Showing results for 
Search instead for 
Did you mean: 

Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

It takes about 1-15 minutes to save an IPS Rules policy on our ePO server.  It is running 4.5 patch 6 on SQL 2008 R2 on 2008 Server R2.

Saving any other policy is fine.

How best can we troubleshoot this problem?  Any input is appreciated.

7 Replies

Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

Has this been resolved or are you still waiting for feedback?

Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

It is very slow with HIPS 8.0 P2 and latest extensions when running ePO 4.6 P4.  When making IPS exceptions it can take 2-4 minutes.  When saving the policy it can take up to 5 min.   Seems to be related to number of exceptions in the policy.   Once they get past about 5 things go downhill.

Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

I'm glad I'm not the only one with this issue, ePO 4.5 patch 5 and ours takes around 10-15 minutes to save. I do have a large number of bespoke signatures but not 1000's!

Another 'feature of the product'


Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

I have had ticket open with Platinum support for almost two weeks now.   It is going nowhere.   Saving of IPS rules takes well over two minutes.   Even Firewall rules are taking much longer than before.  The ePO server itself is not overly busy,  but the problem appears to be on the SQL server side.  Our lead DBA tells me they see blocks being put on transactions when I try to save HIPS rules.  It appears trying to save the rule puts a block on the processing of routine client updates.  Then waits for those in process to clear, and then does it processing and saving.   In looking at the ePO counters on the ePO server the number of client requests processed goes to zero.   The number of open client connections zooms up, many times hitting the 244 max.  CPU activity spurts for a few seconds as client connections go up.  Then client requests start getting processed again and the number of connections returns to normal. 

    2 minutes to create an exception from an event, and then another 2-3 minutes to edit save the rule makes working with HIPS a problem.   And some of the new rules with HIPS 8.0 P2 need LOTS of tuning.

Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

Let's hope it gets fixed, we've learned to live with it........................amend for coffee (and maybe lunch)!



Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

Just heard from support.  "it is running as expected"   If you have a large number of rules it will take awhile.   I have been timing things this afternoon.  I have done at least 8 saves between creating new exceptions from events and editing the actual polcy.  Typical time to save 3 min 15 sec.  Best time 1:59 Sec.  I have wasted close to a 1/2 hour just today.

If buffer overflow rules 985 and 6032 were not tripping on well known MS products all the time for all kinds of different reasons I could get rid of close to 40 rules.

I was also advised to put in a Product Enhansement Request.   The black hole of ideas.



Level 10
Report Inappropriate Content
Message 8 of 8

Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

Same problem at my site.  We had serious issues on 4.5 MR4 and were told to wait until MR5 then all would be good.

It's just as bad on MR5.  Edit policy, no problem.  Save policy, wait 20 mins, screen timeout, click ok, wait 20 more mins, get logged out.  !@^#@!$^!@^$@

This is ridiculous.

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community