A customer has a machine that runs a virus scan at a set time. During this time period the McAfee mcshield.exe process consumes 100% of cpu for the duration of the scan ( 1 1/2 hr - 3 hrs) causing the cdm probe to alarm on total cpu usage. The customer did not want to process the alarm when the McAfee scan was in progress.
- Windows Server 2008 SR2
- cdm probe
- McAfee scan
Using the nas probe, create a preprocessing rule.
message string: /.*total cpu is.*/
Action: exclude (delete) or make the alarm invisible
Optionally, set the 'Operating Period' of the profile as desired so the preprocessor rule will only be active during those hours.