Which features may contribute to unusually high CPU usage in the EventSentry agent?

Question

Accepted Answer

The EventSentry Agent is designed to use a minimal amount of CPU usage as not to affect the performance of the monitored host in any way. Under normal circumstance, the average CPU utilization of the CPU should be < 1%.

Certain features and environmental conditions can however temporarily spike the CPU usage.

High Event Log Activity
EventSentry is designed to handle high event log activity (100+ events / second), however extremely active event logs can cause the CPU usage to increase over 1%.

Complex Event Log Filter Rules
Event Log filter support complex evaluations such as:

file matches checksum
file entropy
file has (does not have) digital signature

may increase CPU load if they match a large amount of events during runtime.

High Process Activity
Extremely high process activity can affect CPU usage when "Security & Compliance: Process Tracking" has both checksum and Check Digital Signature enabled. High process activity also results in the generation of more events in the security event log (and possibly the Sysmon event log if enabled), further adding to the processing load of the agent.

Digital File Checksum Features
All features involving the creation of file checksums (e.g. SHA256) will affect CPU usage, since creating cryptographic checksum requires additional CPU cycles. This includes:

System Health: File Checksum / Integrity Monitoring
Security & Compliance: Process Tracking with checksum enabled
Security & Compliance: File Access with "Normalize, Verify & Filter"
Event Log filters utilizing "file matches checksum"

Digital File Signature
Verifying the digital signature of a file under "Security & Compliance: Process Tracking" may also utilize additional CPU resources on systems with extremely high process activity.

Large Volumes
Monitoring volumes with an extremely large amount of files may also increase the CPU load: