one of our customers has the issue, that copying/downloading of archive files brings mcshield.exe to nearly to 100% cpu usage and the client does not respond after some time.
Edit: Especially, when archive-scanning is enabled ... but also it consumes a lot of ressources without.
We use ePO 5.3.3, Agent 5.5, VSE 8.8 P11.
- Uninstall of Agent and VSE, restart, new installation of agent and VSE
- Different client-machines
- Disabling archive-scan (which made it better)
If an Office-Installation folder (no iso, just files) is copied from a server-share to a local directory,
McShield starts going crazy. Same with larger .zip archives (2-5GB) and same with downloads
of large .zip-files (internet). The copy-process then "hangs" forever.
If scanning of archives is disabled on the client-side (while copying or before), everything is better,
but really good. CPU usage is still high.
Server(s) and clients are no "potatoe-machines".
- Maximum scan time is not enforced
- Artemis is "very low"
- Scan on network drives is disabled
- Read/Write scan is enabled
For the moment, we disabled archive scanning and decoding of MIME encoded files, which
is a small workaround but no sollution, because that's just one part of the issue.
Edit2: Same issue with VSE 8.8 P11 and Agent 5.0.6 (another customer). Just copied some smaller
ZIP-Archives (McAfee VSE Installation Archives) from a server to another. Archive-Scan disabled.
McShield has also afterwards for a couple of time nearly 50% CPU usage.
Does anyone have the same issues and/or some good hints?
I never saw this in such an extreme form in the past. Most of our customers run VSE 8.8 P10 and
Win7/10 (1709) with Agent 5.0.6 and do not have this kind of issues...
Hints and suggestions very welcome!
Hi we are having the same issue on several customers however seems to be on high end multicore CPU's, we found that as a work around we could restrict the number of cores used by VSE.
However this is only a work around and causing quite a bit of pain for our customers
Did you ever get a solution to this issue
no solution - just workarounds.
Disabled archive-scanning made it better and disabling scanning of all files.
How did you configure mcshield to just use 1 cpu core without handicraft?
If there is a workaround via GPO, that could ease it up a little bit - for now.