cancel
Showing results for 
Search instead for 
Did you mean: 
avilt
Level 8
Report Inappropriate Content
Message 1 of 2

VSE ODS High CPU Utilization

Jump to solution

I am performing windows on demand scan (VSE 8.8 P10) with system Utilization Setting of “Below Normal”, CPU utilization was reaching 100% for a period of 5 to 8 minutes. High Utilization is consumed by process mcshieled.exe.

How do I resolve this?

1 Solution

Accepted Solutions
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: VSE ODS High CPU Utilization

Jump to solution

@avilt High CPU during ODS is expected behavior and is by design in order to get scans completed as quickly as possible and lessen the window at which the system is at higher duress due to full system scanning alongside the continuous On-Access Scanning. Windows process prioritization will provide the scanner with all of the available resources for this reason, until a process with higher priority requests use where it will temporarily hand it off to the requesting process before handing it back to the scanner. For this reason, we advise that your ODS be scheduled at a non-peak business hour, or on weekends, in order to limit the impact to the end user.

The first configuration change that can assist in making significant changes to scan duration and performance is disabling scanning of archives during ODS. This is considered to be a very minor to non-existent security risk because all files inside an archive are scanned when the archive is opened or extracted, making scanning these files redundant, because OAS will scan the archive if it is accessed or opened at any time and scanning them during an ODS can take some time. This extended time to scan the large archive files prevents Microsoft's priority allocation for resources from handing the processing power to other processes that request it until the entire archive is scanned or the default 45 second timeout is reached. If there is a large number of archives on a system, this scenario is more frequent and can create significant impact to performance and scan duration. This is a likely contributor to why you see the period of time where utilization is peaking to 100% even with "Below Normal" set.
The second change is to change system utilization from "Below Normal" to "Low" in order to set us at the lowest priority for resource allocation. Please keep in mind that this will not eliminate increased CPU consumption by ODS, but can increase the frequency and speed at which resources are handed off to other processes via priority leveling of the OS.

We recommend that you look towards these config changes to assist in lessening the impact of the ODS. However, as described, high CPU during ODS is expected by design, and there is not much that can be done to make a dramatic difference in scanning. Please review the following articles that go further in depth in regards to these concepts:
https://kc.mcafee.com/corporate/index?page=content&id=KB55145
https://kc.mcafee.com/corporate/index?page=content&id=KB85299

You can also review the best practices documentation for optimum ODS configuration: https://kc.mcafee.com/corporate/index?page=content&id=KB74059

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

1 Reply
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: VSE ODS High CPU Utilization

Jump to solution

@avilt High CPU during ODS is expected behavior and is by design in order to get scans completed as quickly as possible and lessen the window at which the system is at higher duress due to full system scanning alongside the continuous On-Access Scanning. Windows process prioritization will provide the scanner with all of the available resources for this reason, until a process with higher priority requests use where it will temporarily hand it off to the requesting process before handing it back to the scanner. For this reason, we advise that your ODS be scheduled at a non-peak business hour, or on weekends, in order to limit the impact to the end user.

The first configuration change that can assist in making significant changes to scan duration and performance is disabling scanning of archives during ODS. This is considered to be a very minor to non-existent security risk because all files inside an archive are scanned when the archive is opened or extracted, making scanning these files redundant, because OAS will scan the archive if it is accessed or opened at any time and scanning them during an ODS can take some time. This extended time to scan the large archive files prevents Microsoft's priority allocation for resources from handing the processing power to other processes that request it until the entire archive is scanned or the default 45 second timeout is reached. If there is a large number of archives on a system, this scenario is more frequent and can create significant impact to performance and scan duration. This is a likely contributor to why you see the period of time where utilization is peaking to 100% even with "Below Normal" set.
The second change is to change system utilization from "Below Normal" to "Low" in order to set us at the lowest priority for resource allocation. Please keep in mind that this will not eliminate increased CPU consumption by ODS, but can increase the frequency and speed at which resources are handed off to other processes via priority leveling of the OS.

We recommend that you look towards these config changes to assist in lessening the impact of the ODS. However, as described, high CPU during ODS is expected by design, and there is not much that can be done to make a dramatic difference in scanning. Please review the following articles that go further in depth in regards to these concepts:
https://kc.mcafee.com/corporate/index?page=content&id=KB55145
https://kc.mcafee.com/corporate/index?page=content&id=KB85299

You can also review the best practices documentation for optimum ODS configuration: https://kc.mcafee.com/corporate/index?page=content&id=KB74059

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community