7 Replies Latest reply on Feb 2, 2010 9:00 AM by runcmd

    "McScript_InUse.exe" CPU Utilization on VSE 8.7 / MA v4.5

    runcmd

      Is anyone else seeing high CPU utilization by the "McScript_InUse.exe" process with VSE 8.7 and MA 4.5?  I experienced similar issues with this on MA 3.5 and VSE 8.0i in the past, prior to our upgrade, but recently I've received complaints from our PC Technicians that the "McScript_InUse.exe" process is causing performance issues on workstations again.  Initially, I believed it to be occurring only while the update task was running but that does not appear to be the case (or at least not always the case).  I had an incident, yesterday, where the issue was reported and the UpdateLog does not show an update as occurring at that time.  I also checked the OnAccessScanLog and don't see anything detected at the time.  I have included an Agent Log entry of interest from this timeframe, below in green, which may or may not be related as I'm not sure what it means.  I have been unable to reproduce the problem on my own computer, even when forcing an update; however, I have several reports of computers experiencing this problem--on various hardware (laptops, tablets, and desktops) and various platforms (Windows XP & Windows 7).  Because the problem is intermittent and I'm having difficulty reproducing it, at this point I'm speculating as to the cause.  As I am able to perform more testing and collect additional information, I'll be sure to provide an update.  I have not tried the old "LowerWorkingThreadPriority" registry hack yet because I don't believe that I have all the facts and I don't know the information in the older KB article is only supposed to apply to MA 3.6/P1.  Thanks!

       

      Related Forum Thread:

      http://community.mcafee.com/thread/8741

       

      KB Article of Interest:
      MA 3.6/P1 - KB53690

       

      Agent log entries of interest:
      2010-01-14 10:33:42 i  #1924  Sched  Scheduler: Invoking task [Deploy VirusScan 8.7]...
      2010-01-14 10:33:42  I  #11240  Sched  >>--RunTask
      2010-01-14 10:33:42  I  #11240  Manage  Running task SoftwareID:EPOAGENT3000, TaskID:21
      2010-01-14 10:33:42  I  #7340  FrmSvc  User SID is X-N-N-NN and SessionID is 0
      2010-01-14 10:33:42  I  #7452  UpdEvents  Initializing Event Interface
      2010-01-14 10:33:42  I  #7452  UpdEvents  EpoEventInf Interface: Initialization succeeded.
      2010-01-14 10:33:42  I  #5440  Uec  Waiting for ipc thread to initialize
      2010-01-14 10:33:42  I  #11276  ipcchannel  Initializing IPC server
      2010-01-14 10:33:42  I  #11276  Uec  Initialized ipc channel successfully
      2010-01-14 10:33:42  I  #5440  Uec  Ipc thread initialized successfully
      2010-01-14 10:33:42  I  #5440  Uec  Invoking Mue with "C:\Program Files (x86)\McAfee\Common Framework\McScript_InUse.exe"  -script "C:\ProgramData\McAfee\Common Framework\InstallMain.McS" -id 21877 -localeid 0409 -parent FRAMEWORK -logfile "C:\ProgramData\McAfee\Common Framework\DB\McScript" -initiator 4 -ipcid "
      \\.\pipe\upda05440" -installdir "C:\Program Files (x86)\McAfee\Common Framework"
      2010-01-14 10:33:42  I  #7452  deploy  Deployment session started.
      2010-01-14 10:33:42  I  #11240  Sched  <<--RunTask
      2010-01-14 10:33:42  I  #1924  Sched  Deploy VirusScan 8.7 - Last run time(local) is Thu Jan 14 10:33:42 2010
      2010-01-14 10:33:42  I  #1924  Sched 
      2010-01-14 10:33:42  I  #1924  Sched  End of invoking the task
      2010-01-14 10:33:42  I  #11276  Uec  Received ipc data from mue
      2010-01-14 10:33:42  I  #11276  Uec  Processing progress information
      2010-01-14 10:33:42  i  #11276  Updater  Checking update packages from repository ePO_[MyEpo].
      2010-01-14 10:33:42  I  #11276  Uec  Done processing progress information
      2010-01-14 10:33:42  I  #11276  Uec  Received ipc data from mue
      2010-01-14 10:33:42  I  #11276  Uec  Processing progress information
      2010-01-14 10:33:42  i  #11276  Updater  Initializing update...
      2010-01-14 10:33:42  I  #11276  Uec  Done processing progress information
      2010-01-14 10:33:42  I  #11276  Uec  Received ipc data from mue
      2010-01-14 10:33:42  I  #11276  Uec  Processing progress information
      2010-01-14 10:33:42  i  #11276  Updater  Verifying catalog.z.
      2010-01-14 10:33:42  I  #11276  Uec  Done processing progress information
      2010-01-14 10:33:42  I  #11276  Uec  Received ipc data from mue
      2010-01-14 10:33:42  I  #11276  Uec  Processing progress information
      2010-01-14 10:33:42  i  #11276  Updater  Extracting catalog.z.
      2010-01-14 10:33:42  I  #11276  Uec  Done processing progress information
      2010-01-14 10:33:42  I  #11276  Uec  Received ipc data from mue
      2010-01-14 10:33:42  I  #11276  Uec  Processing progress information
      2010-01-14 10:33:42  i  #11276  Updater  Loading update configuration from: catalog.xml
      2010-01-14 10:33:42  I  #11276  Uec  Done processing progress information
      2010-01-14 10:33:42  I  #1920  Sched  The task Deploy VirusScan 8.7 is still running

       

       

      Message was edited by: runcmd on 1/15/10 1:58:28 PM EST
        • 1. Re: "McScript_InUse.exe" CPU Utilization on VSE 8.7 / MA v4.5
          psolinski

          We experience McScript_InUse.exe high CPU Utilization issue on both ePO 3.6.1 system with MA4.0 + VS8.5p8 or VS8.7p2, and on our new ePO4.5p1 with MA4.5 + VS8.7p2.

