ENS Custom On-Demand Scan and CPU percentage value does not seem to work

[User27605043]

I setup and Scheduled On-Demand Scan in ePO and limited the CPU usage to 25%. Made sure that "Scan Anytime" was checked and note that the Scanner Service is sucking up on average about 50% of CPU. 

I have been told over and over that this product would not adversely impact our working user systems. An average CPU percentage of 50% is not acceptable.

I have application server systems that constantly run at fairly high percentages for their apps. I am afraid to even try turning on this feature on them, as I am not sure if this would cause a crash.  

What is the solution to this? System is running 10.7 February Update if that makes any difference.

[Daveb3d]

I can't speak to the issue, but I can offer a few suggestions.

1) Target your ODS as it pertains to reading the disk only to places where you have excluded OAS. Everything else gets read when it loads, so it will get scanned then.

2) Otherwise, you're worried about what is running, so do a daily memory scan to look at what is running.

3) Scan while idle, to minimize impact.

4) Scan overnight whenever possible. Update dats first.  Even if you have to run again during the day, you can use the scan cache to minimize the load.

These things will minimize user impact and should keep you well covered. 

Dave

[rfranci]

Hi @User27605043 ,

Thankyou for reaching us on community !

I agree with all the points mentioned by @Daveb3d .

- "limit maximum CPU usage" applied when ENS is scanning " files in folders " only.
-  When ENS is scanning other locations like " boot sector, memory, running process, services, registry", the scan might cause high CPU because while scanning other locations ENS would use normal "windows thread priority" and would consume CPU amount provided my windows as per thread priority.

Also, another point to note is that On-demand scan CPU limit feature does not work if you have exclusions in ODS task/policy. Currently this is asper design of the product :
https://kc.mcafee.com/corporate/index?page=content&id=KB93411&locale=en_US

-Rohit Francis

[User27605043]

Testing this and finding that no matter how I limit the scan parameters, the CPU usage for the On-Demand Scan jumps to around 50% for around 30 minutes up to 2 hours. 

[Mandara]

Why is that " Limit maximum CPU usage" does not work with the exclusions in place? Is there any technical reason behind it?

There are scenarios where we do not want to lock the files/processes during the scan (hence excluding these) and also we want to limit the maximum CPU usage by McAfee scanner service

[User27605043]

Actually from my testing, the limit CPU usage does not actually function at all. 

You can set the Max CPU usage to 25% and the percentage will still jump to 50% when an On-Demand Scan is run no matter what.  Probably one of the worst features currently. 

McAfee recommends we do regular scans on Servers and workstations, but Servers like SQL or Exchange are already running at greater than 50% CPU due to the nature of those apps. Initiating a scan can take them down. So no On Demand Server Scanning is possible. 

Workstations are also a problem. We do not have wake on LAN and I don't believe that is supported by McAfee even if it was, so the only On demand Scan for workstations can only occur during working hours, disruptingin users computers while the Scan runs.  

A really poorly designed module, that should be fixed. You really should be able to control how much resources scanning takes. McAfee sold me as one of the reasons to move from VSE to ENS in the first place was due to its smaller footprint, but that particular feature actually works better in VSE. (No I am not saying go back to VSE).