cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
edavid
Level 7
Report Inappropriate Content
Message 1 of 4

ENS 10 possible memory leak running on VM Windows Server 2012 R2

Is anybody expierencing Virtual Memory Leakage lately on VM Servers Wndows 2012 R2 when ENS is running ENS 10.5.3 or 10.2.x with Threat Preventon and Advance Threat Protection?

It take a few days but eventually starts Wndows complains about Virtual Memory being over utilized and McShield is in the top three list of proccesses in the windows event alert.

 

 

3 Replies
Reliable Contributor bodysoda
Reliable Contributor
Report Inappropriate Content
Message 2 of 4

Re: ENS 10 possible memory leak running on VM Windows Server 2012 R2

Have you install McAfee profiler which will give clues on what's is running hot?
In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
hausi
Level 9
Report Inappropriate Content
Message 3 of 4

Re: ENS 10 possible memory leak running on VM Windows Server 2012 R2

We are Running:

Agent5.5.0.447
Endpoint Security Platform10.5.3.3197
Endpoint Security Threat Prevention10.5.3.3271

On Servers with different WIndows-Versions 2008R2...2016

I've tried to optimize scanning with McProfiler (Version 1.3.0.0), but id didn't find significant scan load.
Even with ProcMon I was not able to figure out excessive scanning or lots of archives... Logfiles are excluded from scanning, because of the changing hash.

Top (see below) was a Windows Server 2012 R2 booted at Feb 1st 2018 - McShield allocated 11.66 GB RAM (out of 24 GB - It's a SitCore VMware-Server).

Also about half of the Memory -> That can not be a normal behaviour...

...are there others with the same behaviour? Otherwise, they will tell me again, that we are the only company with such problems...

A lot of Servers (booted in February or later) have following WorkingSets:

Id

Name

WorkingSet (in MB)

