

This section covers how to set the maximum CPU limit, the event storage use limit, the priority schedule for xAgent processes, and the concurrent host limits using the Web UI. See the Endpoint Security (HX) xAgent API Guide for more information on defining the resource use policy settings using the API.

Setting the Maximum CPU Limit

You can set the maximum CPU limit for all of your host endpoints or selected host sets using the Web UI or the CLI. This represents the percentage of CPU that agents can use when performing tasks on behalf of the Endpoint Security (HX) server.

Note

macOS and Linux environments do not support CPU limiting.

Important

CPU limiting only impacts audit and acquisition process. It does not apply to other agent processes as this would increase the risk of missed detections.

A physical processor can simultaneously run a limited number of threads. Trellix recommends setting a CPU limit greater than the quotient of 1/# of threads. For example, for an Intel i5 processor, which can run 4 threads at a time, set the CPU limit to 25% (1/4) or higher. If you set the CPU limit below this guideline, the Full Disk and Full Memory data acquisitions may not have enough resources to complete.

This section covers how to set the maximum CPU limit using the Web UI. See the Endpoint Security (HX) REST API Guide for more information on setting the maximum CPU limit using the API.

Setting the CPU Limit for All Endpoints

To set the maximum CPU limit for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default policy link to access the Edit Policy page.
Click the Resource Use tab.
In the Resource Use section, specify the percentage of CPU that agents can use when performing tasks on behalf of the Endpoint Security (HX) server in the CPU use field. Valid values range from 10 through 100 percent. The default is 100 percent. For more information about the use of this field, see CPU Limiting.
Click Save.

Setting the CPU Limit for Selected Host Sets

To set the maximum CPU limit for selected host sets:

Note

See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Click the Resource Use tab.
In the Resource Use section, specify the percentage of CPU that agents can use when performing tasks on behalf of the Endpoint Security (HX) server in the CPU use field. Valid values range from 10 through 100 percent. The default is 100 percent. For more information about the use of this field, see CPU Limiting.
Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Configuring the event storage Settings

Event storage is also known as the ring buffer. You can set the event storage use limit and the storage mode for the resource use policy for all of your host endpoints or selected host sets using the Web UI or the API.

The event storage limit represents the number of megabytes of storage that can be used for tasks performed on behalf of the Endpoint Security (HX) server.

If the agents' events database exceeds the storage specified by this setting, the agent rebuilds the database. If the database is corrupt and the attempt to rebuild it fails, a new, empty events database is created. The old events database is backed up as file events.db.bk. You may need assistance from Trellix Technical Support to extract the data contained in the backup.

The event storage mode allows you to adjust event storage I/O handling and physical disk I/O use. If your host endpoints experience a degradation in I/O processing times, use this setting to optimize event storage I/O handling and reduce the physical disk I/O use. The default settings is conventional.

Important

Changing storage mode may lead to the loss of historical data. Complete all incident response investigations on your host endpoint before changing the storage mode.

The storage_mode setting is only available for agents running Trellix Endpoint Security (HX) xAgentversion 21.33.7 or later.

In Endpoint Security (HX) xAgent version 26, databases operate more reliably and allow for automatic recovery whenever possible.

The table below describes the available storage modes.

Storage Mode	Description	Configuration
Conventional	This is the default storage mode. This storage mode stores write events in batches before writing them to the events database on disk. Important Use one of the other storage modes only if your endpoints experience a degradation in I/O processing times.	To select the default storage mode, remove the `storage_mode` key from the configuration file.
Memory-mapped I/O with log	This is the recommended memory-mapped storage mode. In this storage mode, read and write operations are backed by memory and backed by an on-disk journal file. Write transactions are written to the Write Ahead Log file (`events.db-wal`) then committed to the events database. The journal file prevents database corruption caused by unexpected restarts. This mode produces efficient disk I/O performance because read transactions are in memory. Memory-mapped I/O with log mode improves disk I/O performance for two reasons. Event processing does not need to transition to kernel mode to read and write data. Event data is stored in memory as much as possible and is written to the events database only when necessary. Before changing to this storage mode in your production environment, you should first determine the impact of the change in a test environment.	To select this storage mode, set the storage_mode key to `mmapiowithlog`.
In-memory	This storage mode stores the events database in memory. This mode increases memory usage, but improves disk I/O performance. Consider the following caveats before switching to in-memory storage mode. The in-memory events database is volatile. Events in the in-memory database are lost when the agent restarts or when event processing is restarted. Consequently, in-memory mode is best used for machines that remain running for long periods (such as servers). Any previous events database on disk remains untouched and unmodified. Events stored in it are not transferred to the in-memory database. If you switch back to the default storage mode, your agent resumes updating the events database on disk and the events in the in-memory database are lost.	To select this storage mode, set the `storage_mode` key to `inmemory`.
Memory-mapped I/O NOT RECOMMENDED	Use of this storage mode is not recommended because it may cause failure of Real-time Event storage and functionality. Please use MMAPIOWITHLOG. This storage mode uses memory mappings to back up read and write operations, and uses paging to optimize the read and write operations.	To select this storage mode, set the `storage_mode` key to `mmapio`.

