cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
scoreson
Level 8
Report Inappropriate Content
Message 1 of 8

VSE 1.9 on Linux Ent 5.7 Multiple Spawned Scanner Process

Hi Folks

OK I know its old tech but we're running VSE1.9 on old legacy Linux 5.7 servers. Note these servers are air-gapped from the web/internet and will NEVER be connected. We update the DAT files manually every few days via an air-gap sheep-dip removable media process.

I know I know, you dont need to tell me, I inherited this and am taking steps longer term but for now any help appreciated.

Usually when I check there will be a single root owned scanner process and perhaps 3-6 nails owned scanner processes. However following a recent DAT update we are seeing huge numbers of root owned scanner processes that within a few hours brick the server due to 100% CPU. nails owned scanner processes are nowhere to be seen. This is repeatable across all similarly configured servers.

I have tried the stop nails, kill scanner process, start nails idea I've seen mentioned elsewhere, but the issue just starts again and soon, the server is bricked. I have tried using other newer DAT files and each gives the same. Note if we roll back the DAT files to the last known 'safe' version, the issue stops and scanner process behaves.

I am desperate for any ideas here please. I know this stuff is going end of life soon any way, but for now I am getting a lot of grief on this and need a solution.

Thanks in anticipation folks

GD

7 Replies
Sivakumar1
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: VSE 1.9 on Linux Ent 5.7 Multiple Spawned Scanner Process

Hello @scoreson . Thank you for posting here . Could you please help us with the DAT Version where there was single root owned scanner process and there was 3-6 nails owned scanner processes.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

scoreson
Level 8
Report Inappropriate Content
Message 3 of 8

Re: VSE 1.9 on Linux Ent 5.7 Multiple Spawned Scanner Process

Hi Sivakumar1 and thanks for replying

DAT10035 (Engine is 5600.1067) is 'good'.

DATs 10106 and 10155 cause issues. Note that I do not know what happens with any DAT between 10035 and 10106, as I dont have them; we dont update every day, we are air-gapped.

I get the same result on other identical version Linux servers, running the same McAfee version/engine, it is repeatable.

Note I have also just noticed that on an affected server's McAfee web page the Host Summary shows the status as 'Enabled' when 10035 is installed, but the status is 'On-access Disabled' when 10106&10155 are installed.

The On Access settings page shows the enabled box as ticked, but any attempt by me to Edit that page and re-apply that setting results in the following error page: Error Code 25 reload failed code Failed to configure the OAS scheduler.

All further assistance much appreciated.

Regards  Graham

 

Revathi1
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: VSE 1.9 on Linux Ent 5.7 Multiple Spawned Scanner Process

Hi @scoreson ,

Thanks for sharing the details

Engine 5600 is already a EOL engine

Is that possible to test the Engine with 6200 or the latest version and let us know the status


In case if the issue still persist with 6200 we might need to collect the logs or get on remote to
troubleshoot the issue. Hence please feel free to open a service request for McAfee support. We will look in to it.

 

scoreson
Level 8
Report Inappropriate Content
Message 5 of 8

Re: VSE 1.9 on Linux Ent 5.7 Multiple Spawned Scanner Process

Thanks for the reply

I am happy to attempt to update the Engine, can you advise where I get the latest engine for a standalone, none ePO managed, Linux Enterprise VirusScan 1.9 install and how I perform that update manually - are there instructions somewhere?

I can find info for Windows but not Linux.

Thank you

Graham

scoreson
Level 8
Report Inappropriate Content
Message 6 of 8

Re: VSE 1.9 on Linux Ent 5.7 Multiple Spawned Scanner Process

Many thanks for the assistance, I have managed to find the latest engine and applied it to my one of my Linux servers and it seems to have resolved the issue.

Kind Regards

Graham

Revathi1
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 8

Re: VSE 1.9 on Linux Ent 5.7 Multiple Spawned Scanner Process

Hi @scoreson ,

Thank you for reaching us through community.

Could you please share the DAT and the Engine version which is been used in the server to initiate scan.

 

Thanks,

Revathi R

scoreson
Level 8
Report Inappropriate Content
Message 8 of 8

Re: VSE 1.9 on Linux Ent 5.7 Multiple Spawned Scanner Process

Hi thanks for replying, please see my reply to Sivakumar1 for the information required.

Regards

Graham

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community