Hi, we need to lower the cpu usage by the initial scan done by auditbeat windows agent. it takes up to 20% but for 30 to 60 min and we need to reduce the CPU consumption because is a critical server.
Is there a way to resolve that?
scan_rate_per_sec is one knob that you could adjust. Or you may wish to entirely disable scan_at_start.