ENS 10 possible memory leak running on VM Windows Server 2012 R2

[edavid]

Is anybody expierencing Virtual Memory Leakage lately on VM Servers Wndows 2012 R2 when ENS is running ENS 10.5.3 or 10.2.x with Threat Preventon and Advance Threat Protection?

It take a few days but eventually starts Wndows complains about Virtual Memory being over utilized and McShield is in the top three list of proccesses in the windows event alert.

[bodysoda]

Have you install McAfee profiler which will give clues on what's is running hot?

[hausi]

We are Running:

Agent

5.5.0.447

Endpoint Security Platform

10.5.3.3197

Endpoint Security Threat Prevention

10.5.3.3271

On Servers with different WIndows-Versions 2008R2...2016

I've tried to optimize scanning with McProfiler (Version 1.3.0.0), but id didn't find significant scan load.
Even with ProcMon I was not able to figure out excessive scanning or lots of archives... Logfiles are excluded from scanning, because of the changing hash.

Top (see below) was a Windows Server 2012 R2 booted at Feb 1st 2018 - McShield allocated 11.66 GB RAM (out of 24 GB - It's a SitCore VMware-Server).

Also about half of the Memory -> That can not be a normal behaviour...

...are there others with the same behaviour? Otherwise, they will tell me again, that we are the only company with such problems...

A lot of Servers (booted in February or later) have following WorkingSets:

