The extension reports High CPU Usage, what can I do?
ActiveGates can be configured with several levels of resource utilization limits, called performance profiles. By default, more restrictive limits are applied. Whenever you plan to scan over more than 1000 IP addresses, it is recommended that you configure your ActiveGate to use the High limits profile. With particularly large setups, the Dedicated profile allows the extension to leverage even more of the ActiveGate's resources.
To enable the High limits profile on an ActiveGate, navigate to Deployment Status. From there, find your ActiveGate, expand the row, and click on Settings. On the Extension Execution Controller tab, the dropdown allows you to select a different profile.
To enable the Dedicated profile, please follow the instructions here. Note: when following the instructions, please leave the restInterface
option enabled.
In addition, you should adjust the scan parameters accordingly (see the below answer).
How should scan parameters be adjusted?
The frequency and number of threads should be adjusted based on ActiveGate resources and the size of scanned subnets. As the main consumed resource on the ActiveGate is CPU, load tests were ran simulating the load through unresponsive IPs (keeping the CPU blocked and active).
The following tables show an example of how to adjust these parameters based on load and recommended ActiveGate sizing (labelled S (c7i.large), M (c7i.xlarge), and L (c7i.2xlarge)):
High limits profile:
| Load (IPs) | Threads (S) | Threads (M) | Threads (L) | Time (S) | Time (M) | Time (L) |
| ---------- | ----------- | ----------- | ----------- | -------- | -------- | -------- |
| 800 | 5 | 8 | 20 | 3 min | 2.5 min | 2 min |
| 1,600 | 3 | 8 | 20 | 9.6 min | 3.6 min | 2.9 min |
| 3,000 | 3 | 6 | 20 | 19 min | 9.4 min | 5.4 min |
| 5,000 | 3 | 6 | 20 | 30 min | 15 min | 8.8 min |
| 10,000 | 3 | 6 | 20 | 1 hr | 31 min | 18 min |
Dedicated limits profile:
| Load | Threads (S) | Threads (M) | Threads (L) | Time (S) | Time (M) | Time (L) |
| ------ | ----------- | ----------- | ----------- | --------- | -------- | -------- |
| 1,000 | 20 | 20 | 40 | 1.5 min. | 1 min. | < 1 min. |
| 3,000 | 7 | 15 | 30 | 8 min. | 5.1 min. | 4 min. |
| 5,000 | 7 | 15 | 30 | 13.4 min. | 8 min. | 8 min. |
| 10,000 | 7 | 15 | 20 | 24 min. | 18 min. | 18 min. |
My monitored devices still appear unmonitored. How do I fix this?
To reduce the load on the scanner, but also allow monitored data to take priority, the extension requires an API Token. Please ensure the token has 'Read entities' permission. Also, ensure that the API routing module (restInterface
) is enabled on the ActiveGate (even on a Dedicated profile).
Our specialized extensions are being updated to adopt the new network entity model. Currently, only devices monitored by the following extensions will be part of the topology: