Host server jobs

Qualys vulnerability scan is run against iseries environment on a weekly basis. the purpose of running this scan is to fix any issues in the iseries.
When these scans are run on a weekly basis it causes elevated CPU utilization and since these scans run for a period of 1-2 hrs it causes high level of CPU utilization.

The simple fact is that SSL connections are costly from a CPU perspective. Opening 600 connections during scan is causing high level of CPU Utilization. The host server jobs are doing what we expect.....processing the bad SSL connections but the processing is casuing very high level of CPU Utilization. . These scans are also run across HP /AIX / Linux systems but does not cause high level of CPU Utilization as in iseries.

There were some 3rd party vendor jobs that were also causing high level of CPU Util and they have been fixed by the vendor via a PTF.

The TCP traces have been done and results have been sent to IBM.

Scans which are done on a weekly basis You can see on the attachment that when scans are done around 1330 there is a high level of CPU Utilization for more than an hour. We have tested and captured traces without Host server ports excluded in scan and have seen the results .

A redesign of host server code would make it efficient so that it processes ssl (good / bad) connections in a more efficient manner and in a manner which does not result in CPU spikes and in a manner which is consistent with other tcp servers on the system i.