On some machines, AeXMetricProv.exe consumes high CPU usage. This behavior is most prevelant on, but not limited to, Domain Controllers.
This condition occurs on machines with excessively busy NT Event Logs. Domain Controllers are most likely to experience this issue because their NT Event Logs, the Security log in particular, are typically busier than other Windows machines.
If any NT Event rules are enabled in a Monitor Policy, the Monitor Agent will then read all NT Events which occur on a machine. This architecture is not typically problematic unless the NT Event Logs are excessively busy (e.g. thousands of events per minute).
To aleviate the CPU consumption, separate all Domain Controllers (and other machines with excessivley busy NT Event Logs) from the existing Monitor Policies. Clone the existing enabled policies, remove all NT Event based rules, and apply the policies to only the effected machines. This will allow all other monitoring to occur except for NT Event monitoring which will resolve the high CPU consumption of the Monitor Agent.
Monitor Solution for Servers 7.x and 8.x
ID: ETK 1998414
Logged in Etrack (Symantec) database
Imported Document ID: TECH122357
Subscribing will provide email updates when this Article is updated. Login is required.