Anti Malware engine overload intermittently ?

[mekafir]

Hi People,

Can anyone here please share some tips and the explanation as to why my McAfee Web Gateway server is always overloaded intemittently ?

I don't receive any email alert so it broke the internet conenction in production environment. How to configure it ?

[trevorw2000 · Accepted solution]

How much RAM does your server or VM have and what version of the Web Gateway are you running.  If you're running version 7.5 or higher keep in mind that the Anti-Malware engine was converted to a 64-bit process and as such memory requirements have changed.  We had to bump ours to 16GB to avoid that error.  16GB is now the minimum recommended for a VM in production.  We have less than 500 users and I can say that it uses about 12GB on average.

More details here:

[mekafir]

Hi Trevor, I'm using the MWG v7.5.2.5 hardware appliance So below is the result:

[root@PRODWEBPROXY01 ~]# free -g
             total       used       free     shared    buffers     cached
Mem:            94         93          1          0          7         67
-/+ buffers/cache:         18         75
Swap:           15          0         15

At the moment it is used by approximately 5000 users.

[trevorw2000]

Interesting.  You've got 94GB of RAM.  I'm not sure how that scales on a physical appliance for that many users but you're not using any swap space.

I would open up a ticket with support.  If you want to get a head start you can go ahead and create a feedback file and attach it to the ticket when you open it.  They're going to ask for it anyway.

You can read more about creating the feedback file here:  https://kc.mcafee.com/corporate/index?page=content&id=KB63289

[mekafir]

yeah that's what I thought so...

I'll raise the ticket to the McAfee team, but so far the work around is to restart the service by using the command line through Putty.