# Elastic agent and SvcHost DnsCache very high CPU usage **URL:** \ **Category:** Endpoint Security\ **Tags:** elastic-agent\ **Created:** [May 12, 2022, 8:10am UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536 "2022-05-12T08:10:07Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![popeio](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@popeio](https://discuss.elastic.co/u/popeio)\ **Post date:** [May 12, 2022, 8:10am UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/1 "2022-05-12T08:10:08Z")
Hi everyone, We've been happy users of the ELK stack and endpoint security components for quite some time now. During the past few months we've been living with **occasional** , weird **performance issues** which seem to be related to **the mere presence of the agent** on some machines. This sort of issues appears only on some **Windows 10 machines** , we've observed it on some servers but to a much more limited extent. What we see is **SvcHost** consuming a **huge percentage of CPU** time and resources, even though the actual activity we observe on the host experiencing this issue is very low. RAM consumption remains extremely low at all times. - This does not appear to be related to **endpoint security** , because if we totally disable the endpoint security integration on the specific endpoint we observe little changes (from 90% down to 85%, for example). - Disabling the individual components of the security suite (ransomware, malware, memory, ...) makes up for an even less noticeable difference. - Disabling **only events collection** from the endpoint security integration makes no difference. - Entirely removing the endpoint security integration from the policy (yup, for good measure we tried this too) doesn't make a difference. - If we enable metrics collection, either via the generic `system` integration or via the specialized `windows` integration, we do see some noticeable difference in CPU usage. It still does not account for a sizable amount, but we do see a 20% difference, which is already significant. - Entirely uninstalling the Elastic Agent, of course, does make a difference and the system load gets back to low thresholds. - Adding **SvcHost** and a couple of other system binaries to **Trusted Applications** does not seem to help either, no changes were observed in the agent's behaviour. I want to specify that we are always talking about machines which do **very little work** : this specific machine I am thinking about now is barely attempting to check-in with its domain controller every now and then, without actually be doing anything special. In fact, without the agent the overall system load is extremely low (between 5 and 10 %). I'm kinda lost unfortunately 😅 has anyone in here experienced similar issues? Is there any meaningful additional information I should share for additional context? BTW all of our agents are at **version 7.17.0** , with ongoing activities to get up to speed with the new **8.\*** release. P.s.: I add that the Elastic Endpoint component remains functional at all times and that `endpoint-security` metrics do not seem to highlight any particolar issue with the agent's behaviour on the client: everything _seems_ to be working fine. Of course, it's not something I developed and I might be wrong 🙂 ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [May 17, 2022, 1:15pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/2 "2022-05-17T13:15:38Z")
I haven't seen similar behavior, do you have the same high level usage if you do the following: - remove endpoint - remove system integration - add a simple log integration that tails an empty file? The above will give us a baseline, nothing would be actively done. **Questions:** Is the cpu usage is coming from elastic-agent or one of the other binary run by the agent? Filebeat/metricbeat. Is there any error log in any of the Elastic Agent's logs? ---
**Author:** ![popeio](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@popeio](https://discuss.elastic.co/u/popeio)\ **Post date:** [May 17, 2022, 1:34pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/3 "2022-05-17T13:34:45Z")
Hey @pierhugues , thanks for reaching out! We haven't tried doing the actual **unenroll** , but I can tell you that: 1. Metricbeat is seen doing a fair bit of work (roughly 20% CPU), _ **if and only if** _ we enable actual collection of performance metrics, for example from perfmon via the `system` integration. 2. Filebeat is not seen anywhere in the top 10 resource consumers. 3. If we completely empty the policy, removing every integration, CPU consumption is still extremely high. 4. If we disable metrics collection, and therefore Metricbeat, CPU usage lowers down a little, but not significantly. There appear to be absolutely **no error messages from the agent**. As far as CPU usage is concerned, depending on whom you ask you'll get two different answers: A) If you ask the Windows Task Manager, the top consumer is **Elastic Agent** - B) If you ask sysmon / perfomon, the top consumer is **SvcHost.exe** with its DnsCache. I am more inclined to beliave the latter. Should we maybe try and update to 8.2, just to see if anything improves? We did update some endpoints already, we haven't updated this one yet. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [May 17, 2022, 1:42pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/4 "2022-05-17T13:42:56Z")
