cancel
Showing results for 
Search instead for 
Did you mean: 
Labnuke
Level 7

Slow shutdown >2min with HIP 8.0.0.2919

Client computers are taking >2min to shutdown with HIP 8.0.0.2919 installed. If HIPs is removed, then client shutdown takes <30sec. Any ideas?

Clients are running agent 4.8.0.1500

on 4/17/14 7:09:27 AM GMT-05:00
0 Kudos
23 Replies
konecnym
Level 9

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello.

We have the same problem. We had to escalate to McAfee Platinum (since 21.3.2014... so today is 29.4.2014 ).

We are sure that problem is in Patch 4.

For your test you can stop manually service "McAfee Host Intrusion Prevention IPC service" and after that you try ShutDown. It will be quick.

This problem reported all users but users with SSD drives where times enormous increased (SSD drives have VIPusers only)

We have suspicion to HIPS extension.

We are using ePO 4.8.0.1500 (P2) and HIPS 8.0.0.2919 (P4) and ePO 5.0.1
(we would like upgrade to ePO 5.1 long time but still isn´t compatible GTI Proxy.  )

M.

0 Kudos
steflevy94
Level 7

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello

we have 450 laptops with HIPS 8.0.0.2919, ePO 4.8.0.887 and VSE 8.8.0.975 and don't have slow shutdown issues.

We only use firewall rules and not IPS module.

Did you test with only the HIPS firewall enabled ?

Maybe the problem is with your IPS rules.

K. Regards

0 Kudos
konecnym
Level 9

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello.

We can be more secure, we are using the last version McAfee products.
I hope that new update is published that McAffe tested it well.
Of course we are testing new update in our lab. But sometimes problem aren´t in testing enviroment.
So then we have to use McAfee Platinum Support.

HIPS and IPS and FW rules
We are using hips since version 6.
And IPS policy in HIPS 8 wasn´t long time changed. (So I think that problem isn´t there)
Problem turned out to to P4.

steflevy94 - you are using old VSE and old CMA ... there maybe isn´t problem.
We can´t roll back to old version 12.000 clients.

Patch 4 add some service "McAfee Host Intrusion Prevention IPC" and better communication with CMA.
(We try some test with  old ePO Agent 4.6 P3 and there is ShutDown a little faster ...)

I hope that  McAfee Platinum give us some solution.

0 Kudos
mlmarshall3
Level 7

Re: Slow shutdown >2min with HIP 8.0.0.2919

What level of logging do you have for Firewall and IPS under the HIPs General > Client UI?  We were finding FireSVC.exe using a large chunk of CPU and slow start up/shut down.  Adjustment of this to "Error" eliminated that.

0 Kudos
konecnym
Level 9

Re: Slow shutdown >2min with HIP 8.0.0.2919

Level.jpg

0 Kudos
Labnuke
Level 7

Re: Slow shutdown >2min with HIP 8.0.0.2919

Our logging is set to Error/Error and we are seeing the same issue.

b16811
Level 7

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello,

same problem.

McAfee HIPS 8.0.0.2919, VSE 8.8.0.1247, Agent 4.8.0.887, ePo 4.6.8 Build 112

I.R.

konecnym
Level 9

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello !

It is still bad... but there is only the one workaround.

  • Could you set deployment tasks without selected Options-Run at every policy enforcement (Windows only).

        I mean disable this options.

After that settings you have to update policy on clients and you will try shutting down PC.

SSD is going to off about 20-40 seconds.

Before disable this options it was about 2min.

Before HIPS P4 (so i mean HIPS with P2) it take about 6s ! (the same time like without McAfee products).
So our users know and they are sure what slow down their computers (Intel Mcafee)

So there is some progress but we are not satisfied.

Support haven't any fix (HFX or Patch or new product) :-(

(information from today 24.6.2014... we reported this problem on PlatinumSupport on 21.03.2014)

Michal

Note:
Does anyone have a better solution ?

Message was edited by: konecnym on 6/24/14 1:12:38 PM CEST
0 Kudos
Pmaquoi
Level 10

Re: Slow shutdown >2min with HIP 8.0.0.2919

Did you try the last recent hotfix for Hips ? RTW last week.

0 Kudos