           

          On PC with  P4 2.80GHz and 1GB RAM it takes ~100 seconds when CPU spikes to 100%, and RAM used by the VS to ~200MB.

          On PC with 512MB RAM (we still have a couple hundred of them) it takes.... ~20 minutes, due to intensive paging.

           

          My impression after upgrade from epo361 ma40 to ePO4.5 MA4.5 is that epo/ma 4.5 handle DAT updates in smoother way, anyway it's still noticeable.

          • 2. Re: "McScript_InUse.exe" CPU Utilization on VSE 8.7 / MA v4.5
            wwarren

            Suggest implementing the following -

             

            KB53690 CPU usage spikes during policy enforcement and a DAT update

            • 3. Re: "McScript_InUse.exe" CPU Utilization on VSE 8.7 / MA v4.5
              psolinski

              Thanks William,

               

              We already use LowerWorkingThreadPriority and it doesn't really help.

               

              We don't use NoUpdaterUI

              Does NoUpdaterUI=1 disable the Agent Icon in system tray? What it does?

               

               

              Why both options cannot be ePO controlled????

               

               

              on 18/01/10 23:14:25 GMT+01:00
              • 4. Re: "McScript_InUse.exe" CPU Utilization on VSE 8.7 / MA v4.5
                wwarren

                If still an issue you might be best served working with McAfee Support a little closer.

                Use Perfmon to help present your situation, capturing the Process object (all counters, all instances for simplicity sake) during the hour in which an update occurs.

                This will include the CPU usage per process during the update cycle.

                The MER data collection tool will collect the registry info to let Support verify the thread priority tweak is in place.

                Other tweaks are likely warranted, though bare in mind, the thread priority tweak is not meant to reduce CPU usage if the system is idle. It's meant to reduce noticeability of the update occurring when a user is actively working with the system.

                 

                NoUpdaterUI=1 does not affect the Agent icon... at least I don't think it does for MA4.0 or later UpdaterUI should be controlling dialog progress windows for a user-invoked update. McTray.exe controls the icon now.

                 

                Totally agree on the ePO control. It's a long-standing gripe. There is work being done to allow central management of all things registry-related - I've seen the prototype, and it worked great. I'm not privy to when it will release, or if it will release for that matter. Lots of concern about people shooting themselves in the foot, much like you can (and a handful of people have) with Access Protection.

                • 5. Re: "McScript_InUse.exe" CPU Utilization on VSE 8.7 / MA v4.5
                  psolinski

                  AFAIK NoUpdaterUI=1 does remove the icon, that's the reason we dont want to use it.

                   

                   

                  Corporate KnowledgeBase ID:    KB66073
                  Published:    June 16, 2009

                   

                  Categories:
                  McAfee Agent 4.0


                  Environment
                  For details of all supported operating systems, see KB51109
                  Problem 1
                  If you run cmdagent /s from a command line on a client, you see the following error:

                  Failed to send command to ePO Agent
                  Problem 2
                  The McAfee Agent system tray icon does is not dispalyed on the client , although the agent policy is set correctly in ePolicy Orchestrator (ePO).

                  Policies for all installed McAfee products are correctly enforced on the affected client computer. This can be verified by reviewing the agent_<computername>.log on the client computer. If an Agent Wakeup Call is sent and policy enforcement takes place, no errors are reported in the agent_<computername>.log.
                  System Change
                  A DWORD NoUpdaterUI entry was set / added in the registry under the following key:

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator]
                  Cause
                  The DWORD NoUpdaterUI value is set to 1 in the registry of the affected computer in the following key:

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator]
                  Solution
                  Remove the added DWORD value entry and restart the Framework Service:

                  • 6. Re: "McScript_InUse.exe" CPU Utilization on VSE 8.7 / MA v4.5
                    wwarren

                    As best I can tell, that article applies to the 3.6.x versions and earlier only.

                    • 7. Re: "McScript_InUse.exe" CPU Utilization on VSE 8.7 / MA v4.5
                      runcmd

                      Upon further investigation, I have been unable to firmly establish that the reported performance issues in my environment are associated with the "McScript_InUse.exe" process.  I am unable to reproduce the problem in a lab environment or on the computers where the problem was reported.  To-date the reported issues have been narrowed to a variety of non-McAfee related issues: (1) A problem with Windows' Client Side Caching--Because the OAS was scanning the files that CSC was synchronizing, McAfee was believed to be the problem.  (2) A bad processor fan that resulted in an overheating CPU.

                       

                      Unless more damning evidence against the "McScript_InUse.exe" comes to light, I believe that it has been exonerated in my case.  That said, I have checked the box to "Disable default AutoUpdate task schedule" on my global policy and am now allowing only the ePO scheduled task to perform client updates in order to avoid duplicate update attempts.  Additional information on my update changes is available in this thread:  http://community.mcafee.com/thread/21093