Using epolicy orchestrator 4.0 for medium size business. I have a number users with machines that have less than 1GB of memory who complain that once a day their machines slow to a crawl. The issue is with McAfee, but the times they give me do not correspond with any scheduled jobs. Can someone please provide some insight into what I need to look at? Does the agent to server communication interval need to be set at 60 minutes or can I change it to say 4 hours? What are the advantages/disadvantages?
Thank you in advance for any & all help!!!!
In the first instance I would look at the agent log on the client machine, and see if there is anything happening at the time the user reports the problem. Generally speaking the agent itself doesn't impact the machines, but obviously tasks spawned by the agent like updates and on-demand scans can...
Thanks for your input. We don't have any scheduled on-demand scans, but there are updates. I have attached the on access scan log & the activity log for a machine that experiences slow times, but I am not familiar enough with McAfee to decipher what exactluy is wrong.
A lot of people complain during the time period od 12:30 - 1:45... nothing is scheduled during this time other than updates.
Thanks for any help.
the log for signature updates and deployment tasks can be found in McScript.log under \Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db. Actually if the machine of your colleague slows down due to such tasks, this is the log that need to have a look at.
Also, scheduled scans have their logs in OnDemandScanLog.txt under the folder %DEFLOGDIR% (this variable has the path; just open a folder window and enter this in the address bar.)
Could you also post these here ?
I have attached the McScript.log...
There is no OnDemandScanLog.txt in the directory on this machine. Here are a list of files in the directory:
Thanks!!Message was edited by: dns-admin on 7/14/10 8:26:39 AM CDT
Unfortunately the agent log doesn't cover the timeframe we're interested in - it runs from 6pm to 8am (ish.)
The mcscript log shows an update task running at 12.15, which could conceivably have an impact - it only runs for three minutes, though, so I'm not sure if that's the culprit. (It's an all-products update by the look of it which means it might have been manually invoked by the user.)
You may need to implement some performance monitoring on these machines and find out what's happening...
Thanks for the input. The time frame that everyone complains about is 12:30 (ish) to about 1:45... not the entire time, but during that period. The uses don't have access to invoke anything, except an on-demand scan. I honestly just don't get what is going on. I have looked at the client tasks that have were set up prior to me & nothing correlates to the time frame that everyone complains about.
If I go to systems, My organization, client tasks, I see 3 tasks set up. Deployment, Update, & Default Update...the product name for each of these is McAfee Agent, all are enabled, all are daily, but the times are 12am, 5pm, & 4:30am. The update & default update tasks appeaer to be identical. Looking at the configuration of each, they both have selected packages of Engine & DAT. The only difference are the scheduled times.
Thanks for your assistance.