SOLIDCORE SYSTEM SLOWNESS

[avilt]

I have VSE and SC deployed using ePO in Windows. All works fine but when I put SC in Enable mode, my cusotm application which heavily uses Graphics slows down.

Nothing is getting blocked or denies. How can I fine tune and resolve this issue?

[BEllis · Accepted solution]

You can try to disable Memory Protection and GTI and see if it helps, or test other modes and let us know. 

Here is some of the stuff support typically asks. If you cant figure it out. Please submit a case and gatherinfo and we will help you out.

When creating a ticket please make sure you answer the following questions:

1. What OS?
2. What Solidcore version?
3. Any other McAfee Software installed?
4. What is system used for (file server, workstation, domain controller..etc)?
5. What is the issue?
6. What troubleshooting has been done?

Additional questions client issues should be able to answer the following questions:

1. Does the behavior change in any other mode (Update, enabled, observe, disabled)?
2. Does the behavior change with MP disabled?
3. Does the behavior change with Execution control disabled?
4. Does the behavior change with SAU disabled?

Slow Application Startup, Performance

Perform the steps in this section if the symtoms are any of the following:

• Slow Application Startup
• Slow Application Performance

Data collection for Slow Application Startup, Performance:

1. Download Procmon
2. Run Procmon as Administrator
3. Reproduce Issue
4. Collect MER / Gatherinfo and Procmon files (*.PML)
5. Collect the following of the application:
   1. Process name of application being launched
   2. Version of application
   3. homegrown or made by another company?
   4. Copy of Application or link to where to trial version

- Slow System Perfomance

Perform the steps in this section if the symptoms are any of the following:

• Slow System Performance

Data collection for Slow System Performance:

1. Screenshot of Task manager showing High resource utilization with process names.
2. Note how often the slow performance happens? (every 5 mins, 60 mins, overall,...etc)
3. Collect Windows Performance monitor over time of slowness. (5 mins unless longer is needed)
4. Collect MER / Gatherinfo and Windows Perf files

[avilt]

Thank You,

Please let me know how to achieve the following? Where do I define these settings?

1. Does the behavior change with Execution control disabled?
2. Does the behavior change with SAU disabled?

Also, if I have VSE, do I need to exclude any directories for SC? 

[BEllis]

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-unmanaged/page/GUID-4...

You can see what each feature is. and how to disable via CLI.

"Sadmin help features"

"sadmin features -d" will give you the features

if you have VSE/ENS you also need to follow the following kb: KB88915

[avilt]

Just to re-confirm a few things.

Is GTI applicable for solidcore? If yes how do I disable this?

Also, my understanding is that if something is getting blocked, then we have to define/ fine tune updaters.

If the system is slow then we need to investigate memory protection and not the updaters.

Am I right?

[gnautiya]

Hi,

Yes GTI is applicable for the product, but not in standalone usage of it.

You can always disable it by using "sadmin features disable gti-reputation".

Looking into updaters configuration and disable memory protection for avoiding slowness, your understanding upto some extent is correct.

Regards

[avilt]

Thank You,

Is it possible to disable globally from ePO server?

[gnautiya]

Hi,

Yes you can do it from epo as well.

Under "Application control option" policy, go to reputation tab and uncheck 

"Use McAfee Global Threat Intelligence (McAfee GTI)"

Regards

[Majidkhan]

Hi,

We see the Solidcore Throttle cache reaching 100% due to which there is a high usage of Solidocore CPU usage in servers. We are using 8.2.1.143 version

We tried clearing the cache with the below commands, but the next day again the cache is reaching 100%. Please suggest

sadmin clear-events

sadmin clear-events -o(during observe mode)

[gnautiya]

Hi,

If this is the case, try to check the type of data being throttled.

We can add filters to control the data generation, and if throttling is an issue, we can try by keeping this feature disable for a while.

Regards