This section covers how to set the event storage use limit using the Web UI. See the Endpoint Security (HX) REST API Guide for more information on setting the event storage use limit using the API.

Setting the Event Storage Use Limit for All Endpoints

To set the event storage use limit for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default policy link to access the Edit Policy page.
Click the Resource Use tab.
In the Resource Use section, specify the maximum number of megabytes of storage for the events database in the Event storage field. Valid values range from 10 to 500 MB. The default is 120 MB.
Click Save.

Setting the Event Storage Use Limit for Selected Host Sets

To set the event storage use limit for selected host sets:

Note

NOTE: See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Click the Resource Use tab.
In the Resource Use section, specify the maximum number of megabytes of storage for the events database in the Event storage field.Valid values range from 10 to 500 MB. The default is 120 MB.
Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Setting the Event Storage Mode for All Endpoints

To set the event storage use limit for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default policy link to access the Edit Policy page.
Click the Resource Use tab.
In the Resource Use section, click the Storage Mode drop-down and select the event storage mode setting.Valid modes include: conventional (default), in-memory, memory-mapped I/O (not recommended), and memory-mapped I/O with log.
Click Save.

Setting the Event Storage Mode for Selected Host Sets

To set the event storage use limit for selected host sets:

Note

NOTE: See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Click the Resource Use tab.
In the Resource Use section, click the Storage Mode drop-down and select the event storage mode setting.Valid modes include: conventional (default), in-memory, memory-mapped I/O (not recommended), and memory-mapped I/O with log.
Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Setting the priority schedule for xAgent Processes

You can set the agent's priority scheduling setting using the Web UI or the API.

Note

Priority Scheduling for agent processes is only supported on Trellix Endpoint Security (HX) version 4.5 or later.

The table below defines the base priority settings available for xAgent processes.

xAgent Process Base Priority Settings	Description	Base Priority Class by Operating System
xAgent Process Base Priority Settings	Description	Windows	macOS/Linux
IDLE	xAgent process threads are prioritized at the lowest base priority and will only run when the CPU is idle. All other process threads run at a higher priority. An IDLE setting will also result in longer I/O delays for agent processing. Important IDLE is the default priority scheduling setting assigned to xAgent process threads.	IDLE_PRIORITY_CLASS	19
BELOW NORMAL	The operating system prioritizes xAgent process threads above process threads with an IDLE base priority but below process threads with a NORMAL base priority.	BELOW_NORMAL_PRIORITY_CLASS	5
NORMAL	The operating system does not assign xAgent process threads any special scheduling needs.	NORMAL_PRIORITY_CLASS	0
ABOVE NORMAL	The operating system prioritizes xAgent process threads above process threads with a NORMAL base priority but below process threads with a HIGH base priority.	ABOVE_NORMAL_PRIORITY_CLASS	-5
HIGH	xAgent process threads preempt process threads with a ABOVE NORMAL, NORMAL, or IDLE base priority. Process threads assigned a HIGH base priority are considered time-critical tasks and must be executed immediately. Important Trellix does not recommend setting the priority scheduling value for xAgent process threads to HIGH. Process threads with a HIGH base priority may use nearly all of the available CPU time on your host endpoint.	HIGH_PRIORITY_CLASS	-10
HIGHEST	xAgent process threads are given the highest base priority and preempt process threads assigned all other base priority levels and important process tasks performed by the operating system.	REALTIME_PRIORITY_CLASS	-20

This section covers how to set the base priority for xAgent process threads using the Web UI. See the Endpoint Security (HX) REST API Guide for more information on setting the base priority for agent process threads using the API.

Setting the priority schedule for xAgent processes on all endpoints

To set the priority schedule for your agents on all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default policy link to access the Edit Policy page.
Click the Resource Use tab.
In the Priority Scheduling section, select the base priority level that you want to assign to the agent process threads. Trellix recommends that you set this value to NORMAL.
Important
Selecting IDLE for the Priority Scheduling value will result in longer IO delays for agent processing and cause xAgent processes to run only when the CPU is completely idle.
Selecting HIGH for the Priority Scheduling value may cause xAgent processes to use nearly all of the available CPU time on your host endpoint.
Click Save.

