Resource Analyzer & High CPU with Trend Anti-virus

[Curtis Taylor]

I apologize if this is already documented elsewhere....

Whenever a report is executed within WebFocus, the Trend Anti-virus on the production server will spike up to 30% when the resource analyzer is enabled. We tried whitelist the entire application folder (ibi/srv82). Has anyone else ran into this issue?

Windows 2019 Server

9.0.3 webfocus version

[David Beagan]

I wonder if you whitelisted all of ibi/ if it would make any difference?

[Toby Mills]

Hi Curis

That's a tough one. We usually know the folder where the Resource Analzyer log files are being written to (default for windows):

X:ibisrv82homebin (where X: is your drive letter).

I guess the question I'd have first is how to prove that Trend is actually trying to look at things in your whitelisted folder.

Are there logs you can turn on in your Trend product that shows you what its looking at?

Can you tell for sure that ibisrv82 AND all its subfolders are really marked as exceptions? Maybe it missed the subfolders?

I think I'd focus on proving to myself that Trend is getting busy looking at IBI files Maybe it's actually looking at an executable instead of really watching a folder for something to write to it? You can find all our .exe's under ibisrv82homebin if you want to see a list.

One other thing - I notice you're using version 9x. And your folder is still ibisrv82. I presume you did an upgrade in place and that's the reason for the srv82 instead of srv90? Or maybe it just installed that way.

Is your SQL repository also on your same VM as WebFOCUS?

I think it all comes down to trying to be able to watch Trend work to see what it's looking at. Maybe ask Trend for a more exhaustive log that shows what its looking at when it's running. A list of folders it is scanning would be super helpful.

And yes, I've seen antivirus software get busy with WebFOCUS servers / tomcat before. So you may need some whitelisting.

[Curtis Taylor]

Thanks for the replies!

I've got our Networking department to open a ticket with Trend to look into the logs to see what's going on.

We did do an in-place upgrade of WebFocus - that's why the folder name is a little off.

The SQL repository is on a different VM than WebFOCUS reporting server.

I'll give an update to the community once I find out more. Thanks for the advice!