cancel
Showing results for 
Search instead for 
Did you mean: 

Various reasons, but still no fix

I have taken off processes on startup but also check out KB66152 which refers to spikes in engine_server as an unsolved issue. Sadly th article related to it has gone. I await a response from McAfee on that.

Also now seeing the error in mctray that McAfee are working on.

Also querying Agent Handlers, which seems to be set up in some bizarre fashion. My Pcs seems to be gayly talking to any handler they can talk to despite my rules. Guess what....waiting for a reply from McAfee on that one........................

RE: Various reasons, but still no fix

Conclusion after disabling "Processes on enable" ... ok, it's a bit faster but there's no wonder as VSE doesn't scan the processes. Other than that PC is still "hanged" for about 2-5 minutes during the DAT upgrade and Engineserver utilizes PC at about 50% for another 5-10 minutes. After that the mem consumption is about 3 times higher than before the update.

This is on HP Elitebook 6930p w/ Win 7 ... not really bad piece of HW ... on slower machines it's usually much worse, not to mention machines with Win XP.

I'd say this is by design ... designed by McAfee 😉

Petr
RickIA
Level 9
Report Inappropriate Content
Message 33 of 76

Re: RE: Various reasons, but still no fix

This issue is still happening in my shop as well. We are running EPO 4.5, MA 4.5.1270 and VSE 8.71 P2 + hotfix 517265. Not all machines have the hang, but the same machines have the hang almost daily.  I have removed/reinstall agents, VSE, still no change in behavior. DAT update dates 2-3 minutes (that's fine) but then engineserver.exe buries the machine for another 8-10 minutes. I saw a machine yesterday with over 1gb of pagefile used and the machine had 1gb of total system memory so you know how well it was acting. Seriously, do I need to just NOT update dats except for once a week or something? It also doesn't matter what OS I am running its not picky. I have Windows 7 64-bit and Windows XP, same behavior happens at the same time on both OS'es. Is this something a patch 3 might finally resolve for 8.7? I sure hope so!

Mcafee 8.7 and ServerEngine.exe

I have this issue as well using 8.7i, and have sent mer and poolmon data to Mcafee. After 4 days of my 2003 Citrix 4.5 server running this process is now 800+MB.

Has anyone heard from Mcafee on this?

Scott
Highlighted
SeaCat
Level 7
Report Inappropriate Content
Message 35 of 76

Re: engineserver.exe memory leaks?

I haven't seen any posts on this in a while.  I'm seeing the exact same issue occur in our environment.  As of yet I have not made the recommended change of turning off scanning the processes on enable.  I was hoping that someone might have some more information on this and if there is anything else to address the issue.

Re: engineserver.exe memory leaks?

Still happening. Thought I'd fixed it by removing 'send-to' entries from my profile but the joy was short lived. Seeing it on a few PCS around the world in our company and have changed update times to be during a break for them rather than talk to McAfee again. Spent about 6 weeks getting nowhere really last year and don't want to go though it all again. Patch 3 for 8.7 should be out March so I am going to wait for that and if it does not help, I will address it again.

dvo
Level 9
Report Inappropriate Content
Message 37 of 76

Re: engineserver.exe memory leaks?

engineserver.exe issue should be fixed in patch4 per KB59962(June 2010)

disabling process on enable should fix the hung system on updates issue, will be perm fixed and ok to keep that enabled by the NEXT VSE release VSE 8.7.1

hope this helps

McAfee Employee wwarren
McAfee Employee
Report Inappropriate Content
Message 38 of 76

Re: engineserver.exe memory leaks?

Here's what I know -

Patch 4 will include resolutions to 2 issues that are relevant to this thread:-

1. EngineServer memory usage climbing to excessive levels.

A proof-of-concept build has been proven to solve one aspect of the issue, specific to use of EmailScan. We still haven't tracked down lingering reports of high memory usage in EngineServer once our POC code is in place; whatever the condition, it is rare, and it does not appear related to EmailScan.

2. A fix for an issue with creating the mferuntime.dat file.

This symptom is the key contributor of why some systems are seen to take 10+ minutes to complete an update.

Post update, the Engine tries to create a memory mapped file to help reduce memory footprint and improve performance, this file is mferuntime.dat (See article KB65459).

What we have found to occur is the creation of the file sometimes encounters sharing violations (one or more of the scanners hasn't released it) and the product enters a loop of retrying to create this file. This file is created based on information from our DAT signatures, and so this data is reread each time the loop repeats. It can be very noticeable to users by way of sluggishness of the system.

Here's what I know will help alleviate the stress of updates, until these issues are resolved:-

1. Tweak the Agent thread priority as described in KB53690.

2. Disable scanning of Processes on Enable - this is only intended for environments who abide by the "Maximum Security" setting of the product

3. Utilize the Low Risk On-Access Scanner profile, placing McAfee processes into it (mcscript_inuse.exe, naprdmgr.exe, frameworkservice.exe), with scanning disabled (understand this is a temporary measure)

4. Perhaps the most significant change for relief, lower the priority of our On-Access Scanner from its default "High" to "Normal"

This is done by creating/setting a DWORD registry flag named "RunAtNormalPriority" to 1, under HKLM\Software\McAfee\VSCore\On Access Scanner\McShield\Configuration, and restart the service.

This change is normally done only under direction by McAfee Support. It does not reduce your security in any way, but it's plausible you could see an increase in scanner timeouts because McShield will be getting equal CPU time as your other Normal thread priority processes instead of a lion's share. And this means if experiencing the mferuntime.dat loop, your system will still be pretty responsive during that time.

Patch 4 is expected mid-June if able to stay on schedule. Living in the dynamic world of McAfee Sustaining, all things are subject to change.

William W. Warren | S.I.R.R. | Customer Success Group | McAfee
RickIA
Level 9
Report Inappropriate Content
Message 39 of 76

Re: engineserver.exe memory leaks?

Thanks William for the update. Please keep us updated with any changes or more specifics with the P4 release schedule.

Re: engineserver.exe memory leaks?

Is VSE8.7 Patch 4 still expected to be released in June? Do you have any RTS date?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community