Is anybody expierencing Virtual Memory Leakage lately on VM Servers Wndows 2012 R2 when ENS is running ENS 10.5.3 or 10.2.x with Threat Preventon and Advance Threat Protection?
It take a few days but eventually starts Wndows complains about Virtual Memory being over utilized and McShield is in the top three list of proccesses in the windows event alert.
We are Running:
Agent | 5.5.0.447 |
Endpoint Security Platform | 10.5.3.3197 |
Endpoint Security Threat Prevention | 10.5.3.3271 |
On Servers with different WIndows-Versions 2008R2...2016
I've tried to optimize scanning with McProfiler (Version 1.3.0.0), but id didn't find significant scan load.
Even with ProcMon I was not able to figure out excessive scanning or lots of archives... Logfiles are excluded from scanning, because of the changing hash.
Top (see below) was a Windows Server 2012 R2 booted at Feb 1st 2018 - McShield allocated 11.66 GB RAM (out of 24 GB - It's a SitCore VMware-Server).
Also about half of the Memory -> That can not be a normal behaviour...
...are there others with the same behaviour? Otherwise, they will tell me again, that we are the only company with such problems...
A lot of Servers (booted in February or later) have following WorkingSets:
Id | Name | WorkingSet (in MB) |
2128 | mcshield | 11943 |
40204 | mcshield | 8327 |
30160 | mcshield | 7592 |
2132 | mcshield | 7141 |
2032 | mcshield | 6757 |
2700 | mcshield | 6755 |
6988 | mcshield | 6606 |
2080 | mcshield | 6571 |
7380 | mcshield | 6460 |
6728 | mcshield | 6460 |
7512 | mcshield | 6437 |
2184 | mcshield | 6111 |
2388 | mcshield | 6057 |
2656 | mcshield | 6015 |
2500 | mcshield | 6010 |
2780 | mcshield | 5825 |
3900 | mcshield | 5759 |
2772 | mcshield | 5629 |
14656 | mcshield | 5560 |
2256 | mcshield | 5389 |
2516 | mcshield | 5361 |
2252 | mcshield | 5360 |
2692 | mcshield | 5353 |
2664 | mcshield | 5342 |
2996 | mcshield | 5339 |
2776 | mcshield | 5331 |
2116 | mcshield | 5323 |
2332 | mcshield | 5312 |
2492 | mcshield | 5101 |
4708 | mcshield | 5017 |
2872 | mcshield | 4702 |
2216 | mcshield | 4506 |
2252 | mcshield | 4412 |
1892 | mcshield | 4402 |
1896 | mcshield | 4394 |
684 | mcshield | 4391 |
1952 | mcshield | 4384 |
2616 | mcshield | 4277 |
3216 | mcshield | 4174 |
3120 | mcshield | 4014 |
2768 | mcshield | 3973 |
3424 | mcshield | 3756 |
2760 | mcshield | 3716 |
2648 | mcshield | 3681 |
2480 | mcshield | 3676 |
2764 | mcshield | 3618 |
2924 | mcshield | 3329 |
3552 | mcshield | 3313 |
2132 | mcshield | 3311 |
1576 | mcshield | 3120 |
2504 | mcshield | 3072 |
1540 | mcshield | 2963 |
1576 | mcshield | 2864 |
2400 | mcshield | 2850 |
2348 | mcshield | 2817 |
3012 | mcshield | 2814 |
11188 | mcshield | 2777 |
4004 | mcshield | 2726 |
3664 | mcshield | 2723 |
5528 | mcshield | 2534 |
8036 | mcshield | 2516 |
9004 | mcshield | 2512 |
2812 | mcshield | 2491 |
7484 | mcshield | 2478 |
7792 | mcshield | 2475 |
1096 | mcshield | 2447 |
2844 | mcshield | 2421 |
2612 | mcshield | 2329 |
2308 | mcshield | 2228 |
2392 | mcshield | 2206 |
5500 | mcshield | 2203 |
8980 | mcshield | 2143 |
1828 | mcshield | 2078 |
6824 | mcshield | 2043 |
2016 | mcshield | 2042 |
3120 | mcshield | 2036 |
30596 | mcshield | 2035 |
1976 | mcshield | 2034 |
1236 | mcshield | 2031 |
1472 | mcshield | 2026 |
9148 | mcshield | 2019 |
1224 | mcshield | 2018 |
1804 | mcshield | 2016 |
4132 | mcshield | 2013 |
2248 | mcshield | 2001 |
2812 | mcshield | 2001 |
1576 | mcshield | 1998 |
2140 | mcshield | 1998 |
2052 | mcshield | 1993 |
3776 | mcshield | 1991 |
2016 | mcshield | 1990 |
2136 | mcshield | 1989 |
3972 | mcshield | 1984 |
2108 | mcshield | 1981 |
1560 | mcshield | 1981 |
5124 | mcshield | 1974 |
1964 | mcshield | 1971 |
2216 | mcshield | 1967 |
2280 | mcshield | 1962 |
7280 | mcshield | 1958 |
2032 | mcshield | 1952 |
2492 | mcshield | 1950 |
1540 | mcshield | 1949 |
4984 | mcshield | 1947 |
4000 | mcshield | 1945 |
1848 | mcshield | 1944 |
