Summary
Bsdiff.exe is causing a sudden spike in CPU usage on the OfficeScan server that lasts for one to two minutes.
Details
Bsdiff.exe is a module in the Integrated Scan Server (ISS) used when creating the differential pattern file for the Smart Query Pattern. A sudden spike is expected if there is a frequent update since it tries to create 24 differential pattern and covers the entire 24 hours of smart query pattern in case Trend Micro creates the pattern in an hourly basis.
If the CPU usage spike is becoming frequent, you may check the scheduled update setting for the ISS and tune it to "every hour".
If the spike increases to more than two (2) minutes and affects the overall server performance, do the following:
- Perform a debug.
- Enable logging by editing the \WSS\Log.ini file as below:
==============
[TMCOMMONLOGGING]
LogEnable = 1
LogLevel = 4
============== - Edit the Aucfg.ini file on the same folder and then set it as below:
==============
[debug]
Level=-1
============== - Restart the Trend Micro Smart scan Server service.
- When the problem occurs, please collect the following:
d.1 PCCSRV\WSS\AU.ini
d.2. PCCSRV\WSS\aucfg.ini
d.3. PCCSRV\WSS\Diagnostic.log
d.4 PCCSRV\WSS\log.ini
d.5. PCCSRV\WSS\PatternVersion.ini
d.6. PCCSRV\WSS\UpdatePattern.ini
d.7 PCCSRV\WSS\Patterns\*.*
d.8 PCCSRV\WSS\AU_Data\*.*
d.9 CDT Log from the Server ( no replication required )
d.10 System event logs - Send the logs to Trend Micro Technical Support.
- Enable logging by editing the \WSS\Log.ini file as below:
- As a temporary measure, disable the update for ISS under Smart Scan > Integrated Server by deselecting Enable Schedule updates.
This should be done while waiting for an update from Trend Micro Technical Support regarding the logs you provided.
Note: Bsdiff.exe can also cause an increase in CPU usage on the OfficeScan server if the UpdatePattern.ini file is modified. If this is the case, set the default values of the UpdatePattern.ini file:
[GenBFDiff]
MaxDiff=8
KeepPtn=42
MaxDiff=8
KeepPtn=42
