cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

VSE 8.8 P11 / Agent 5.5 - High CPU Usage - when archive-scanning is activated (Windows 10 1709/1803)

Hello,

one of our customers has the issue, that copying/downloading of archive files brings mcshield.exe to nearly to 100% cpu usage and the client does not respond after some time.

Edit: Especially, when archive-scanning is enabled ... but also it consumes a lot of ressources without.

We use ePO 5.3.3, Agent 5.5, VSE 8.8 P11.

We tested:
- Uninstall of Agent and VSE, restart, new installation of agent and VSE
- Different client-machines
- Disabling archive-scan (which made it better)

If an Office-Installation folder (no iso, just files) is copied from a server-share to a local directory,
McShield starts going crazy. Same with larger .zip archives (2-5GB) and same with downloads
of large .zip-files (internet). The copy-process then "hangs" forever.

If scanning of archives is disabled on the client-side (while copying or before), everything is better,
but really good. CPU usage is still high.

Server(s) and clients are no "potatoe-machines".

 

Side notes:
- Maximum scan time is not enforced
- Artemis is "very low"
- Scan on network drives is disabled
- Read/Write scan is enabled

For the moment, we disabled archive scanning and decoding of MIME encoded files, which
is a small workaround but no sollution, because that's just one part of the issue.

Edit2: Same issue with VSE 8.8 P11 and Agent 5.0.6 (another customer). Just copied some smaller
ZIP-Archives (McAfee VSE Installation Archives) from a server to another. Archive-Scan disabled.
McShield has also afterwards for a couple of time nearly 50% CPU usage.

 

Does anyone have the same issues and/or some good hints?
I never saw this in such an extreme form in the past. Most of our customers run VSE 8.8 P10 and
Win7/10 (1709) with Agent 5.0.6 and do not have this kind of issues...

Hints and suggestions very welcome!

 

Best regards
Daniel

 

2 Replies

Re: VSE 8.8 P11 / Agent 5.5 - High CPU Usage - when archive-scanning is activated (Windows 10 1709/1

Hi we are having the same issue  on several customers however seems to be on high end multicore CPU's,  we found that as a work around we could restrict the number of cores used by VSE.

 

https://community.mcafee.com/t5/VirusScan/How-could-I-limit-McAfee-s-CPU-usage-during-scans/m-p/4746...

 

However this is only a work around and causing quite a bit of pain for our customers

 

Did you ever get a solution to this issue

Re: VSE 8.8 P11 / Agent 5.5 - High CPU Usage - when archive-scanning is activated (Windows 10 1709/1

Hi,

no solution - just workarounds.
Disabled archive-scanning made it better and disabling scanning of all files.

How did you configure mcshield to just use 1 cpu core without handicraft?
If there is a workaround via GPO, that could ease it up a little bit - for now.

 

Best regards
Daniel

ePO Support Center Plug-in
Check out the new ePO Support Center. Simply access the ePO Software Manager and follow the instructions in the Product Guide for the most commonly used utilities, top known issues announcements, search the knowledgebase for product documentation, and server status and statistics – all from within ePO.