Is anybody expierencing Virtual Memory Leakage lately on VM Servers Wndows 2012 R2 when ENS is running ENS 10.5.3 or 10.2.x with Threat Preventon and Advance Threat Protection?
It take a few days but eventually starts Wndows complains about Virtual Memory being over utilized and McShield is in the top three list of proccesses in the windows event alert.
We are Running:
Agent | 5.5.0.447 |
Endpoint Security Platform | 10.5.3.3197 |
Endpoint Security Threat Prevention | 10.5.3.3271 |
On Servers with different WIndows-Versions 2008R2...2016
I've tried to optimize scanning with McProfiler (Version 1.3.0.0), but id didn't find significant scan load.
Even with ProcMon I was not able to figure out excessive scanning or lots of archives... Logfiles are excluded from scanning, because of the changing hash.
Top (see below) was a Windows Server 2012 R2 booted at Feb 1st 2018 - McShield allocated 11.66 GB RAM (out of 24 GB - It's a SitCore VMware-Server).
Also about half of the Memory -> That can not be a normal behaviour...
...are there others with the same behaviour? Otherwise, they will tell me again, that we are the only company with such problems...
A lot of Servers (booted in February or later) have following WorkingSets:
Id | Name | WorkingSet (in MB) |
2128 | mcshield | 11943 |
40204 | mcshield | 8327 |
30160 | mcshield | 7592 |
2132 | mcshield | 7141 |
2032 | mcshield | 6757 |
2700 | mcshield | 6755 |
6988 | mcshield | 6606 |
2080 | mcshield | 6571 |
7380 | mcshield | 6460 |
6728 | mcshield | 6460 |
7512 | mcshield | 6437 |
2184 | mcshield | 6111 |
2388 | mcshield | 6057 |
2656 | mcshield | 6015 |
2500 | mcshield | 6010 |
2780 | mcshield | 5825 |
3900 | mcshield | 5759 |
2772 | mcshield | 5629 |
14656 | mcshield | 5560 |
2256 | mcshield | 5389 |
2516 | mcshield | 5361 |
2252 | mcshield | 5360 |
2692 | mcshield | 5353 |
2664 | mcshield | 5342 |
2996 | mcshield | 5339 |
2776 | mcshield | 5331 |
2116 | mcshield | 5323 |
2332 | mcshield | 5312 |
2492 | mcshield | 5101 |
4708 | mcshield | 5017 |
2872 | mcshield | 4702 |
2216 | mcshield | 4506 |
2252 | mcshield | 4412 |
1892 | mcshield | 4402 |
1896 | mcshield | 4394 |
684 | mcshield | 4391 |
1952 | mcshield | 4384 |
2616 | mcshield | 4277 |
3216 | mcshield | 4174 |
3120 | mcshield | 4014 |
2768 | mcshield | 3973 |
3424 | mcshield | 3756 |
2760 | mcshield | 3716 |
2648 | mcshield | 3681 |
2480 | mcshield | 3676 |
2764 | mcshield | 3618 |
2924 | mcshield | 3329 |
3552 | mcshield | 3313 |
2132 | mcshield | 3311 |
1576 | mcshield | 3120 |
2504 | mcshield | 3072 |
1540 | mcshield | 2963 |
1576 | mcshield | 2864 |
2400 | mcshield | 2850 |
2348 | mcshield | 2817 |
3012 | mcshield | 2814 |
11188 | mcshield | 2777 |
4004 | mcshield | 2726 |
3664 | mcshield | 2723 |
5528 | mcshield | 2534 |
8036 | mcshield | 2516 |
9004 | mcshield | 2512 |
2812 | mcshield | 2491 |
7484 | mcshield | 2478 |
7792 | mcshield | 2475 |
1096 | mcshield | 2447 |
2844 | mcshield | 2421 |
2612 | mcshield | 2329 |
2308 | mcshield | 2228 |
2392 | mcshield | 2206 |
5500 | mcshield | 2203 |
8980 | mcshield | 2143 |
1828 | mcshield | 2078 |
6824 | mcshield | 2043 |
2016 | mcshield | 2042 |
3120 | mcshield | 2036 |
30596 | mcshield | 2035 |
1976 | mcshield | 2034 |
1236 | mcshield | 2031 |
1472 | mcshield | 2026 |
9148 | mcshield | 2019 |
1224 | mcshield | 2018 |
1804 | mcshield | 2016 |
4132 | mcshield | 2013 |
2248 | mcshield | 2001 |
2812 | mcshield | 2001 |
1576 | mcshield | 1998 |
2140 | mcshield | 1998 |
2052 | mcshield | 1993 |
3776 | mcshield | 1991 |
2016 | mcshield | 1990 |
2136 | mcshield | 1989 |
3972 | mcshield | 1984 |
2108 | mcshield | 1981 |
1560 | mcshield | 1981 |
5124 | mcshield | 1974 |
1964 | mcshield | 1971 |
2216 | mcshield | 1967 |
2280 | mcshield | 1962 |
7280 | mcshield | 1958 |
2032 | mcshield | 1952 |
2492 | mcshield | 1950 |
1540 | mcshield | 1949 |
4984 | mcshield | 1947 |
4000 | mcshield | 1945 |
