cancel
Showing results for 
Search instead for 
Did you mean: 

Re: engineserver.exe memory leaks?

in this KB i cant find anything about HF638179

sgrimmel
Level 11
Report Inappropriate Content
Message 62 of 76

Re: engineserver.exe memory leaks?

The following articles deal with HF638179

- Possible memory leak when scanners exit abnormally (KB71848)
- Possible Scanner timeouts during updates (KB71849

HTH

Re: engineserver.exe memory leaks?

dvo,

I am very curious to know about VSE 8.7.1

When is it supposedly releasing ? What will be the major changes or updates ?

Also, I have been hearing about the version 9.0. What happened to that ?


Sameer

Re: engineserver.exe memory leaks?

April 19, 2010 and engineserver.exe is STILL a SERIOUS problem. We just installed Total Protection on the server and workstations and they all exist just for the purpose of running engineserver.exe because nothing else is getting done. The workstations are continuously locking up and occassionally, the server locks up too. When can we expect some relief from this? Is there anything we can do short of uninstalling McAfee to get our computers back again? We really need to get some work done. Thanks.

rjo98
Level 7
Report Inappropriate Content
Message 65 of 76

Re: engineserver.exe memory leaks?

For what its worth to those still having problems, creating the RunAtNormalPriority key as advised a few posts ago resolved my issue.  Maybe we'll get an update on when the patch will be coming out to resolve this permanently.

Re: HotFix 539488 for vse8.7 engineserver+outlook scan mem issue

There is a HF available for engineserver + outlook scan memory issue:

https://mysupport.mcafee.com/Eservice/Article.aspx?id=KB59962

EngineServer.exe memory usage

  • #FeedBackDiv
  • --------------------

    Environment

    Microsoft Windows
    Microsoft Outlook
    Microsoft Internet Explorer 7 x
    Mozilla FireFox 3 x
    Lotus Notes

    For details of all supported operating systems, see KB51109

    Summary

    Problem 1

    The OutlookScan feature can fail to release an instance of the scan engine that was loaded via EngineServer.exe. This can lead to symptoms of EngineServer.exe using large amounts of memory, until the service was restarted.

    Problem 2

    Memory usage is higher than expected

    Because of the present (March 2010) size of virus definition files, it is reasonable to expect to use 50 MB of memory for a single instance of the Engine and DAT files.

    If you find that the EngineServer service is using more than 150 MB of memory (in other words, more than three instances of the Engine and DAT files), and this memory is not released after being idle for more than 30 seconds, you should install the hotfix attached to this article.

    Solution 1

    Install the hotfix attached to this article.

    The hotfix will be included in Patch 4 for VirusScan Enterprise 8.7i (expected to be released for general availability in July 2010).

    To receive email notification when this article is updated, click Subscribe at the top of the page. (You must be logged in at https://mysupport.mcafee.com to subscribe.)

    Solution 2

    This issue has been resolved with hotfix HF539488 for VirusScan Enterprise 8.7i.

    The Outlook UI library will now properly release the Engine instance on exit of Outlook.

    Workaround

    When EngineServer.exe's memory usage is high, restarting the service will reset the amount used.

    Attachments 1

    VSE870HF539488.Zip

    Release Notes for McAfee VirusScan Enterprise 8.7i HotFix 539488

    Thank you for using McAfee® VirusScan® Enterprise 8.7i. This document contains important information about this HotFix. We strongly recommend that you read the entire document.

    About this HotFix

    • This release was developed for use with:

      McAfee VirusScan Enterprise 8.7i Patch 3
    • Datestamp: 04-15-2010
    • Files affected:
      FilenameVersion
      OtlkUI.dll14.1.0.526

    Resolved issues

    Resolved issues in this release of the software are described below:

    1. Issue: The OutlookScan feature could fail to release an instance of the scan engine that was loaded via EngineServer.exe. This could lead to symptoms of EngineServer.exe using large amounts of memory, until the service was restarted. (Reference: 539488)
      Resolution: The Outlook UI library will now properly release the engine instance on exit of Outlook.

    Installation instructions

    Installation prerequisites

    • McAfee VirusScan Enterprise 8.7i Patch 3

    This article explains expected behavior for the EngineServer.exe service, which is new to VirusScan Enterprise (VSE) 8.7i.

    In the previous version (VSE 8.5i), scanner components ran inside the process they were protecting. This is also known as running "in-process." For example, EmailScan, providing scanning for Outlook, would cause the Outlook.exe process and memory space to load the Engine and DAT files, increasing its memory usage footprint significantly by adding the size of the DAT files and Engine.

    This design had a limitation. If the Engine and DAT files encountered a serious problem, it would impact the entire process, potentially causing the process to fail or stop responding. This would require restarting the application.

    VirusScan Enterprise 8.7i introduced EngineServer.exe, where the DATs and Engine are loaded to provide scanning services for scanner features (EmailScan, ScriptScan, and the Root-kit scan portion of On-Demand Scan). This is known as "out-of-process." The design solved the issue that resulted when the Engine and DATs encountered a problem.

    EngineServer.exe loads an instance of the engine for each scanner that is running, as described. To improve memory management, EngineServer.exe retains instances of the Engine and DAT files in memory only if there are active scan requests for the scanner using that instance. If idle for 30 seconds or more, that instance of the Engine and DAT files is released from memory. A new scan request for that scanner causes an instance to be loaded again.


    NOTE: When there are multiple instances of an application that uses a scanner (for example multiple instances of Outlook.exe) all instances share the same engine instance.

    Message was edited by: psolinski on 21/04/10 12:45:42 CEST

    Re: engineserver.exe memory leaks?

    I have several machines (WinXP Sp3) that are having this issue in our environment. I have noticed most of them are the older laptops that are still in use. We do not notice any issue with the dual core and higher laptops.

    We are running

    MA 4.5

    VSE 8.7i Patch 3

    I looked at the KB article that was posted this week. I downloaded the zip file and ran the EXE on my computer, to test and see what it does, before I release to production. I received an error, Product(s) already running the latest version of engine and DAT files. So i clicked OK and then that was it, the window closed.

    I will run this on one of the computers that is having this issue and test it, but has anyone else seen a positive outcome from this?

    What is the file actually updating. If I am already using the latest engine version, everyone else is as well, so not sure what value it will have to resolve this issue.

    rjo98
    Level 7
    Report Inappropriate Content
    Message 68 of 76

    Re: engineserver.exe memory leaks?

    Which KB article that was posted this week?  could you provide a link?

    As far as I know an engine update isn't going to fix this, which it sounds like you downloaded.  I still haven't seen patch 4 come out.  But on single core machine I've used (which is all of mine unfortunately), that registry hack mentioned above and that I posted about also has stopped the headaches for me so far.  The reason you don't see it on the multi-core machines is because it only ties up one core, leaving the other for normal work causing users not to notice it.

    Re: engineserver.exe memory leaks?

    I have applied the reg hack and it is still causing issues for a couple users.


    We have seen about 60% correction with the reg fix.

    Message was edited by: stmanser on 5/26/10 8:26:39 AM CDT
    rjo98
    Level 7
    Report Inappropriate Content
    Message 70 of 76

    Re: engineserver.exe memory leaks?

    Hmmm, what's different between the 60% it worked for and 40% it didn't work for?  Different hardware? Different software load?  Different VirusScan upgrade paths to 8.7p3?  That registry hack puts VirusScan on an even keel with other programs so it shouldn't be spiking the processor after that reg hack is applied and the VirusScan stuff is restarted.

    More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community