cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 24

Slow shutdown >2min with HIP 8.0.0.2919

Client computers are taking >2min to shutdown with HIP 8.0.0.2919 installed. If HIPs is removed, then client shutdown takes <30sec. Any ideas?

Clients are running agent 4.8.0.1500

on 4/17/14 7:09:27 AM GMT-05:00
23 Replies
konecnym
Level 9
Report Inappropriate Content
Message 2 of 24

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello.

We have the same problem. We had to escalate to McAfee Platinum (since 21.3.2014... so today is 29.4.2014 ).

We are sure that problem is in Patch 4.

For your test you can stop manually service "McAfee Host Intrusion Prevention IPC service" and after that you try ShutDown. It will be quick.

This problem reported all users but users with SSD drives where times enormous increased (SSD drives have VIPusers only)

We have suspicion to HIPS extension.

We are using ePO 4.8.0.1500 (P2) and HIPS 8.0.0.2919 (P4) and ePO 5.0.1
(we would like upgrade to ePO 5.1 long time but still isn´t compatible GTI Proxy.  )

M.

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 24

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello

we have 450 laptops with HIPS 8.0.0.2919, ePO 4.8.0.887 and VSE 8.8.0.975 and don't have slow shutdown issues.

We only use firewall rules and not IPS module.

Did you test with only the HIPS firewall enabled ?

Maybe the problem is with your IPS rules.

K. Regards

konecnym
Level 9
Report Inappropriate Content
Message 4 of 24

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello.

We can be more secure, we are using the last version McAfee products.
I hope that new update is published that McAffe tested it well.
Of course we are testing new update in our lab. But sometimes problem aren´t in testing enviroment.
So then we have to use McAfee Platinum Support.

HIPS and IPS and FW rules
We are using hips since version 6.
And IPS policy in HIPS 8 wasn´t long time changed. (So I think that problem isn´t there)
Problem turned out to to P4.

steflevy94 - you are using old VSE and old CMA ... there maybe isn´t problem.
We can´t roll back to old version 12.000 clients.

Patch 4 add some service "McAfee Host Intrusion Prevention IPC" and better communication with CMA.
(We try some test with  old ePO Agent 4.6 P3 and there is ShutDown a little faster ...)

I hope that  McAfee Platinum give us some solution.

Former Member
Not applicable
Report Inappropriate Content
Message 5 of 24

Re: Slow shutdown >2min with HIP 8.0.0.2919

What level of logging do you have for Firewall and IPS under the HIPs General > Client UI?  We were finding FireSVC.exe using a large chunk of CPU and slow start up/shut down.  Adjustment of this to "Error" eliminated that.

konecnym
Level 9
Report Inappropriate Content
Message 6 of 24

Re: Slow shutdown >2min with HIP 8.0.0.2919

Level.jpg

Former Member
Not applicable
Report Inappropriate Content
Message 7 of 24

Re: Slow shutdown >2min with HIP 8.0.0.2919

Our logging is set to Error/Error and we are seeing the same issue.

Former Member
Not applicable
Report Inappropriate Content
Message 8 of 24

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello,

same problem.

McAfee HIPS 8.0.0.2919, VSE 8.8.0.1247, Agent 4.8.0.887, ePo 4.6.8 Build 112

I.R.

konecnym
Level 9
Report Inappropriate Content
Message 9 of 24

Re: Slow shutdown >2min with HIP 8.0.0.2919

Hello !

It is still bad... but there is only the one workaround.

  • Could you set deployment tasks without selected Options-Run at every policy enforcement (Windows only).

        I mean disable this options.

After that settings you have to update policy on clients and you will try shutting down PC.

SSD is going to off about 20-40 seconds.

Before disable this options it was about 2min.

Before HIPS P4 (so i mean HIPS with P2) it take about 6s ! (the same time like without McAfee products).
So our users know and they are sure what slow down their computers (Intel Mcafee)

So there is some progress but we are not satisfied.

Support haven't any fix (HFX or Patch or new product) 😞

(information from today 24.6.2014... we reported this problem on PlatinumSupport on 21.03.2014)

Michal

Note:
Does anyone have a better solution ?

Message was edited by: konecnym on 6/24/14 1:12:38 PM CEST
Pmaquoi
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 10 of 24

Re: Slow shutdown >2min with HIP 8.0.0.2919

Did you try the last recent hotfix for Hips ? RTW last week.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community