cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Ulhas
Level 7
Report Inappropriate Content
Message 1 of 4

VSE 8.8 Patch 8 -Mcshield High CPU Usage during On Demand Full Scan - Windows Server 2012 R2 Std

Jump to solution

Hi, We installed VSE+AntiSpyware 8.8 on Server 2012 R2 Standard. During On Demand Full Scan CPU Usage getting High. We observed that during On Demand Scan CPU Usage of Scan64.exe was normal but McShield.exe consume high CPU Usage even though we selected System Resource Utilization Low in On Demand Full Scan Settings. Please suggest how can i limit CPU Usage or can keep low CPU Usage. Because High CPU Usage affecting PC Performance.VSE_Version.JPGVSE Version & Patch Details

1 Solution

Accepted Solutions
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: VSE 8.8 Patch 8 -Mcshield High CPU Usage during On Demand Full Scan - Windows Server 2012 R2 Std

Jump to solution

@Ulhas 

High CPU during ODS is expected behavior and is by design in order to get scans completed as quickly as possible and lessen the window at which the system is at higher duress due to full system scanning alongside the continuous On-Access Scanning. Windows process prioritization will provide the scanner with all of the available resources for this reason, until a process with higher priority requests use where it will temporarily hand it off to the requesting process before handing it back to the scanner. For this reason, we advise that your ODS be scheduled at a non-peak business hour, or on weekends, in order to limit the impact to the end user.

The first configuration change that can assist in making significant changes to scan duration and performance is disabling scanning of archives during ODS. This is considered to be a very minor to non-existent security risk because all files inside an archive are scanned when the archive is opened or extracted, making scanning these files redundant, because OAS will scan the archive if it is accessed or opened at any time and scanning them during an ODS can take some time. This extended time to scan the large archive files prevents Microsoft's priority allocation for resources from handing the processing power to other processes that request it until the entire archive is scanned or the default 45 second timeout is reached. If there is a large number of archives on a system, this scenario is more frequent and can create significant impact to performance and scan duration.

The second change (as you state you have implemented) is to change system utilization from normal to low in order to set us at the lowest priority for resource allocation. Please keep in mind that this will not eliminate increased CPU consumption by ODS, but can increase the frequency and speed at which resources are handed off to other processes via priority leveling of the OS.

We recommend that you look towards these config changes to assist in lessening the impact of the ODS. However, as described, high CPU during ODS is expected by design, and there is not much that can be done to make a dramatic difference in scanning. Please review the following articles that go further in depth in regards to these concepts:
https://kc.mcafee.com/corporate/index?page=content&id=KB55145
https://kc.mcafee.com/corporate/index?page=content&id=KB85299

You can also review the best practices documentation for optimum ODS configuration: https://kc.mcafee.com/corporate/index?page=content&id=KB74059

Please let me know if you have any questions or concerns in regards to this information.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

3 Replies
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: VSE 8.8 Patch 8 -Mcshield High CPU Usage during On Demand Full Scan - Windows Server 2012 R2 Std

Jump to solution

@Ulhas 

High CPU during ODS is expected behavior and is by design in order to get scans completed as quickly as possible and lessen the window at which the system is at higher duress due to full system scanning alongside the continuous On-Access Scanning. Windows process prioritization will provide the scanner with all of the available resources for this reason, until a process with higher priority requests use where it will temporarily hand it off to the requesting process before handing it back to the scanner. For this reason, we advise that your ODS be scheduled at a non-peak business hour, or on weekends, in order to limit the impact to the end user.

The first configuration change that can assist in making significant changes to scan duration and performance is disabling scanning of archives during ODS. This is considered to be a very minor to non-existent security risk because all files inside an archive are scanned when the archive is opened or extracted, making scanning these files redundant, because OAS will scan the archive if it is accessed or opened at any time and scanning them during an ODS can take some time. This extended time to scan the large archive files prevents Microsoft's priority allocation for resources from handing the processing power to other processes that request it until the entire archive is scanned or the default 45 second timeout is reached. If there is a large number of archives on a system, this scenario is more frequent and can create significant impact to performance and scan duration.

The second change (as you state you have implemented) is to change system utilization from normal to low in order to set us at the lowest priority for resource allocation. Please keep in mind that this will not eliminate increased CPU consumption by ODS, but can increase the frequency and speed at which resources are handed off to other processes via priority leveling of the OS.

We recommend that you look towards these config changes to assist in lessening the impact of the ODS. However, as described, high CPU during ODS is expected by design, and there is not much that can be done to make a dramatic difference in scanning. Please review the following articles that go further in depth in regards to these concepts:
https://kc.mcafee.com/corporate/index?page=content&id=KB55145
https://kc.mcafee.com/corporate/index?page=content&id=KB85299

You can also review the best practices documentation for optimum ODS configuration: https://kc.mcafee.com/corporate/index?page=content&id=KB74059

Please let me know if you have any questions or concerns in regards to this information.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Ulhas
Level 7
Report Inappropriate Content
Message 3 of 4

Re: VSE 8.8 Patch 8 -Mcshield High CPU Usage during On Demand Full Scan - Windows Server 2012 R2 Std

Jump to solution

Hi, Thanks for reply but Our Priority is Performance becuase our PC 24x7 under operation and user activities will be continuously. So it will be acceptable for us if Full Scan will take 2 or 4 Days to complete Scanning but High CPU Usage not accepatable for us. Please suggest any alternative way to keep performance satisfactory during Scanning.

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 5 of 4

Re: VSE 8.8 Patch 8 -Mcshield High CPU Usage during On Demand Full Scan - Windows Server 2012 R2 Std

Jump to solution

@Ulhas Have you investigated what the performance looks like when you disable scanning of archives? As mentioned, this can be one of the biggest holders of CPU spikes can be scanning through an archive-type file. 

Outside of doing this, or breaking up your scans into multiple smaller scans (breaking up the areas your scanning) in order to break up the periods of higher CPU, there is little else you can do from a configuration standpoint to lessen the performance impact due to On Demand Scans. This is due to the design of getting ODS completed as quickly as possible in order to lessen the length of time that the system is under duress. 

Please review the provided documentation above for more details and explanation, as well as Best Practice instructions.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator