cancel
Showing results for 
Search instead for 
Did you mean: 
avilt
Level 8
Report Inappropriate Content
Message 1 of 13

SOLIDCORE SYSTEM SLOWNESS

Jump to solution

I have VSE and SC deployed using ePO in Windows. All works fine but when I put SC in Enable mode, my cusotm application which heavily uses Graphics slows down.

Nothing is getting blocked or denies. How can I fine tune and resolve this issue?

1 Solution

Accepted Solutions
McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 2 of 13

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution
You can try to disable Memory Protection and GTI and see if it helps, or test other modes and let us know. 
 
Here is some of the stuff support typically asks. If you cant figure it out. Please submit a case and gatherinfo and we will help you out.
 
When creating a ticket please make sure you answer the following questions:
  1. What OS?
  2. What Solidcore version?
  3. Any other McAfee Software installed?
  4. What is system used for (file server, workstation, domain controller..etc)?
  5. What is the issue?
  6. What troubleshooting has been done?
Additional questions client issues should be able to answer the following questions:
  1. Does the behavior change in any other mode (Update, enabled, observe, disabled)?
  2. Does the behavior change with MP disabled?
  3. Does the behavior change with Execution control disabled?
  4. Does the behavior change with SAU disabled?

 

Slow Application Startup, Performance

Perform the steps in this section if the symtoms are any of the following:
  • Slow Application Startup
  • Slow Application Performance
Data collection for Slow Application Startup, Performance:
  1. Download Procmon
  2. Run Procmon as Administrator
  3. Reproduce Issue
  4. Collect MER / Gatherinfo and Procmon files (*.PML)
  5. Collect the following of the application:
    1. Process name of application being launched
    2. Version of application
    3. homegrown or made by another company?
    4. Copy of Application or link to where to trial version

- Slow System Perfomance

Perform the steps in this section if the symptoms are any of the following:
  • Slow System Performance
Data collection for Slow System Performance:
  1. Screenshot of Task manager showing High resource utilization with process names.
  2. Note how often the slow performance happens? (every 5 mins, 60 mins, overall,...etc)
  3. Collect Windows Performance monitor over time of slowness. (5 mins unless longer is needed)
  4. Collect MER / Gatherinfo and Windows Perf files

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

12 Replies
McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 2 of 13

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution
You can try to disable Memory Protection and GTI and see if it helps, or test other modes and let us know. 
 
Here is some of the stuff support typically asks. If you cant figure it out. Please submit a case and gatherinfo and we will help you out.
 
When creating a ticket please make sure you answer the following questions:
  1. What OS?
  2. What Solidcore version?
  3. Any other McAfee Software installed?
  4. What is system used for (file server, workstation, domain controller..etc)?
  5. What is the issue?
  6. What troubleshooting has been done?
Additional questions client issues should be able to answer the following questions:
  1. Does the behavior change in any other mode (Update, enabled, observe, disabled)?
  2. Does the behavior change with MP disabled?
  3. Does the behavior change with Execution control disabled?
  4. Does the behavior change with SAU disabled?

 

Slow Application Startup, Performance

Perform the steps in this section if the symtoms are any of the following:
  • Slow Application Startup
  • Slow Application Performance
Data collection for Slow Application Startup, Performance:
  1. Download Procmon
  2. Run Procmon as Administrator
  3. Reproduce Issue
  4. Collect MER / Gatherinfo and Procmon files (*.PML)
  5. Collect the following of the application:
    1. Process name of application being launched
    2. Version of application
    3. homegrown or made by another company?
    4. Copy of Application or link to where to trial version

- Slow System Perfomance

Perform the steps in this section if the symptoms are any of the following:
  • Slow System Performance
Data collection for Slow System Performance:
  1. Screenshot of Task manager showing High resource utilization with process names.
  2. Note how often the slow performance happens? (every 5 mins, 60 mins, overall,...etc)
  3. Collect Windows Performance monitor over time of slowness. (5 mins unless longer is needed)
  4. Collect MER / Gatherinfo and Windows Perf files

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

avilt
Level 8
Report Inappropriate Content
Message 3 of 13

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution

Thank You,

Please let me know how to achieve the following? Where do I define these settings?

  1. Does the behavior change with Execution control disabled?
  2. Does the behavior change with SAU disabled?

Also, if I have VSE, do I need to exclude any directories for SC? 

Highlighted
McAfee Employee BEllis
McAfee Employee
Report Inappropriate Content
Message 4 of 13

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-unmanaged/page/GUID-4...

 

You can see what each feature is. and how to disable via CLI.

"Sadmin help features"

"sadmin features -d" will give you the features

if you have VSE/ENS you also need to follow the following kb: KB88915

 

 

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

avilt
Level 8
Report Inappropriate Content
Message 5 of 13

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution

Just to re-confirm a few things.

Is GTI applicable for solidcore? If yes how do I disable this?

Also, my understanding is that if something is getting blocked, then we have to define/ fine tune updaters.

If the system is slow then we need to investigate memory protection and not the updaters.

Am I right?

McAfee Employee gnautiya
McAfee Employee
Report Inappropriate Content
Message 6 of 13

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution

Hi,

Yes GTI is applicable for the product, but not in standalone usage of it.

You can always disable it by using "sadmin features disable gti-reputation".

 

Looking into updaters configuration and disable memory protection for avoiding slowness, your understanding upto some extent is correct.

Regards

 

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
avilt
Level 8
Report Inappropriate Content
Message 7 of 13

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution

Thank You,

Is it possible to disable globally from ePO server?

McAfee Employee gnautiya
McAfee Employee
Report Inappropriate Content
Message 8 of 13

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution

Hi,

 

Yes you can do it from epo as well.

Under "Application control option" policy, go to reputation tab and uncheck 

"Use McAfee Global Threat Intelligence (McAfee GTI)"

 

Regards

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution

Hi,

We see the Solidcore Throttle cache reaching 100% due to which there is a high usage of Solidocore CPU usage in servers. We are using 8.2.1.143 version

We tried clearing the cache with the below commands, but the next day again the cache is reaching 100%. Please suggest

sadmin clear-events

sadmin clear-events -o(during observe mode)

McAfee Employee gnautiya
McAfee Employee
Report Inappropriate Content
Message 10 of 13

Re: SOLIDCORE SYSTEM SLOWNESS

Jump to solution

Hi,

 

If this is the case, try to check the type of data being throttled.

We can add filters to control the data generation, and if throttling is an issue, we can try by keeping this feature disable for a while.

 

Regards

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community