cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 5

Threat Prevention high CPU constantly logging "successfully set EPPolicyName"

Jump to solution

Hey

I'm investigating high CPU usage for Threat Prevention on a server. TP is constantly using 5-20% CPU and I decided to check the log file below for clues.

C:\ProgramData\McAfee\Endpoint Security\Logs\ThreatPrevention_Debug.log

What I saw when I opened it was the log entry "successfully set EPPolicyName" over and over, between 70-250 times per second. What is happening with TP? We're running the latest version of TP on one of the servers but from what I can see this has been ongoing for a while. Earliest entry on one server is from 2020-09-11 and on the other 2020-09-13 - long before we updated TP on one of the servers.

Why is it logging this so many times? Can this be the cause of the high CPU usage?

1 Solution

Accepted Solutions
halmazid
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: Threat Prevention high CPU constantly logging "successfully set EPPolicyName"

Jump to solution

Hi @Former Member.,

If the debug is enabled on the policy, you would see lots of entries under debug logs. Please check the ENS common policy and see if debug logging is enabled for few modules.

Regards,
Hasib
McAfee

View solution in original post

4 Replies
halmazid
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Threat Prevention high CPU constantly logging "successfully set EPPolicyName"

Jump to solution

Hi @Former Member,

The CPU utilization is not most likely because of log entries "successfully set EPPolicyName"

If it is McShield, we would have to check if there is an ODS task running on the machines and if there isn't any scheduled or none running, it could be the On Access scanner utilizing CPU in its real time scan.
The best way to understand the CPU usage is to run a tool called McAfee profiler. This tool will give us an insight on what is being scanned when the CPU is 20%. It should be run only when the issue is seen. This tool will show us the process or files being scanned and you could decide an exclusion if the process or files scanned are safe/trusted.
Note: Don't exclude processes such as explorer.exe/svchost as they could be used by another processes.

You can get the tool from link below(McAfee Portal login is required) :from https://support.mcafee.com/webcenter/portal/supportportal/pages_tools/toolsMcAfeeProfiler

You can also run a small test mentioned in the article below on a single machine to understand if its On Access scan(Real time scan), the cause for CPU utilization.

https://kc.mcafee.com/corporate/index?page=content&id=KB89354

Looking forward for your reply. Have a good day Ahead.

Regards,
Hasib
McAfee

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 5

Re: Threat Prevention high CPU constantly logging "successfully set EPPolicyName"

Jump to solution

Thanks for the reply, Hasib. I will try the profiler tool as soon as possible.

Do you have any idea what might be the cause behind the excessive logging in the debug-log?
It's currently at 461 000 lines. Although, it does seem to have stopped this behavious earlier this morning.

Not sure what has changed, maybe a new DAT or something, but it has been going on for a long time only to stop this morning.

halmazid
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: Threat Prevention high CPU constantly logging "successfully set EPPolicyName"

Jump to solution

Hi @Former Member.,

If the debug is enabled on the policy, you would see lots of entries under debug logs. Please check the ENS common policy and see if debug logging is enabled for few modules.

Regards,
Hasib
McAfee

View solution in original post

Former Member
Not applicable
Report Inappropriate Content
Message 5 of 5

Re: Threat Prevention high CPU constantly logging "successfully set EPPolicyName"

Jump to solution

It seems that debug logging was the cause behind the high cpu. After unchecking it in the policy, the process barely runt above 10% CPU.

Thank you!

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community