cancel
Showing results for 
Search instead for 
Did you mean: 
VPaclt
Level 7
Report Inappropriate Content
Message 1 of 6

Memory Protection caused performance issue

Hello,

we have a problem with Memory Protection in Solidcore 8.x which caused various performance issues. In some cases CPU is running on 100%, or production softwares are very slow during operations, ... . Affected software is not one type, but many different brands. 
Solution that help was to disable VASR by command "sadmin features disable mp-vasr". Based on this, I was trying to create rules based on the local log file for every VASR error (vasr_hooks or vasr violation detected) but without success. Only disable vasr feature help. 
OS on affected clients: Windows 7, Windows 10 

Is it possible that memory protection of solidcore has a problem with windows memory protection ?

Do you have some solution without needs to disable mp-vasr at all ?

Soldicore versions we have in use: 8.0.0-950 , 8.0.2-125
Agent: 5.5.1-342


Thank you,

Vlastimil Paclt
ZF

5 Replies
McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Memory Protection caused performance issue

please increase log level "sadmin loglevel enable pst info"

then reproduce the issue.

Collect Gatherinfo and open a case with support. 

 

If customer has ENS or VSE installed on the machine. Then MP needs to be disabled anyways and you dont need an exception.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Memory Protection caused performance issue

Hi Benjamin,

 

After installing solidcore and enabling GTI option in few windows servers 2012R2 we could see the McAfee solidcore service utilizing more than 170MB and if we disable GTI the memory usage in windows servers is reducing to 20MB.

We have also tested with latest version 8.2.1 Update 3, Agent version 5.0.5, VSE 8.8.0.1247 

Is that a default behavior of Memory with McAfee GTI turned ON? Please suggest.

 

 

McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: Memory Protection caused performance issue

Honestly i would say that is good. Mine is Windows 10 with no GTI and its at 120MB

Do you have the VSE exclusions inplace? KB88915

 

If you believe there is something to be concerned. You can check for a memory leak, collect this data and open a case, then we can look further but i think thats as designed as memory usuage could very depending on what the machine is doing.

 

- Memory Leak

Perform the steps in this section if the symptoms are any of the following:

  • Memory Leak

Data Collection for Memory Leak using PoolMon (sysinternals):

  1. (Windows 2000/XP only) On Windows 2000 and Windows XP, you must first use GFlags to enable pool tagging. On later versions of Windows, pool tagging is always enabled. GFlags is included in Debugging Tools for Windows. Start GFlags, click the System Registry tab, select Enable Pool Tagging, and then click Apply. You must restart Windows for this setting to take effect. 
  2. Start PoolMon.
  3. Choose the kind of pool to include:
    • If you have determined that the leak is occurring in non-paged pool, press P once.
    • If you have determined that the leak is occurring in paged pool, press P twice.
    • If you do not know, do not press P and both kinds of pool are included.
  4. Press B to sort the display by maximum byte use.
  5. Start your test.
  6. Take a screenshot and copy it to Notepad. Take a new screenshot every half hour. By comparing screenshots, determine which tag's bytes are increasing.

Data Collection for Memory Leak using WinDBG:

  1. Download and install the Debugging Tools for Windows.
  2. (Windows 2000/XP only) On Windows 2000 and Windows XP, you must first use GFlags to enable pool tagging. On later versions of Windows, pool tagging is always enabled. GFlags is included in Debugging Tools for Windows. Start GFlags, click the System Registry tab, select Enable Pool Tagging, and then click Apply. You must restart Windows for this setting to take effect. 
  3. Configure the system to generate a complete memory dump. For instructions to create a memory dump, see KB56023.
  4. Wait for the low memory symptoms to occur: system unresponsive, application(s) failing or stuck, or Task Manager showing high kernel memory (paged or non-paged) usage.
  5. Crash the system manually to generate a complete memory dump. For instructions to force a system crash, see KB85853.

- Windows Performance Monitor Memory Usage for scsrvc.exe process

  1. Download perfmon_template_scmem.zip attached to KB.
  2. Extract perfmon_template_scmem.xml from perfmon_template_scmem.zip.
  3. Start -> Windows Administrative Tools -> Performance Monitor as Administrator.
  4. Expand Data Collector Sets.
  5. Right click on User Defined -> New -> Data Collector Set.
  6. Provide name for collector set.
  7. Select Create from a template (Recommended) and click Next.
  8. Click on Browse and navigate to perfmon_template_scmem.xml downloaded on step 1.
  9. Click Finish. You will see your newly created data collector set under User Defined.
  10. Right click on newly created collector set -> Start.
  11. Keep Performance Monitor and system running until memory is severely increased.
  12. To stop Performance Monitor, right click on collector set -> Stop.
  13. Collect Mer/Gatherinfo and  Performance Monitor logs (default location is C:\PerfLogs)

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Highlighted

Re: Memory Protection caused performance issue

Hi Benjamin,

How often does Solidcore installed servers contact GTI to evaluate the reputations?

Regards,

Majid

McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: Memory Protection caused performance issue

should be constantly on client.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community