Expected behaviour

The following sections list the expected behavior when you manage Xprotect agents and hosts and use the features in Xprotect.

CPU utilization on managed hosts

On the hosts managed from Xprotect, the CPU used by the Xprotect agent on the hosts is dependent on the total number of concurrent network connections with the host.

• For Windows hosts with sizing of 16 GB RAM, 30 GB disk space, and 2 CPUs, the following are the expected CPU utilization percentages.

  Total number of connections	CPU utilization (%)
  up to 500	negligible
  above 500 and up to 3000	1 to 2
  above 3000 and up to 7000	2 to 5
  above 7000 and up to 12000	5 to 6

• For Linux and mac OS hosts with sizing of 16 GB RAM, 30 GB disk space, 2 CPUs, and a base CPU utilization of 1.7%, the following are the expected CPU utilization percentages.

  Total number of connections	CPU utilization (%)
  up to 500	2 to 3
  above 500 and up to 3000	3 to 5
  above 3000 and up to 8000	5 to 8
  above 8000 and up to 14000	8 to 14
  above 14000 and up to 18000	14 to 21
  above 18000 and up to 20000	21 to 27