Why is my scanner consuming 100% of the CPU and Should the Tivoli Endpoint Manager agent be excluded from antivirus scanning?
Configure your virus scanner on TEM-managed computers to exclude the Tivoli Endpoint Manager agent and the Tivoli Endpoint Manager SUA Scanners.
Resolving the problem
The Tivoli Endpoint Manager Agent and Tivoli Endpoint Manager Software Usage Analysis (SUA) Scanners components are used to evaluate compliance with policy and analyze the properties of executable files on managed systems.
For the TEM Client - BESClient.exe
For SUA 1.3 - SAMScanner.exe
For SUA 2.0 - Itsit.exe
The normal operations of these programs involve reading file properties in addition to creating and processing temporary files. This activity is essential for TEM's operation, but can be slowed down dramatically if a virus scanner is scanning each file on access. To address this issue, configure your virus scanner on TEM-managed computers to exclude the TEM Agent (besclient.exe) and TEM SAM Scanner (samscanner.exe).
Additional performance improvements can be realized by excluding the TEM Agent's directory and subfolders (default is C:\program files\bigfix enterprise\bes client). Refer to instructions from your virus scanner for more information on how to set these exclusion rules. The scanning process uses operating system APIs to query information and does not execute potentially infected files.
Note: The scanners will appear to be taking 100% of the CPU if they are not excluded from the real time scanner.
Note: if the entire besclient directory is excluded from scanning, this may cause programs downloaded and launched by Tivoli Endpoint Manager to not be scanned. Examples of this sort of program include patches, software installers, and utilities.
Performance best practices for anti-virus can be found here: https://www.ibm.com/developerworks/community/wikis/home?lang=en#/wiki/Tivoli%20Endpoint%20Manager/page/Performance%20Configurations.
See also the "Configure virus scanners not to scan TEM Server / TEM Relay folder" section in the following performance best practices: https://www.ibm.com/developerworks/community/wikis/home?lang=en#/wiki/Tivoli%20Endpoint%20Manager/page/Performance%20Configurations.