Summary
Bsdiff.exe is causing a sudden spike in CPU usage on the WFBS server that lasts for one to two minutes.
Details
Bsdiff.exe is a module in the Integrated Scan Server (ISS) used when creating the differential pattern file for the Smart Query Pattern. A sudden spike is expected if there is a frequent update since it tries to create 24 differential pattern and covers the entire 24 hours of smart query pattern in case Trend Micro creates the pattern in an hourly basis.
WFBS 8 with iCRC 2.0 have CPU control for Bsdiff.exe, its CPU usage will keep under 60%.
If the spike increases to more than 2 minutes and affects the overall server performance, disable the update for Integrated Smart Scan under Updates > Scheduled Update and deselecting Smart Scan Pattern then follow the debugging procedure below:
- Edit the ..\WSS\Log.ini file to enable logging:
[TMCOMMONLOGGING]
LogEnable= 1
LogLevel= 4 - Edit the ..\WSS\Aucfg.ini file and then set it as below:
[debug]
Level=-1 - Restart the Trend Micro Smart Scan Server service.
If the issue persists, collect the following and send to Trend Micro Technical Support:
- PCCSRV\WSS\AU.ini
- PCCSRV\WSS\aucfg.ini
- PCCSRV\WSS\Diagnostic.log
- PCCSRV\WSS\log.ini
- PCCSRV\WSS\PatternVersion.ini
- PCCSRV\WSS\UpdatePattern.ini
- PCCSRV\WSS\Patterns\*.*
- PCCSRV\WSS\AU_Data\*.*
- CDT Log from the Server ( no replication required )
- System event logs
