IJ23404: WSCANSW AND WSCANFS ARE USING HIGH CPU FOR A LONG TIME

APAR status

• Closed as program error.

Error description

• It has been confirmed that in a very rare case, on some unusual
  Unix OS setups, under circumstances that have not yet been
  precisely defined, the mechanism of caching the scan data by
  the software scanner fails. Due to this error, the scanner is
  looping through the cache data, and as a result occupies one of
  the threads available on the machine. The issue is caused by
  the incorrect processing of scanner cache
  data.
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  TS000163305
  

Local fix

• The scanner job which encountered the issue needs to be
  forcefully stopped. If the issue reappears, to avoid another
  occurrence of the problem, it should be sufficient to disable
  the cache mechanism for that particular endpoint. However, the
  impact of this change on the scan duration needs to be
  considered. One of actions that might improve the situation is
  to narrow down the list of scanned directories. For more
  information, see the following link: https://www.ibm.com/support
  /knowledgecenter/SS8JFY_9.2.0/com.ibm.lmt.doc/Inventory/planinco
  nf/c_excludedirs_main.html
  
  Other good practices for scanning
  are described under the following link:
  
  https://www.ibm.com/sup
  port/knowledgecenter/SS8JFY_9.2.0/com.ibm.lmt.doc/Inventory/tuni
  ng/c_scan_import_practicies.html
  

Problem summary

• ****************************************************************
  *****************
  ERROR DESCRIPTION:
  It has been confirmed that in a very rare case, on some unusual
  Unix OS setups, under circumstances that have not yet been
  precisely defined, the mechanism of caching the scan data by
  the software scanner fails. Due to this error, the scanner is
  looping through the cache data, and as a result occupies one of
  the threads available on the machine. The issue is caused by
  the incorrect processing of scanner cache
  data.
  
  
  
  
  
  
  To apply the fix, the scanner needs to be upgraded to the
  9.2.29.0000 version. To change the scan cache provided open
  BigFix Console and set the computer property called
  'CIT_Scan_Provider' to the value 'provider_cache3'
  on the problematic endpoint.
  
  The new cache mechanism have following limitations in this
  release:
  
  
  
  Supported operating systems
  - Linux x86 (x86_64)
  - AIX
   
  Functionalities not yet supported
  - Shared disks scanning
  - Wildcards (? and *) in includeDirectory parameter of CIT scan
  configuration (Note: Wildcards in excludeDirectory are supported
  )
  - UTF-8 encoding
  - CPU threshold
  - Timeout
  - File checksums (md5, sha256 etc.)
  
  
  
  
  
  TS000163305
  
  ****************************************************************
  *****************
  * EXPECTED RESULTS:
  * The issue does not occur.
  ****************************************************************
  * RECOMMENDATION: Apply appropriate update when available.
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following maintenance
  packages:
   | Update | ILMT 9.2.30.0
  ****************************************************************
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  LIC METRIC TOOL

• Fixed component ID

  5724LMTEM

Applicable component levels