cancel
Showing results for 
Search instead for 
Did you mean: 
krobin
Level 7
Report Inappropriate Content
Message 1 of 19

Memory leak with Agent 5.6.3.157

We have been investigating an issue with all servers (2012 r2 and 2016) and - as we found out later - all workstations (windows 10 1809).

Issue:
The stations were maxing out memory and we noticed a large number of handles for system.

Consequence:
Servers had to be restarted daily.
Workstations are shut down every night anyway by policy, so that was clearing the memory for them.

Fix:
After much investigation, we found out that removing the McAfee Agent fixed the problem. keeping Mcafee VSE is fine as long as the agent is removed.

Where do I go from there?

18 Replies
hem McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 19

Re: Memory leak with Agent 5.6.3.157

Out of MA, we need to investigate which process is causing the leak and have to investigate accordingly.

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?please select Accept as Solution in my reply and together we can help other members?
cdinet McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 19

Re: Memory leak with Agent 5.6.3.157

KB86691 has a section in it for gathering data for memory leaks.  Disregard that the KB says ENS, it is applicable for other processes too.  Please gather that data along with an associated mer and open a ticket with McAfee.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

krobin
Level 7
Report Inappropriate Content
Message 4 of 19

Re: Memory leak with Agent 5.6.3.157

I exported an AMTRACE log (see attachment) but the issue is that I can't shutdown the Agent and restart it during this process as closing the app is blocked.

Of note, if you see the agent can't communicate with EPO that's normal as the EPO is off. I started this investigation by switching EPO off, that didn't solve it. Uninstalling the agent did.

On this station the system handle count is 1921034.
Memory usage is at at 67% (high but not quite at the point of collapse).

Highlighted
cdinet McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 19

Re: Memory leak with Agent 5.6.3.157

Please open a ticket and get all the data required for memory leak in that KB, as any memory leak issues have to go to dev.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

TyWebb
Level 7
Report Inappropriate Content
Message 6 of 19

Re: Memory leak with Agent 5.6.3.157

We are running the same agent version with ENS and are seeing very similar behavior across servers and workstations.  Was there a solution to this?

cdinet McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 19

Re: Memory leak with Agent 5.6.3.157

What specific process is running high memory?

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

TyWebb
Level 7
Report Inappropriate Content
Message 8 of 19

Re: Memory leak with Agent 5.6.3.157

We are not seeing high usage on any one service using task manager which is why we think its a memory leak. Mcshield is slightly higher than normal but not by much.  Our issue is when an on demand scan runs our servers slowly start to run out of memory until they become unresponsive and we have to reboot.  The displayed memory usage for the server that we see in task manager doesn't match what we are seeing using in SolarWinds which we use to monitor our servers.  Our desktop people are seeing similar issues.

 

cdinet McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 9 of 19

Re: Memory leak with Agent 5.6.3.157

If there is a memory leak, one specific process should be showing a consistent increase in memory usage.  You might need to use perfmon to capture memory usage on all processes to catch it over several time frames.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

TyWebb
Level 7
Report Inappropriate Content
Message 10 of 19

Re: Memory leak with Agent 5.6.3.157

I used poolmon.exe to check for the memory leak and I think the leak is coming from the system pool tags SeTl an MFE0.

We have a case open with both MS and Mcafee and are not getting anywhere and continuing to have to cancel our on demand scans or reboot our servers when they are run.  If there was a solution to the previous users issue I'd be interested in knowing how they fixed it.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community