cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

McAfee FileCore kernel extension slows down file copying

I write backup software (Carbon Copy Cloner, https://bombich.com), and one of my users reported that his backup task was running excruciatingly slow, especially as it copied individual email documents (i.e. .emlx documets in ~/Library/Mail/V5/...). The user noted that this same performance degradation occurred when he tried to copy the same items via the Finder.

I asked the user to collect a spindump when the performance issue was occurring, and the stack trace of my file copier shows severe performance degradation caused by the McAfee "FileCore.kext" kernel extension:

 

Process: rsync [11133]
Path: /Library/Application Support/com.bombich.ccc/Frameworks/CloneKit.framework/Versions/A/rsync
Architecture: x86_64
Parent: rsync [11131]
Responsible: com.bombich.ccchelper [54]
UID: 0
Task size: 101.77 MB
CPU Time: 0.002s (4.8M cycles, 2.7M instructions, 1.80c/i)

Thread 0x8175c DispatchQueue 1 1000 samples (1-1000) priority 31-46 (base 31) cpu time 0.002s (4.8M cycles, 2.7M instructions, 1.80c/i)
1000 start + 52 (rsync + 5220) [0x106174464]
1000 main + 3252 (rsync + 275512) [0x1061b6438]
1000 local_child + 349 (rsync + 216649) [0x1061a7e49]
1000 child_main + 26 (rsync + 262298) [0x1061b309a]
1000 start_server + 883 (rsync + 263181) [0x1061b340d]
1000 do_recv + 507 (rsync + 271853) [0x1061b55ed]
993 recv_files + 2238 (rsync + 19902) [0x106177dbe]
993 finish_transfer + 763 (rsync + 257002) [0x1061b1bea]
993 robust_rename + 61 (rsync + 201042) [0x1061a4152]
993 do_rename + 141 (rsync + 125453) [0x106191a0d]
993 __rename + 10 (libsystem_kernel.dylib + 117914) [0x7fff55f51c9a]
*993 hndl_unix_scall64 + 22 (kernel + 129382) [0xffffff800021f966]
*993 unix_syscall64 + 616 (kernel + 6306776) [0xffffff8000803bd8]
*982 ??? (kernel + 2834557) [0xffffff80004b407d]
*982 vn_authorize_renamex + 217 (kernel + 2761145) [0xffffff80004a21b9]
*982 mac_vnode_check_rename + 1018 (kernel + 7375130) [0xffffff800090891a]
*982 mpo_vnode_check_rename + 627 (FileCore + 7479) [0xffffff7f85d03d37]
*982 handleFileIOEvent + 334 (FileCore + 6044) [0xffffff7f85d0379c]
*982 msleep + 98 (kernel + 5439570) [0xffffff8000730052]
*982 ??? (kernel + 5438104) [0xffffff800072fa98]
*982 lck_mtx_sleep_deadline + 139 (kernel + 509659) [0xffffff800027c6db]
*982 thread_block_reason + 175 (kernel + 554463) [0xffffff80002875df]
*982 ??? (kernel + 558618) [0xffffff800028861a]
*982 machine_switch_context + 205 (kernel + 1586045) [0xffffff800038337d]

Binary Images:
*0xffffff7f85d02000 - 0xffffff7f85d04fff com.intelsecurity.FileCore 1.0 (1) <FF5D6D9C-B670-30DD-8758-3ABC63E85985> /Library/StagedExtensions/Library/Application Support/McAfee/FMP/FileCore.kext/Contents/MacOS/FileCore


This is not the first incident of FileCore interference that has been reported to me, so I would like someone on the FMP engineering team to investigate and resolve the performance problem in this "handleFileIOEvent" method. 

 

Thanks,

Mike

 

Mike Bombich

Bombich Software, Inc.

mike@bombich.com

1 Reply

Re: McAfee FileCore kernel extension slows down file copying

Hi Mike, 

Please respond to the email which i have sent so that we can further look into this. 

Cheers.

How Many Badges Can You Collect?
Ready for a little competition? Members like you are earning badges and unlocking perks for their helpful answers. Are you? Click here to find out.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community