Agent-based throttling of command executions
Disclosed herein are methods, systems, and processes to perform granular and selective agent-based throttling of command executions. A polling interval of an agent process executing on a protected host is monitored. If the agent process is active and a current throttle is greater than a desired throttle, the agent process and its children processes are suspended and a run count flag is incremented. However, if the agent process is inactive and the current throttle is less than or equal to the desired throttle, the agent process and its children processes are resumed and a skip count flag is incremented.
1. A computer-implemented method, comprising:
for a polling interval of an agent process executing on a host computing device:
suspending the agent process and one or more children of the agent process and incrementing a run count of the agent process if the agent process is running and a current throttle is greater than a desired throttle generated for the agent process, or
resuming the agent process and the one or more children of the agent process and incrementing a skip count of the agent process if the agent process is not running and the current throttle is less than or equal to the desired throttle generated for the agent process.
2. The computer-implemented method of claim 1 , further comprising:
determining that a command execution associated with the agent process has exceeded a resource consumption threshold allocated to the agent process.
3. The computer-implemented method of claim 2 , wherein
the desired throttle generated for the agent process indicates an efficiency value at which the agent process should run based on the resource consumption threshold allocated to the agent process to finish command execution.
4. The computer-implemented method of claim 2 , wherein
determining that the command execution associated with the agent process has exceeded or is likely to exceed the resource consumption threshold is based on identifying that the command execution is at least one of a full filesystem search or a PowerShell script.
5. The computer-implemented method of claim 1 , wherein
the polling interval is a frequency with which the agent process is monitored.
6. The computer-implemented method of claim 5 , wherein
the current throttle is based on the run count and the skip count of the agent process in the polling interval.
7. The computer-implemented method of claim 1 , wherein
the run count indicates a number of intervals the agent process has spent actively running.
8. The computer-implemented method of claim 1 , wherein
the skip count indicates a number of intervals the agent process has been idle.
9. The computer-implemented method of claim 1 , further comprising:
determining that a command execution thread is active.
10. The computer-implemented method of claim 9 , wherein
the command execution thread is executed and monitored by an abstraction layer provided by the agent process, and
the agent process is initiated by an agent executing on the host computing device.
11. A non-transitory computer readable storage medium comprising program instructions executable to:
for a polling interval of an agent process executing on a host computing device:
suspend the agent process and one or more children of the agent process and incrementing a run count of the agent process if the agent process is running and a current throttle is greater than a desired throttle generated for the agent process, or
resume the agent process and the one or more children of the agent process and incrementing a skip count of the agent process if the agent process is not running and the current throttle is less than or equal to the desired throttle generated for the agent process.
12. The non-transitory computer readable storage medium of claim 11 , further comprising:
determining that a command execution associated with the agent process has exceeded a resource consumption threshold based on identifying that the command execution is at least one of a full filesystem search or a PowerShell script that is part of a data collection routine performed by an agent executing on the host computing device.
13. The non-transitory computer readable storage medium of claim 12 , wherein
the polling interval is a frequency with which the agent process is monitored,
the desired throttle generated for the agent process indicates an efficiency value at which the agent process should run based on the resource consumption threshold allocated to the agent process to finish the command execution,
the current throttle is based on at least the run count and the skip count of the agent process in the polling interval,
the run count indicates a number of polling intervals the agent process has spent actively running, and
the skip count indicates a number of polling intervals the agent process has been idle.
14. The non-transitory computer readable storage of claim 11 , further comprising:
determining that a command execution thread is active, wherein
the command execution thread is executed and monitored by an abstraction layer provided by the agent process, and
the agent process is initiated by an agent executing on the host computing device.
15. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
for a polling interval of an agent process executing on a host computing device:
suspend the agent process and one or more children of the agent process and incrementing a run count of the agent process if the agent process is running and a current throttle is greater than a desired throttle generated for the agent process, or
resume the agent process and the one or more children of the agent process and incrementing a skip count of the agent process if the agent process is not running and the current throttle is less than or equal to the desired throttle generated for the agent process.
16. The system of claim 15 , further comprising:
determining that a command execution thread is active.
17. The system of claim 16 , wherein
the command execution thread is executed and monitored by an abstraction layer provided by the agent process, and
the agent process is initiated by an agent executing on the host computing device.
18. The system of claim 15 , further comprising:
determining that a command execution associated with the agent process has exceeded a resource consumption threshold based on identifying that the command execution is at least one of a full filesystem search or a PowerShell script that is part of a data collection routine performed by an agent executing on the host computing device.
19. The system of claim 18 , wherein
the polling interval is a frequency with which the agent process is monitored,
the desired throttle generated for the agent process indicates an efficiency value at which the agent process should run based on the resource consumption threshold allocated to the agent process to finish the command execution,
the current throttle is based on at least the run count and the skip count of the agent process in the polling interval,
the run count indicates a number of polling intervals the agent process has spent actively running, and
the skip count indicates a number of polling intervals the agent process has been idle.