I’m in charge of a SQL Server in an Azure Virtual Machine. There is an extended event running permanently, and it uses two events, sp_cache_hits and sp_cache_missed.
The extended event session is called Advanced Threat Protection for Queries.
I can see in the Performance Dashboard that this session is taking a lot of CPU time, and I’m having CPU issues with this server because it is one of the first wait states.
I wonder if it is a Good Idea to have an extended event session running forever, not considering the hypothetical benefits.
Have you any idea of Advanced Threat Protection merits?
Thank you for your answer.