cancel
Showing results for 
Search instead for 
Did you mean: 
intenz
Level 9
Report Inappropriate Content
Message 1 of 12

EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

In the last two weeks we upgrade two EPO 4.6 servers to version 5.0. No issues during the migration except for some know problems with AD syncronization. A day after the migration we started noticing that Tomcat was using almost 100% CPU on both servers. The memory utilization has also increased.

Has anyone encountered a high CPU load with tomcat7.exe?!

11 Replies
alexn
Level 14
Report Inappropriate Content
Message 2 of 12

Re: EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

Hi,

Do you have VSE installed on these servers? if yes then latest version of VSE does not exclude tomcat7.exe process because epo 5 is launched with tomcat7 version, SO you need to manaually exclude it .

As far as synchronization task is concerend please follow this thread.

https://community.mcafee.com/message/290208#290208

Alexn

intenz
Level 9
Report Inappropriate Content
Message 3 of 12

Re: EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

Hi,

That might be it. Do you recall in which policy the tomcat7.exe should be excluded? I configured the tomcat7.exe as a low risk process. I recall excluding the EPO server services was in the EPO best practice guide.

Jorge

Message was edited by: intenz on 5/24/13 4:45:38 PM IST
samd
Level 9
Report Inappropriate Content
Message 4 of 12

Re: EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

I haven't excluded any processes including the ePO processes and so far no 100%

You do however have to exclude tomcat7.exe from the mass mailing thing in Access Protection as tomcat7.exe is not automatically in there and tomcat7.exe is the process that sends emails if say you set it up that a server task fails and you want an email notification.

alexn
Level 14
Report Inappropriate Content
Message 5 of 12

Re: EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

Reason why  i am excluding this because tomcate.exe is not only resposible for email notification but also provides the most tangible services of the ePO core components. It provides the front end of the user interface for management tasks and standardized database interface. The Application Server (tomcat)handles the ePO application features such as system tree organization, user management, policy management, dashboards and more. The Application server also runs the automaticresponsesystem and the supports the interactions between endpoints and ePO via extensions. Extensions are zip files installed on the ePO server that contain the static files necessary for ePO to manage other endpoint security products. For example, VirusScan, NetworkAccess Control (NAC), and Host IPS, all have ePO extensions. Inaddition, registered server types are added using extensions. Once the registered server types are added, users are able to register their servers.Finally the Application Server has the Rogue Sensor System that communicates with the Rogue Sensor to detect and report on unmanaged systems.

Thanks

Alexn

Message was edited by: alexn on 5/24/13 4:51:33 PM CDT
intenz
Level 9
Report Inappropriate Content
Message 6 of 12

Re: EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

Hi,

Thank you all for your feedback. The scan exclusions seem to have helped a bit but don't seem to fix the whole problem. Tomcat continues to generate a heavy load on the server. I have been looking at the stderr.log and orion.log and i have noticed some errors in regards to the Java Head Space. The server has enough memory and is doing a 80% max utilization.

These are the errors:

I am error

Exception in thread "http-bio-8444-Acceptor-0" java.lang.OutOfMemoryError: Java heap space

I am error

I am error

I am error

I am error

I am error

On the Mcafee knowledge base i only found one article refering to this error. The article described this as being a problem in version 4.x.

https://kc.mcafee.com/corporate/index?page=content&id=KB71516

Has anyone run into this error?

alexn
Level 14
Report Inappropriate Content
Message 7 of 12

Re: EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

I 'd suggest that if your Java memory pool value is 1024 in Registery then wait for ePO 5.0 Patch. I am sure it will be fixed in that.

intenz
Level 9
Report Inappropriate Content
Message 8 of 12

Re: EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

I have lowered the Max Java memory pool to 1024 but it does not seem to make a diference. Still having the same error. Tomcat 7 does seem to come with a 2048 max value after instalation. I think this was 1024 in EPO 4.x.

alexn
Level 14
Report Inappropriate Content
Message 9 of 12

Re: EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

Correct for tomcat7.Java memory pool was increased, but it is causing problem like yours and as according to this KB "issue is being investigated.You may set it back to 2048 value.Be in touch with community and very soon HF or  patch one will be available.

intenz
Level 9
Report Inappropriate Content
Message 10 of 12

Re: EPO 5 : Tomcat 7 CPU 100% on two different Windows 2008 R2 Servers

Hi Alex,

Thanks for the feedback. Which Kb are you refering too. The one i posted is related to an identified issue in EPO 4.x in 2012. Do you have another KB refering to this type of problem? This is becoming a real issue and i dont think i can hold off much longer without opening a support call.

Thanks.

Jorge