cancel
Showing results for 
Search instead for 
Did you mean: 
avilt
Level 7
Report Inappropriate Content
Message 1 of 2

VSE ODS High CPU Utilization

Jump to solution

I am performing windows on demand scan (VSE 8.8 P10) with system Utilization Setting of “Below Normal”, CPU utilization was reaching 100% for a period of 5 to 8 minutes. High Utilization is consumed by process mcshieled.exe.

How do I resolve this?

1 Solution

Accepted Solutions
Highlighted
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: VSE ODS High CPU Utilization

Jump to solution

@avilt High CPU during ODS is expected behavior and is by design in order to get scans completed as quickly as possible and lessen the window at which the system is at higher duress due to full system scanning alongside the continuous On-Access Scanning. Windows process prioritization will provide the scanner with all of the available resources for this reason, until a process with higher priority requests use where it will temporarily hand it off to the requesting process before handing it back to the scanner. For this reason, we advise that your ODS be scheduled at a non-peak business hour, or on weekends, in order to limit the impact to the end user.

The first configuration change that can assist in making significant changes to scan duration and performance is disabling scanning of archives during ODS. This is considered to be a very minor to non-existent security risk because all files inside an archive are scanned when the archive is opened or extracted, making scanning these files redundant, because OAS will scan the archive if it is accessed or opened at any time and scanning them during an ODS can take some time. This extended time to scan the large archive files prevents Microsoft's priority allocation for resources from handing the processing power to other processes that request it until the entire archive is scanned or the default 45 second timeout is reached. If there is a large number of archives on a system, this scenario is more frequent and can create significant impact to performance and scan duration. This is a likely contributor to why you see the period of time where utilization is peaking to 100% even with "Below Normal" set.
The second change is to change system utilization from "Below Normal" to "Low" in order to set us at the lowest priority for resource allocation. Please keep in mind that this will not eliminate increased CPU consumption by ODS, but can increase the frequency and speed at which resources are handed off to other processes via priority leveling of the OS.

We recommend that you look towards these config changes to assist in lessening the impact of the ODS. However, as described, high CPU during ODS is expected by design, and there is not much that can be done to make a dramatic difference in scanning. Please review the following articles that go further in depth in regards to these concepts:
https://kc.mcafee.com/corporate/index?page=content&id=KB55145
https://kc.mcafee.com/corporate/index?page=content&id=KB85299

You can also review the best practices documentation for optimum ODS configuration: https://kc.mcafee.com/corporate/index?page=content&id=KB74059

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

1 Reply
Highlighted
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: VSE ODS High CPU Utilization

Jump to solution

@avilt High CPU during ODS is expected behavior and is by design in order to get scans completed as quickly as possible and lessen the window at which the system is at higher duress due to full system scanning alongside the continuous On-Access Scanning. Windows process prioritization will provide the scanner with all of the available resources for this reason, until a process with higher priority requests use where it will temporarily hand it off to the requesting process before handing it back to the scanner. For this reason, we advise that your ODS be scheduled at a non-peak business hour, or on weekends, in order to limit the impact to the end user.

The first configuration change that can assist in making significant changes to scan duration and performance is disabling scanning of archives during ODS. This is considered to be a very minor to non-existent security risk because all files inside an archive are scanned when the archive is opened or extracted, making scanning these files redundant, because OAS will scan the archive if it is accessed or opened at any time and scanning them during an ODS can take some time. This extended time to scan the large archive files prevents Microsoft's priority allocation for resources from handing the processing power to other processes that request it until the entire archive is scanned or the default 45 second timeout is reached. If there is a large number of archives on a system, this scenario is more frequent and can create significant impact to performance and scan duration. This is a likely contributor to why you see the period of time where utilization is peaking to 100% even with "Below Normal" set.
The second change is to change system utilization from "Below Normal" to "Low" in order to set us at the lowest priority for resource allocation. Please keep in mind that this will not eliminate increased CPU consumption by ODS, but can increase the frequency and speed at which resources are handed off to other processes via priority leveling of the OS.

We recommend that you look towards these config changes to assist in lessening the impact of the ODS. However, as described, high CPU during ODS is expected by design, and there is not much that can be done to make a dramatic difference in scanning. Please review the following articles that go further in depth in regards to these concepts:
https://kc.mcafee.com/corporate/index?page=content&id=KB55145
https://kc.mcafee.com/corporate/index?page=content&id=KB85299

You can also review the best practices documentation for optimum ODS configuration: https://kc.mcafee.com/corporate/index?page=content&id=KB74059

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

More McAfee Tools to Help You
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • Visit: Business Service Portal
  • More: Search Knowledge Articles
  • ePolicy Orchestrator Support

    • Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center