1848 | mcshield | 1944 |
1684 | mcshield | 1939 |
1372 | mcshield | 1936 |
1252 | mcshield | 1932 |
2052 | mcshield | 1929 |
2388 | mcshield | 1925 |
3320 | mcshield | 1924 |
1736 | mcshield | 1920 |
2664 | mcshield | 1916 |
2108 | mcshield | 1914 |
2024 | mcshield | 1902 |
2348 | mcshield | 1892 |
4620 | mcshield | 1891 |
2856 | mcshield | 1884 |
9428 | mcshield | 1851 |
1848 | mcshield | 1843 |
3364 | mcshield | 1841 |
1844 | mcshield | 1826 |
4248 | mcshield | 1824 |
3916 | mcshield | 1819 |
280 | mcshield | 1791 |
2436 | mcshield | 1789 |
2164 | mcshield | 1788 |
5048 | mcshield | 1786 |
2156 | mcshield | 1772 |
1988 | mcshield | 1760 |
1712 | mcshield | 1755 |
3516 | mcshield | 1754 |
2540 | mcshield | 1754 |
1640 | mcshield | 1751 |
1892 | mcshield | 1750 |
2280 | mcshield | 1749 |
2764 | mcshield | 1730 |
1812 | mcshield | 1723 |
1880 | mcshield | 1721 |
2368 | mcshield | 1719 |
1672 | mcshield | 1717 |
1964 | mcshield | 1715 |
2028 | mcshield | 1715 |
920 | mcshield | 1712 |
2236 | mcshield | 1707 |
1664 | mcshield | 1704 |
2020 | mcshield | 1700 |
3764 | mcshield | 1695 |
2328 | mcshield | 1694 |
1432 | mcshield | 1693 |
2496 | mcshield | 1689 |
6080 | mcshield | 1686 |
2160 | mcshield | 1681 |
1880 | mcshield | 1681 |
1392 | mcshield | 1678 |
1528 | mcshield | 1677 |
3944 | mcshield | 1677 |
3124 | mcshield | 1673 |
8692 | mcshield | 1667 |
2072 | mcshield | 1661 |
2576 | mcshield | 1655 |
5056 | mcshield | 1626 |
1696 | mcshield | 1625 |
2672 | mcshield | 1584 |
4584 | mcshield | 1584 |
2456 | mcshield | 1582 |
1616 | mcshield | 1581 |
2420 | mcshield | 1581 |
3792 | mcshield | 1579 |
3024 | mcshield | 1572 |
1712 | mcshield | 1572 |
2280 | mcshield | 1562 |
1624 | mcshield | 1560 |
1668 | mcshield | 1553 |
3088 | mcshield | 1550 |
2032 | mcshield | 1537 |
1900 | mcshield | 1537 |
2072 | mcshield | 1534 |
2080 | mcshield | 1528 |
3012 | mcshield | 1526 |
2380 | mcshield | 1503 |
1936 | mcshield | 1496 |
1652 | mcshield | 1475 |
4944 | mcshield | 1464 |
2160 | mcshield | 1454 |
4432 | mcshield | 1446 |
2040 | mcshield | 1443 |
65836 | mcshield | 1433 |
2800 | mcshield | 1425 |
3952 | mcshield | 1425 |
2000 | mcshield | 1425 |
1828 | mcshield | 1408 |
2156 | mcshield | 1404 |
2576 | mcshield | 1401 |
2252 | mcshield | 1378 |
2748 | mcshield | 1375 |
108 | mcshield | 1373 |
1920 | mcshield | 1367 |
1904 | mcshield | 1364 |
1968 | mcshield | 1364 |
1212 | mcshield | 1361 |
2836 | mcshield | 1347 |
4620 | mcshield | 1345 |
1636 | mcshield | 1344 |
2204 | mcshield | 1343 |
3124 | mcshield | 1341 |
1408 | mcshield | 1329 |
1532 | mcshield | 1324 |
1472 | mcshield | 1271 |
420 | mcshield | 1267 |
1548 | mcshield | 1259 |
1876 | mcshield | 1258 |
1552 | mcshield | 1249 |
1832 | mcshield | 1233 |
1460 | mcshield | 1227 |
2332 | mcshield | 1223 |
1620 | mcshield | 1198 |
1708 | mcshield | 1189 |
1684 | mcshield | 1189 |
3736 | mcshield | 1183 |
1520 | mcshield | 1169 |
1984 | mcshield | 1162 |
2528 | mcshield | 1145 |
1200 | mcshield | 1094 |
1996 | mcshield | 1059 |
1384 | mcshield | 1038 |
2080 | mcshield | 1033 |
1388 | mcshield | 1031 |
1988 | mcshield | 1014 |
2504 | mcshield | 1010 |
1412 | mcshield | 1008 |
1788 | mcshield | 1008 |
And a lot more 1000 MB ... 500 MB...
I've ran V3_33xxdat.exe, which restarts the McShield and have at the moment no samples to open a Service Request, but I will have a daily look at the status. As soon, as I have a candidate, I will take a MER and open a SR...
I had same issuse and logged support ticket. Advise was there is a known issue with McTray and other processes leaking memory due to the MPT's Vtp_Init function. This issue was fixed in the ENS 10.5.4 July update. Please use the 10.5.4 July update to see if it resolves their issue.
I just finished upgraded 650 MA to 5.5.1 and ENS to 10.6. Memory leak issue hasn't come back.
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA