cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

VSE 8.8 P11 / Agent 5.5 - High CPU Usage - when archive-scanning is activated (Windows 10 1709/1803)

Hello,

one of our customers has the issue, that copying/downloading of archive files brings mcshield.exe to nearly to 100% cpu usage and the client does not respond after some time.

Edit: Especially, when archive-scanning is enabled ... but also it consumes a lot of ressources without.

We use ePO 5.3.3, Agent 5.5, VSE 8.8 P11.

We tested:
- Uninstall of Agent and VSE, restart, new installation of agent and VSE
- Different client-machines
- Disabling archive-scan (which made it better)

If an Office-Installation folder (no iso, just files) is copied from a server-share to a local directory,
McShield starts going crazy. Same with larger .zip archives (2-5GB) and same with downloads
of large .zip-files (internet). The copy-process then "hangs" forever.

If scanning of archives is disabled on the client-side (while copying or before), everything is better,
but really good. CPU usage is still high.

Server(s) and clients are no "potatoe-machines".

 

Side notes:
- Maximum scan time is not enforced
- Artemis is "very low"
- Scan on network drives is disabled
- Read/Write scan is enabled

For the moment, we disabled archive scanning and decoding of MIME encoded files, which
is a small workaround but no sollution, because that's just one part of the issue.

Edit2: Same issue with VSE 8.8 P11 and Agent 5.0.6 (another customer). Just copied some smaller
ZIP-Archives (McAfee VSE Installation Archives) from a server to another. Archive-Scan disabled.
McShield has also afterwards for a couple of time nearly 50% CPU usage.

 

Does anyone have the same issues and/or some good hints?
I never saw this in such an extreme form in the past. Most of our customers run VSE 8.8 P10 and
Win7/10 (1709) with Agent 5.0.6 and do not have this kind of issues...

Hints and suggestions very welcome!

 

Best regards
Daniel

 

2 Replies

Re: VSE 8.8 P11 / Agent 5.5 - High CPU Usage - when archive-scanning is activated (Windows 10 1709/1

Hi we are having the same issue  on several customers however seems to be on high end multicore CPU's,  we found that as a work around we could restrict the number of cores used by VSE.

 

https://community.mcafee.com/t5/VirusScan/How-could-I-limit-McAfee-s-CPU-usage-during-scans/m-p/4746...

 

However this is only a work around and causing quite a bit of pain for our customers

 

Did you ever get a solution to this issue

Re: VSE 8.8 P11 / Agent 5.5 - High CPU Usage - when archive-scanning is activated (Windows 10 1709/1

Hi,

no solution - just workarounds.
Disabled archive-scanning made it better and disabling scanning of all files.

How did you configure mcshield to just use 1 cpu core without handicraft?
If there is a workaround via GPO, that could ease it up a little bit - for now.

 

Best regards
Daniel