We are currently trying to fix a few hundred systems where a McAfee Access Protection custom rule has broken the Agent commnication. McAfee gave us an automated script to fix this issue. However, the clients when fixed will send hundreds/thousands of events back to the EPO server. When this happens we noticed that the EPO server become very slow causing the console dashboard to be non-responsive. When I looked at the task manager, I noticed that the Eventparser & Mcshield were both consuming about 50% CPU each.
I have tried adding the eventparser to the McAfee exclusions but McShield still continues to scan at a high CPU rate. Has anyone else seen this on their EPO server and know what exclusions I need to use.