2128

mcshield

11943

40204

mcshield

8327

30160

mcshield

7592

2132

mcshield

7141

2032

mcshield

6757

2700

mcshield

6755

6988

mcshield

6606

2080

mcshield

6571

7380

mcshield

6460

6728

mcshield

6460

7512

mcshield

6437

2184

mcshield

6111

2388

mcshield

6057

2656

mcshield

6015

2500

mcshield

6010

2780

mcshield

5825

3900

mcshield

5759

2772

mcshield

5629

14656

mcshield

5560

2256

mcshield

5389

2516

mcshield

5361

2252

mcshield

5360

2692

mcshield

5353

2664

mcshield

5342

2996

mcshield

5339

2776

mcshield

5331

2116

mcshield

5323

2332

mcshield

5312

2492

mcshield

5101

4708

mcshield

5017

2872

mcshield

4702

2216

mcshield

4506

2252

mcshield

4412

1892

mcshield

4402

1896

mcshield

4394

684

mcshield

4391

1952

mcshield

4384

2616

mcshield

4277

3216

mcshield

4174

3120

mcshield

4014

2768

mcshield

3973

3424

mcshield

3756

2760

mcshield

3716

2648

mcshield

3681

2480

mcshield

3676

2764

mcshield

3618

2924

mcshield

3329

3552

mcshield

3313

2132

mcshield

3311

1576

mcshield

3120

2504

mcshield

3072

1540

mcshield

2963

1576

mcshield

2864

2400

mcshield

2850

2348

mcshield

2817

3012

mcshield

2814

11188

mcshield

2777

4004

mcshield

2726

3664

mcshield

2723

5528

mcshield

2534

8036

mcshield

2516

9004

mcshield

2512

2812

mcshield

2491

7484

mcshield

2478

7792

mcshield

2475

1096

mcshield

2447

2844

mcshield

2421

2612

mcshield

2329

2308

mcshield

2228

2392

mcshield

2206

5500

mcshield

2203

8980

mcshield

2143

1828

mcshield

2078

6824

mcshield

2043

2016

mcshield

2042

3120

mcshield

2036

30596

mcshield

2035

1976

mcshield

2034

1236

mcshield

2031

1472

mcshield

2026

9148

mcshield

2019

1224

mcshield

2018

1804

mcshield

2016

4132

mcshield

2013

2248

mcshield

2001

2812

mcshield

2001

1576

mcshield

1998

2140

mcshield

1998

2052

mcshield

1993

3776

mcshield

1991

2016

mcshield

1990

2136

mcshield

1989

3972

mcshield

1984

2108

mcshield

1981

1560

mcshield

1981

5124

mcshield

1974

1964

mcshield

1971

2216

mcshield

1967

2280

mcshield

1962

7280

mcshield

1958

2032

mcshield

1952

2492

mcshield

1950

1540

mcshield

1949

4984

mcshield

1947

4000

mcshield

1945

1848

mcshield

1944

1684

mcshield

1939

1372

mcshield

1936

1252

mcshield

1932

2052

mcshield

1929

2388

mcshield

1925

3320

mcshield

1924

1736

mcshield

1920

2664

mcshield

1916

2108

mcshield

1914

2024

mcshield

1902

2348

mcshield

1892

4620

mcshield

1891

2856

mcshield

1884

9428

mcshield

1851

1848

mcshield

1843

3364

mcshield

1841

1844

mcshield

1826

4248

mcshield

1824

3916

mcshield

1819

280

mcshield

1791

2436

mcshield

1789

2164

mcshield

1788

5048

mcshield

1786

2156

mcshield

1772

1988

mcshield

1760

1712

mcshield

1755

3516

mcshield

1754

2540

mcshield

1754

1640

mcshield

1751

1892

mcshield

1750

2280

mcshield

1749

2764

mcshield

1730

1812

mcshield

1723

1880

mcshield

1721

2368

mcshield

1719

1672

mcshield

1717

1964

mcshield

1715

2028

mcshield

1715

920

mcshield

1712

2236

mcshield

1707

1664

mcshield

1704

2020

mcshield

1700

3764

mcshield

1695

2328

mcshield

1694

1432

mcshield

1693

2496

mcshield

1689

6080

mcshield

1686

2160

mcshield

1681

1880

mcshield

1681

1392

mcshield

1678

1528

mcshield

1677

3944

mcshield

1677

3124

mcshield

1673

8692

mcshield

1667

2072

mcshield

1661

2576

mcshield

1655

5056

mcshield

1626

1696

mcshield

1625

2672

mcshield

1584

4584

mcshield

1584

2456

mcshield

1582

1616

mcshield

1581

2420

mcshield

1581

3792

mcshield

1579

3024

mcshield

1572

1712

mcshield

1572

2280

mcshield

1562

1624

mcshield

1560

1668

mcshield

1553

3088

mcshield

1550

2032

mcshield

1537

1900

mcshield

1537

2072

mcshield

1534

2080

mcshield

1528

3012

mcshield

1526

2380

mcshield

1503

1936

mcshield

1496

1652

mcshield

1475

4944

mcshield

1464

2160

mcshield

1454

4432

mcshield

1446

2040

mcshield

1443

65836

mcshield

1433

2800

mcshield

1425

3952

mcshield

1425

2000

mcshield

1425

1828

mcshield

1408

2156

mcshield

1404

2576

mcshield

1401

2252

mcshield

1378

2748

mcshield

1375

108

mcshield

1373

1920

mcshield

1367

1904

mcshield

1364

1968

mcshield

1364

1212

mcshield

1361

2836

mcshield

1347

4620

mcshield

1345

1636

mcshield

1344

2204

mcshield

1343

3124

mcshield

1341

1408

mcshield

1329

1532

mcshield

1324

1472

mcshield

1271

420

mcshield

1267

1548

mcshield

1259

1876

mcshield

1258

1552

mcshield

1249

1832

mcshield

1233

1460

mcshield

1227

2332

mcshield

1223

1620

mcshield

1198

1708

mcshield

1189

1684

mcshield

1189

3736

mcshield

1183

1520

mcshield

1169

1984

mcshield

1162

2528

mcshield

1145

1200

mcshield

1094

1996

mcshield

1059

1384

mcshield

1038

2080

mcshield

1033

1388

mcshield

1031

1988

mcshield

1014

2504

mcshield

1010

1412

mcshield

1008

1788

mcshield

1008

And a lot more 1000 MB ... 500 MB...

I've ran V3_33xxdat.exe, which restarts the McShield and have at the moment no samples to open a Service Request, but I will have a daily look at the status. As soon, as I have a candidate, I will take a MER and open a SR...

Tags (2)
Reliable Contributor bodysoda
Reliable Contributor
Report Inappropriate Content
Message 4 of 4

Re: ENS 10 possible memory leak running on VM Windows Server 2012 R2

I had same issuse and logged support ticket. Advise was there is a known issue with McTray and other processes leaking memory due to the MPT's Vtp_Init function. This issue was fixed in the ENS 10.5.4 July update. Please use the 10.5.4 July update to see if it resolves their issue.

I just finished upgraded 650 MA to 5.5.1 and ENS to 10.6.  Memory leak issue hasn't come back. 

In case above information was useful or answered your question, please select "Accept as Solution" in my reply, or give a Kudo. Thanks!
McAfee ePO Support Center Plug-in
Check out the new McAfee ePO Support Center. Simply access the ePO Software Manager and follow the instructions in the Product Guide for the most commonly used utilities, top known issues announcements, search the knowledgebase for product documentation, and server status and statistics – all from within ePO.