cancel
Showing results for 
Search instead for 
Did you mean: 

McAfee FileCore kernel extension slows down file copying

I write backup software (Carbon Copy Cloner, https://bombich.com), and one of my users reported that his backup task was running excruciatingly slow, especially as it copied individual email documents (i.e. .emlx documets in ~/Library/Mail/V5/...). The user noted that this same performance degradation occurred when he tried to copy the same items via the Finder.

I asked the user to collect a spindump when the performance issue was occurring, and the stack trace of my file copier shows severe performance degradation caused by the McAfee "FileCore.kext" kernel extension:

 

Process: rsync [11133]
Path: /Library/Application Support/com.bombich.ccc/Frameworks/CloneKit.framework/Versions/A/rsync
Architecture: x86_64
Parent: rsync [11131]
Responsible: com.bombich.ccchelper [54]
UID: 0
Task size: 101.77 MB
CPU Time: 0.002s (4.8M cycles, 2.7M instructions, 1.80c/i)

Thread 0x8175c DispatchQueue 1 1000 samples (1-1000) priority 31-46 (base 31) cpu time 0.002s (4.8M cycles, 2.7M instructions, 1.80c/i)
1000 start + 52 (rsync + 5220) [0x106174464]
1000 main + 3252 (rsync + 275512) [0x1061b6438]
1000 local_child + 349 (rsync + 216649) [0x1061a7e49]
1000 child_main + 26 (rsync + 262298) [0x1061b309a]
1000 start_server + 883 (rsync + 263181) [0x1061b340d]
1000 do_recv + 507 (rsync + 271853) [0x1061b55ed]
993 recv_files + 2238 (rsync + 19902) [0x106177dbe]
993 finish_transfer + 763 (rsync + 257002) [0x1061b1bea]
993 robust_rename + 61 (rsync + 201042) [0x1061a4152]
993 do_rename + 141 (rsync + 125453) [0x106191a0d]
993 __rename + 10 (libsystem_kernel.dylib + 117914) [0x7fff55f51c9a]
*993 hndl_unix_scall64 + 22 (kernel + 129382) [0xffffff800021f966]
*993 unix_syscall64 + 616 (kernel + 6306776) [0xffffff8000803bd8]
*982 ??? (kernel + 2834557) [0xffffff80004b407d]
*982 vn_authorize_renamex + 217 (kernel + 2761145) [0xffffff80004a21b9]
*982 mac_vnode_check_rename + 1018 (kernel + 7375130) [0xffffff800090891a]
*982 mpo_vnode_check_rename + 627 (FileCore + 7479) [0xffffff7f85d03d37]
*982 handleFileIOEvent + 334 (FileCore + 6044) [0xffffff7f85d0379c]
*982 msleep + 98 (kernel + 5439570) [0xffffff8000730052]
*982 ??? (kernel + 5438104) [0xffffff800072fa98]
*982 lck_mtx_sleep_deadline + 139 (kernel + 509659) [0xffffff800027c6db]
*982 thread_block_reason + 175 (kernel + 554463) [0xffffff80002875df]
*982 ??? (kernel + 558618) [0xffffff800028861a]
*982 machine_switch_context + 205 (kernel + 1586045) [0xffffff800038337d]

Binary Images:
*0xffffff7f85d02000 - 0xffffff7f85d04fff com.intelsecurity.FileCore 1.0 (1) <FF5D6D9C-B670-30DD-8758-3ABC63E85985> /Library/StagedExtensions/Library/Application Support/McAfee/FMP/FileCore.kext/Contents/MacOS/FileCore


This is not the first incident of FileCore interference that has been reported to me, so I would like someone on the FMP engineering team to investigate and resolve the performance problem in this "handleFileIOEvent" method. 

 

Thanks,

Mike

 

Mike Bombich

Bombich Software, Inc.

mike@bombich.com

1 Reply
Highlighted

Re: McAfee FileCore kernel extension slows down file copying

Hi Mike, 

Please respond to the email which i have sent so that we can further look into this. 

Cheers.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community