Setting the priority schedule for xAgent processes on selected host sets

To set the priority schedule for your xAgent s on selected host sets:

Note

See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Click the Resource Use tab.
In the Priority Scheduling section, select the base priority level that you want to assign to the xAgent process threads. Trellix recommends that you set this value to NORMAL.
Important
Selecting IDLE for the Priority Scheduling value will result in longer IO delays for xAgent processing and cause xAgent processes to run only when the CPU is completely idle.
Selecting HIGH for the Priority Scheduling value may cause agent processes to use nearly all of the available CPU time on your host endpoint.
Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Setting concurrent host limits

You can use concurrent host limits to set a maximum number of script-driven tasks, such as xAgent upgrades, enterprise searches, acquisitions, and triages that can run concurrently for a host set. The default number of concurrent tasks is limited to 500. However, you can use the Web UI or the API to change this number.

Caution

Concurrent Host Limits do not affect tasks that are not script-driven, such as downloads for antivirus, intelligence, configuration, and xAgent upgrades.

As a best practice, you should enable concurrent host limits within a custom policy that you create for your host endpoints. You can also use a custom policy to disable the concurrent host limit for selected host sets in your environment.

Important

You should only enable concurrent host limits for a small set of hosts in a constrained shared resource environment and that you configure the concurrent host limit feature globally for no fewer than 25% of your hosts.

This section covers the following topics:

Note

The host sets to which these limits apply can only be identified using the Web UI.

Prerequisites

Admin access when using the Web UI
The installed xAgent version must be version 20 or later. If an xAgent for an earlier release is included in a host set that is controlled by a policy, the policy is ignored for that xAgent.

Reviewing the Concurrent Host Limit Policy Settings

To review the concurrent host limit settings in the :

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Resource Use tab.
In the Concurrent Host Limit section, review the policy settings.

To review the concurrent host limit settings for a custom policy.

Important

To disable the concurrent host limit policy on selected host sets, use a custom policy. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, locate the concurrent host limit custom exception policy you want to modify.
Click the policy link to access the Edit Policies page.
The Concurrent Host Limit section shows whether the exception policy is enabled or disabled, and the number of hosts in the selected host sets that can run Endpoint Security (HX) tasks concurrently.
Note
Hosts may not be supported because the version number of the Trellix Endpoint Security (HX) xAgent installed on the hosts is earlier than version 20.

Configuring the Concurrent Host Limit

You can configure the concurrent host limit for all your host endpoints using the Web UI and the API. You can also enable and disable the concurrent host limit for selected host sets in your environment. See Excluding Host Sets from the Concurrent Host Limit Policy for more information.

This section covers how to enable, disable, and set the concurrent host limit using the Web UI. See the Endpoint Security (HX) xAgent API Guide for more information about configuring the concurrent host limit using the API.

Enabling the Concurrent Host Limit

To enable the concurrent host limit for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Resource Use tab.
In the Concurrent Host Limit section, toggle the Concurrent Host Limit ON/OFF switch to ON to enable the Endpoint Security (HX) server to limit the number of host endpoints that can run Endpoint Security (HX) tasks concurrently.
Click Save.

If you need to disable the concurrent host limit setting for selected host sets, use a custom policy to disable this setting and define host set exceptions. See Disabling the Concurrent Host Limit for more information.

Disabling the Concurrent Host Limit

To disable the concurrent host limit for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Resource Use tab.
In the Concurrent Host Limit section, toggle the Concurrent Host Limit ON/OFF switch to OFF to disable the concurrent host limit.
Click Save.

To disable the concurrent host limit for select host sets:

Note

When you disable a setting in a custom policy, the setting is disabled for all host sets assigned to the policy. If you want select host sets to keep the original setting, you must create a new custom policy with the setting enabled and assign it to the selected host sets. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the link for the custom policy you want to modify.
Select the Resource Use tab.
In the Concurrent Host Limit section, toggle the Concurrent Host Limit ON/OFF switch to OFF to disable the concurrent host limit.
Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Setting the Concurrent Host Limit

You can set the maximum number of endpoint hosts that can perform concurrent Endpoint Security (HX) tasks using the Web UI or the API. The concurrent host limit setting applies to all of your host endpoints.

Note

You can modify the Limit concurrent tasks to setting in the Agent Default Policy only. This setting is not supported in custom policies.

To set the limit for the concurrent host limit for all host endpoints:

Important

Use a custom policy to disable the concurrent host limit policy on selected host sets only.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the Agent Default Policy.
Select the Resource Use tab.
In the Concurrent Host Limit section, verify that the Concurrent Host Limit ON/OFF switch is set to ON.
In the Limit concurrent tasks to: field, specify the number of hosts in the selected host sets that can run HX tasks concurrently. Valid values range from 1 through 10,000 hosts. The default value is 500.
Click Save.