Upgrading would be a good idea, so we can get a diagnosics from the machine. (this is not available in 7.17) ---
**Author:** ![popeio](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@popeio](https://discuss.elastic.co/u/popeio)\ **Post date:** [May 17, 2022, 2:57pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/5 "2022-05-17T14:57:54Z")
Thanks for your help and for the suggestion: we've just upgraded and in fact we are observing some improvement, even though the CPU usage is still pretty high. To sum it up: 1. **SvcHost.exe** at ~45% 2. **SearchApp.exe** at ~18% 3. **Metricbeat** at ~14% 4. **Filebeat** at ~13% What puzzles me is the insane amount which seems to be done by **SvcHost** , even though it's not true at all and the system is barely doing DNS queries at all. ~~I can't seem to find any way to get a diagnostics, and I'm probably blind but can't seem to find anything relevant on the official docs, would you mind giving me a couple of directions to look into?~~ EDIT: Nevermind, I found the relevant docs regarding the `diagnostics` command, I'm afraid it won't be easy to do as this endpoint is not anywhere close to us right now. Is there any specific information which I should be looking for, or I which should share with you, in case you need to specifically investigate this issue? Thanks for your help till now! ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [May 20, 2022, 2:41pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/6 "2022-05-20T14:41:21Z")
I would like to see the logs files and see if there is anything there, that would be my first thing. I am not sure yet what would cause that such high level of cpu for svchost. ---
**Author:** ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)\ **Post date:** [May 24, 2022, 1:10pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/7 "2022-05-24T13:10:41Z")
hi @popeio , svchost could mask a myriad of issues. Since the problem also appears when the Elastic Agent is effectively not running any integrations (including monitoring?) the things I can think of is some group policy configuration or, if DNSSEC validation enabled could be causing this when the elastic agent is checking in with Fleet. Can you review those again (also if you are using DNSSEC)? Would also be interesting to unenroll the elastic agent, keep it running and let us know if anything changes with the CPU usage. ---
**Author:** ![popeio](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@popeio](https://discuss.elastic.co/u/popeio)\ **Post date:** [May 24, 2022, 1:42pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/8 "2022-05-24T13:42:48Z")
Hi @MarianaD, we actually sort of "tried that by mistake", because we unenrolled the agent first from the SIEM, before actually uninstalling the agent. During that time, no apparent different was recorded by the end user on the PC (_but_ I'd be a bit cautious about this info: it's one thing when we are monitoring it and (in)directly looking at `perfmon`, it's another thing when it's an external user, albeit a rather technically capable one, making the report). For what concerns your observation about DNSSEC, heck: that's a valid concern! We do have DNSSEC active on the domain name we use with our Elastic SIEM. If I manage to obtain a `diagnostics` from the agent as @pierhugues suggested a few days ago, may I drop the output in here, or do you have some other way of sharing this sort of information? I'll review and redact sensible details before sharing, of course. Thanks for the support! ---
**Author:** ![TTCD](https://avatars.discourse-cdn.com/v4/letter/t/9f8e36/32.png) [@TTCD](https://discuss.elastic.co/u/TTCD)\ **Post date:** [May 31, 2022, 9:16pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/9 "2022-05-31T21:16:01Z")
Hey @popeio, I had something similar when I was working with one of our IIS servers. After working with the Elastic engineers, we were informed to add `C:\Windows\SysWOW64\inetsrv\w3wp.exe` and `C:\Windows\System32\inetsrv\w3wp.exe` as trusted applications. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 28, 2022, 9:16pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536/10 "2022-06-28T21:16:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.