Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Bsdiff.exe causes high CPU usage on the OfficeScan Server

    • Updated:
    • 13 Apr 2016
    • Product/Version:
    • OfficeScan 10.6
    • OfficeScan 11.0
    • Platform:
    • Windows 2003 Enterprise Server
    • Windows 2003 Standard Server Edition
    • Windows 2008 Enterprise Server
    • Windows 2008 Standard Server Edition
    • Windows 2012 Standard
    • Windows 2012 Standard R2
Summary

Bsdiff.exe is causing a sudden spike in CPU usage on the OfficeScan server that lasts for one to two minutes.

Details
Public
Bsdiff.exe is a module in the Integrated Scan Server (ISS) used when creating the differential pattern file for the Smart Query Pattern. A sudden spike is expected if there is a frequent update since it tries to create 24 differential pattern and covers the entire 24 hours of smart query pattern in case Trend Micro creates the pattern in an hourly basis.
If the CPU usage spike is becoming frequent, you may check the scheduled update setting for the ISS and tune it to "every hour".
If the spike increases to more than two (2) minutes and affects the overall server performance, do the following:
  1. Perform a debug.
    1. Enable logging by editing the \WSS\Log.ini file as below:
      ==============
      [TMCOMMONLOGGING]
      LogEnable          = 1
      LogLevel            = 4
      ============== 
    2. Edit the Aucfg.ini file on the same folder and then set it as below:
      ==============
      [debug]
      Level=-1
      ==============
    3. Restart the Trend Micro Smart scan Server service.
    4. When the problem occurs, please collect the following:
      d.1  PCCSRV\WSS\AU.ini
      d.2. PCCSRV\WSS\aucfg.ini
      d.3. PCCSRV\WSS\Diagnostic.log
      d.4  PCCSRV\WSS\log.ini
      d.5. PCCSRV\WSS\PatternVersion.ini
      d.6. PCCSRV\WSS\UpdatePattern.ini
      d.7  PCCSRV\WSS\Patterns\*.*
      d.8  PCCSRV\WSS\AU_Data\*.*
      d.9  CDT Log from the Server ( no replication required )
      d.10 System event logs 
    5. Send the logs to Trend Micro Technical Support.
  2. As a temporary measure, disable the update for ISS under Smart Scan > Integrated Server by deselecting Enable Schedule updates.
    This should be done while waiting for an update from Trend Micro Technical Support regarding the logs you provided.
Note: Bsdiff.exe can also cause an increase in CPU usage on the OfficeScan server if the UpdatePattern.ini file is modified. If this is the case, set the default values of the UpdatePattern.ini file:
[GenBFDiff]
MaxDiff=8
KeepPtn=42
Premium
Internal
Rating:
Category:
Configure; Troubleshoot; Update
Solution Id:
1057204
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.