cancel
Showing results for 
Search instead for 
Did you mean: 

Using McAfee MOVE AV agentless 4.7.0.131 shows very high CPU usage and Guest Introspection causes

Using McAfee MOVE AV agentless 4.7.0.131 shows very high CPU usage and Guest Introspection causes hign disk lantency.

We would therefore like to test the performance impact McAfee MOVE AV agentless 4.7.0.131 seems to have by shutting down the McAfee MOVE AV agentless 4.7.0.131 VM and the Guest Introspection VM on one ESXi 6.5 host to see if the impact changes or not.

Question: Will shutting down a McAfee MOVE AV agentless 4.7.0.131 VM on a host make the other VM on that host migrate using vmotion to another host, make the other VMs shut down or anything else adverse?

Question: Same question for Guest Introspection 6.4.1.8481357

 

Best Regards

Peter Rasch Lageri

UCL.dk

3 Replies

Re: Using McAfee MOVE AV agentless 4.7.0.131 shows very high CPU usage and Guest Introspection cause

Any update on this? I am seeing the same issue in my environment?

Thanks,

jdepina

Highlighted

Re: Using McAfee MOVE AV agentless 4.7.0.131 shows very high CPU usage and Guest Introspection cause

Upgrade your vCenter to 6.5 U2 (6.5.0.20000) and ESXi Hosts to 6.5 U2C (9298722).

Well, its worked for us but I still feel that MOVE AV agentless is slow to scan.

Copying a set of random files from one disk to another on the same VM and datastore takes around 30 sec. more when vsepflt driver is loaded than not. Using the ENT product (full fat McAfee client on each VM) seems more promising. I can get better response times after reloading vsepflt.

I not sure yet..... but upgrading to those vCenter AND ESXi versions did make the red exclamations marks go away.

Best Regards

Peter

 

Re: Using McAfee MOVE AV agentless 4.7.0.131 shows very high CPU usage and Guest Introspection cause

Additionally we have just now upgraded to NSX 6.4.3.9927516, GI 6.4.3.9852941, McAfee MOVE AV 4.8.0.168

We shall see but MOVE AV is under suspicion for being slow or causing slowing performance on Windows VMs compared to using ENT or (sigh) Windows Defender. The true culprit could be the vsepflt driver but could be any part of that chain of those programs (ePO <--> NSX <--> MOVE AV Agentless <--> Guest Introspection <--> vsepflt) I have not enough data yet on this new current setup. I does worry me though that apparently nobody else in Denmark uses MOVE AV agentless or at least I'm not aware of any.

/Peter

 

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community