cancel
Showing results for 
Search instead for 
Did you mean: 
mjmurra
Level 12
Report Inappropriate Content
Message 1 of 2

8.7i P3 duplicate mfeann.exe processes, 100% CPU

Jump to solution

We see this occasionally on servers thave have been up for a very long time (> 100 days). Haven't seen anything in the Knowledge base about the issue, and as I can't replicate it easily (as well as needing patch 5 to get full escalated support if the issue isn't already known) - I don't think this would be an easy one to diagnose.

Win 2K8 R2 x64 is where I've seen it occur.

Version of MFEann.exe is 14.1.0.524

Have only found one vague reference on the web (A Twitter post from an Admin ranting about 100% CPU for mfeann.exe)

Anyone seen similar? Known issue?

on 7/08/12 11:31:41 AM
1 Solution

Accepted Solutions
McAfee Employee wwarren
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: 8.7i P3 duplicate mfeann.exe processes, 100% CPU

Jump to solution

Hi Mjmurra,

In 8.7i, the process MFEAnn.exe is a child process to McShield.exe.

If you have multiple MFEAnn.exe processes, it means that McShield.exe must have encountered some issue to cause it to restart - and then most likely, the "older" MFEAnn.exe has become confused and is possibly trying to connect frantically to the older instance of McShield that no longer exists.

Since that scenario is fueled by McShield restarting - and again, most likely due to a fatal scan timeout occurring - you might want to consider upgrading to a later release where timeouts are less frequent. If that means 8.7i P5, you'll still want HF 638179 which is available from the knowledgebase.

Ideally, you'd go to VSE 8.8 Patch 2... just as soon as it's available, as it has no need for any timeout-related hotfixes.

William W. Warren | S.I.R.R. | Customer Success Group | McAfee
1 Reply
McAfee Employee wwarren
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: 8.7i P3 duplicate mfeann.exe processes, 100% CPU

Jump to solution

Hi Mjmurra,

In 8.7i, the process MFEAnn.exe is a child process to McShield.exe.

If you have multiple MFEAnn.exe processes, it means that McShield.exe must have encountered some issue to cause it to restart - and then most likely, the "older" MFEAnn.exe has become confused and is possibly trying to connect frantically to the older instance of McShield that no longer exists.

Since that scenario is fueled by McShield restarting - and again, most likely due to a fatal scan timeout occurring - you might want to consider upgrading to a later release where timeouts are less frequent. If that means 8.7i P5, you'll still want HF 638179 which is available from the knowledgebase.

Ideally, you'd go to VSE 8.8 Patch 2... just as soon as it's available, as it has no need for any timeout-related hotfixes.

William W. Warren | S.I.R.R. | Customer Success Group | McAfee
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community