We have been having big issues with apparent memory leaks on our Windows Hyper-V 2008 and 2012 hosts, since upgrading VirusScan 8.8 to Patch 6. The processes are mferkdet.sys and mfehidk.sys.
The servers are grinding to a halt with these processes taking all the available RAM :-
Anyone else seen this?
Forcing a dump of the system while in that state would be helpful. Plus running our MER tool afterwards so we can see what else is installed, configurations, etc.
mfehidk.sys is likely blameless; it'll show up in everything though because its purpose in life is a kin to a telephone operator, funneling information off to the appropriate interested party.
mferkdet.sys is a root-kit detection driver. So you'll see it do most its work when your on-demand scan task runs, where the task is configured to scan memory for rootkits. It also suggests you can control the rate of the leak by controlling your ODS tasks.
It's plausible there's an interop issue with another driver on the system that is causing us to leak memory. We've seen that type of interaction before but it was specific to Server 2003.
is this related to Hyper-V only or it general, because we are planning to upgrade to patch 6, does it have issue with memory leaks?
I would like to make sure that if there is no memory issue with vse p6, therefore I will start the windows task manager and watch the memory percent with time if it increases or not. Is this enough test to do?
"Not really" is the quick answer.
Memory can be used directly and indirectly by applications; directly=reserving/committing memory, indirectly=creating objects (because those objects take up memory).
The operating system has different regions of memory that get used by applications and the OS. And it requires different tools to provide you visibility into these various memory segments.
Task Manager is helpful if you want to look at the working set for a process. 32-bit and 64-bit systems have different max boundaries for memory usage of running processes, and you have to be careful when using Task Manager to determine a leak is present - is it a leak, or is the app just using a lot of memory? Task Manager doesn't answer this question for you. But, if you've been watching memory climb without end and certainly if the max boundary usage is being hit, then there's probably a leak in how that app is managing its memory and/or resources.
There are better tools. And the best tool to use depends on what type of memory is being leaked that you are trying to troubleshoot. Poolmon and Perfmon are best for demonstrating a leak is occurring, because they provide data over time, and that also tells you the rate of the leak. Perfmon is especially useful when you include the Process object's counters, so you can see if other resources are being leaked (like Handle or Thread). And depending on the nature of the leak, a process dump or complete system dump may be necessary for getting to the root of the problem.
so up to your knowledge is there memory issue with vse p6? I noticed when I run epo task (Disaster Recovery Snapshot ) the memory jumps from 12% to 30%, when the task is completed the memory percentage stays at 30% and does not go back to 12!
so up to your knowledge is there memory issue with vse p6?
I noticed when I run epo task (Disaster Recovery Snapshot ) the memory jumps from 12% to 30%, when the task is completed the memory percentage stays at 30% and does not go back to 12!
That doesn't mean anything though. If you feel it's a concern then I encourage you to read up on how memory management works in Microsoft Windows, what practices are legal or not, and best practices when writing code for managing memory... but this is not the place for it .
I will state for clarity sake though, using memory for a task and not forcibly clearing that memory when complete, is totally OK for an application to do and not an issue.
Sorry, I have no idea what you're trying to describe in that sentence.
If you feel you have an issue to investigate, please contact Support.
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center