1684 | mcshield | 1939 |
1372 | mcshield | 1936 |
1252 | mcshield | 1932 |
2052 | mcshield | 1929 |
2388 | mcshield | 1925 |
3320 | mcshield | 1924 |
1736 | mcshield | 1920 |
2664 | mcshield | 1916 |
2108 | mcshield | 1914 |
2024 | mcshield | 1902 |
2348 | mcshield | 1892 |
4620 | mcshield | 1891 |
2856 | mcshield | 1884 |
9428 | mcshield | 1851 |
1848 | mcshield | 1843 |
3364 | mcshield | 1841 |
1844 | mcshield | 1826 |
4248 | mcshield | 1824 |
3916 | mcshield | 1819 |
280 | mcshield | 1791 |
2436 | mcshield | 1789 |
2164 | mcshield | 1788 |
5048 | mcshield | 1786 |
2156 | mcshield | 1772 |
1988 | mcshield | 1760 |
1712 | mcshield | 1755 |
3516 | mcshield | 1754 |
2540 | mcshield | 1754 |
1640 | mcshield | 1751 |
1892 | mcshield | 1750 |
2280 | mcshield | 1749 |
2764 | mcshield | 1730 |
1812 | mcshield | 1723 |
1880 | mcshield | 1721 |
2368 | mcshield | 1719 |
1672 | mcshield | 1717 |
1964 | mcshield | 1715 |
2028 | mcshield | 1715 |
920 | mcshield | 1712 |
2236 | mcshield | 1707 |
1664 | mcshield | 1704 |
2020 | mcshield | 1700 |
3764 | mcshield | 1695 |
2328 | mcshield | 1694 |
1432 | mcshield | 1693 |
2496 | mcshield | 1689 |
6080 | mcshield | 1686 |
2160 | mcshield | 1681 |
1880 | mcshield | 1681 |
1392 | mcshield | 1678 |
1528 | mcshield | 1677 |
3944 | mcshield | 1677 |
3124 | mcshield | 1673 |
8692 | mcshield | 1667 |
2072 | mcshield | 1661 |
2576 | mcshield | 1655 |
5056 | mcshield | 1626 |
1696 | mcshield | 1625 |
2672 | mcshield | 1584 |
4584 | mcshield | 1584 |
2456 | mcshield | 1582 |
1616 | mcshield | 1581 |
2420 | mcshield | 1581 |
3792 | mcshield | 1579 |
3024 | mcshield | 1572 |
1712 | mcshield | 1572 |
2280 | mcshield | 1562 |
1624 | mcshield | 1560 |
1668 | mcshield | 1553 |
3088 | mcshield | 1550 |
2032 | mcshield | 1537 |
1900 | mcshield | 1537 |
2072 | mcshield | 1534 |
2080 | mcshield | 1528 |
3012 | mcshield | 1526 |
2380 | mcshield | 1503 |
1936 | mcshield | 1496 |
1652 | mcshield | 1475 |
4944 | mcshield | 1464 |
2160 | mcshield | 1454 |
4432 | mcshield | 1446 |
2040 | mcshield | 1443 |
65836 | mcshield | 1433 |
2800 | mcshield | 1425 |
3952 | mcshield | 1425 |
2000 | mcshield | 1425 |
1828 | mcshield | 1408 |
2156 | mcshield | 1404 |
2576 | mcshield | 1401 |
2252 | mcshield | 1378 |
2748 | mcshield | 1375 |
108 | mcshield | 1373 |
1920 | mcshield | 1367 |
1904 | mcshield | 1364 |
1968 | mcshield | 1364 |
1212 | mcshield | 1361 |
2836 | mcshield | 1347 |
4620 | mcshield | 1345 |
1636 | mcshield | 1344 |
2204 | mcshield | 1343 |
3124 | mcshield | 1341 |
1408 | mcshield | 1329 |
1532 | mcshield | 1324 |
1472 | mcshield | 1271 |
420 | mcshield | 1267 |
1548 | mcshield | 1259 |
1876 | mcshield | 1258 |
1552 | mcshield | 1249 |
1832 | mcshield | 1233 |
1460 | mcshield | 1227 |
2332 | mcshield | 1223 |
1620 | mcshield | 1198 |
1708 | mcshield | 1189 |
1684 | mcshield | 1189 |
3736 | mcshield | 1183 |
1520 | mcshield | 1169 |
1984 | mcshield | 1162 |
2528 | mcshield | 1145 |
1200 | mcshield | 1094 |
1996 | mcshield | 1059 |
1384 | mcshield | 1038 |
2080 | mcshield | 1033 |
1388 | mcshield | 1031 |
1988 | mcshield | 1014 |
2504 | mcshield | 1010 |
1412 | mcshield | 1008 |
1788 | mcshield | 1008 |
And a lot more 1000 MB ... 500 MB...
I've ran V3_33xxdat.exe, which restarts the McShield and have at the moment no samples to open a Service Request, but I will have a daily look at the status. As soon, as I have a candidate, I will take a MER and open a SR...
I had same issuse and logged support ticket. Advise was there is a known issue with McTray and other processes leaking memory due to the MPT's Vtp_Init function. This issue was fixed in the ENS 10.5.4 July update. Please use the 10.5.4 July update to see if it resolves their issue.
I just finished upgraded 650 MA to 5.5.1 and ENS to 10.6. Memory leak issue hasn't come back.
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center
Corporate Headquarters
2821 Mission College Blvd.
Santa Clara, CA 95054 USA