Id	Name	WorkingSet (in MB)
2128	mcshield	11943
40204	mcshield	8327
30160	mcshield	7592
2132	mcshield	7141
2032	mcshield	6757
2700	mcshield	6755
6988	mcshield	6606
2080	mcshield	6571
7380	mcshield	6460
6728	mcshield	6460
7512	mcshield	6437
2184	mcshield	6111
2388	mcshield	6057
2656	mcshield	6015
2500	mcshield	6010
2780	mcshield	5825
3900	mcshield	5759
2772	mcshield	5629
14656	mcshield	5560
2256	mcshield	5389
2516	mcshield	5361
2252	mcshield	5360
2692	mcshield	5353
2664	mcshield	5342
2996	mcshield	5339
2776	mcshield	5331
2116	mcshield	5323
2332	mcshield	5312
2492	mcshield	5101
4708	mcshield	5017
2872	mcshield	4702
2216	mcshield	4506
2252	mcshield	4412
1892	mcshield	4402
1896	mcshield	4394
684	mcshield	4391
1952	mcshield	4384
2616	mcshield	4277
3216	mcshield	4174
3120	mcshield	4014
2768	mcshield	3973
3424	mcshield	3756
2760	mcshield	3716
2648	mcshield	3681
2480	mcshield	3676
2764	mcshield	3618
2924	mcshield	3329
3552	mcshield	3313
2132	mcshield	3311
1576	mcshield	3120
2504	mcshield	3072
1540	mcshield	2963
1576	mcshield	2864
2400	mcshield	2850
2348	mcshield	2817
3012	mcshield	2814
11188	mcshield	2777
4004	mcshield	2726
3664	mcshield	2723
5528	mcshield	2534
8036	mcshield	2516
9004	mcshield	2512
2812	mcshield	2491
7484	mcshield	2478
7792	mcshield	2475
1096	mcshield	2447
2844	mcshield	2421
2612	mcshield	2329
2308	mcshield	2228
2392	mcshield	2206
5500	mcshield	2203
8980	mcshield	2143
1828	mcshield	2078
6824	mcshield	2043
2016	mcshield	2042
3120	mcshield	2036
30596	mcshield	2035
1976	mcshield	2034
1236	mcshield	2031
1472	mcshield	2026
9148	mcshield	2019
1224	mcshield	2018
1804	mcshield	2016
4132	mcshield	2013
2248	mcshield	2001
2812	mcshield	2001
1576	mcshield	1998
2140	mcshield	1998
2052	mcshield	1993
3776	mcshield	1991
2016	mcshield	1990
2136	mcshield	1989
3972	mcshield	1984
2108	mcshield	1981
1560	mcshield	1981
5124	mcshield	1974
1964	mcshield	1971
2216	mcshield	1967
2280	mcshield	1962
7280	mcshield	1958
2032	mcshield	1952
2492	mcshield	1950
1540	mcshield	1949
4984	mcshield	1947
4000	mcshield	1945
1848	mcshield	1944
1684	mcshield	1939
1372	mcshield	1936
1252	mcshield	1932
2052	mcshield	1929
2388	mcshield	1925
3320	mcshield	1924
1736	mcshield	1920
2664	mcshield	1916
2108	mcshield	1914
2024	mcshield	1902
2348	mcshield	1892
4620	mcshield	1891
2856	mcshield	1884
9428	mcshield	1851
1848	mcshield	1843
3364	mcshield	1841
1844	mcshield	1826
4248	mcshield	1824
3916	mcshield	1819
280	mcshield	1791
2436	mcshield	1789
2164	mcshield	1788
5048	mcshield	1786
2156	mcshield	1772
1988	mcshield	1760
1712	mcshield	1755
3516	mcshield	1754
2540	mcshield	1754
1640	mcshield	1751
1892	mcshield	1750
2280	mcshield	1749
2764	mcshield	1730
1812	mcshield	1723
1880	mcshield	1721
2368	mcshield	1719
1672	mcshield	1717
1964	mcshield	1715
2028	mcshield	1715
920	mcshield	1712
2236	mcshield	1707
1664	mcshield	1704
2020	mcshield	1700
3764	mcshield	1695
2328	mcshield	1694
1432	mcshield	1693
2496	mcshield	1689
6080	mcshield	1686
2160	mcshield	1681
1880	mcshield	1681
1392	mcshield	1678
1528	mcshield	1677
3944	mcshield	1677
3124	mcshield	1673
8692	mcshield	1667
2072	mcshield	1661
2576	mcshield	1655
5056	mcshield	1626
1696	mcshield	1625
2672	mcshield	1584
4584	mcshield	1584
2456	mcshield	1582
1616	mcshield	1581
2420	mcshield	1581
3792	mcshield	1579
3024	mcshield	1572
1712	mcshield	1572
2280	mcshield	1562
1624	mcshield	1560
1668	mcshield	1553
3088	mcshield	1550
2032	mcshield	1537
1900	mcshield	1537
2072	mcshield	1534
2080	mcshield	1528
3012	mcshield	1526
2380	mcshield	1503
1936	mcshield	1496
1652	mcshield	1475
4944	mcshield	1464
2160	mcshield	1454
4432	mcshield	1446
2040	mcshield	1443
65836	mcshield	1433
2800	mcshield	1425
3952	mcshield	1425
2000	mcshield	1425
1828	mcshield	1408
2156	mcshield	1404
2576	mcshield	1401
2252	mcshield	1378
2748	mcshield	1375
108	mcshield	1373
1920	mcshield	1367
1904	mcshield	1364
1968	mcshield	1364
1212	mcshield	1361
2836	mcshield	1347
4620	mcshield	1345
1636	mcshield	1344
2204	mcshield	1343
3124	mcshield	1341
1408	mcshield	1329
1532	mcshield	1324
1472	mcshield	1271
420	mcshield	1267
1548	mcshield	1259
1876	mcshield	1258
1552	mcshield	1249
1832	mcshield	1233
1460	mcshield	1227
2332	mcshield	1223
1620	mcshield	1198
1708	mcshield	1189
1684	mcshield	1189
3736	mcshield	1183
1520	mcshield	1169
1984	mcshield	1162
2528	mcshield	1145
1200	mcshield	1094
1996	mcshield	1059
1384	mcshield	1038
2080	mcshield	1033
1388	mcshield	1031
1988	mcshield	1014
2504	mcshield	1010
1412	mcshield	1008
1788	mcshield	1008

And a lot more 1000 MB ... 500 MB...

I've ran V3_33xxdat.exe, which restarts the McShield and have at the moment no samples to open a Service Request, but I will have a daily look at the status. As soon, as I have a candidate, I will take a MER and open a SR...

[bodysoda]

I had same issuse and logged support ticket. Advise was there is a known issue with McTray and other processes leaking memory due to the MPT's Vtp_Init function. This issue was fixed in the ENS 10.5.4 July update. Please use the 10.5.4 July update to see if it resolves their issue.

I just finished upgraded 650 MA to 5.5.1 and ENS to 10.6.  Memory leak issue hasn't come back.