3 Replies Latest reply on Mar 26, 2010 12:14 PM by wwarren

    MFE NonPaged Pool Exchange 2003 cluster issue



      I'm having problems with the amount of nonpaged memory consumed by the process MFE0 as you can see in the attached image:



      This is causing our servers to failover, we have installed in our two node cluster the following:


      - McAfee VirusScan 8.7.0i patch 3

      - McAfee GroupShield v7.0.716.103


      Is there any known issue about this??


      Thanks in advance

        • 1. Re: MFE NonPaged Pool Exchange 2003 cluster issue

          Has your issue been resolved? I am not a product expert but I have moved your post to the VirusScan area in hopes that someone can help you, however this may require a support case.


          Have you tried searching our KnowledgeBase?

          • 2. Re: MFE NonPaged Pool Exchange 2003 cluster issue

            Hi, We manage to reducea little the amount of nonapged memory by the drivers upgrading to the latest versions available, but the consumption by the process MFE0 is still high.

            There's an entry realted at: https://kc.mcafee.com/corporate/index?page=content&id=KB54549, but we are unable to modify or create the registry hive decribed.


            Thanks for your reply!

            • 3. Re: MFE NonPaged Pool Exchange 2003 cluster issue



              Poolmon is a tool that is not very intuitive.

              From the screenshot you provided you imply there is an issue presented by that data, but in fact it does not show an issue.


              You might be looking at the first and second columns of the MFE0 tag and thinking OMG those numbers are huge!

              But they are harmless. They show the product has allocated tons of memory, and on the same hand freed tons of memory. That behavior is OK.


              The column you are interested in is the Bytes column. There you see MFE0 has only used 1.2mb of NPP memory. This is a very safe amount of memory usage.


              If you are actually experiencing NPP usage issues, and the operating system is telling you so via Event 2019 in your system event log, then using Poolmon is the right way to go about tracking down who is using that memory. You should be taking poolsnap captures over time, so you can observe any trends in the data and usage of NPP memory.

              An additional suggestion based on history and experience with these issues, be sure you are using VSE 8.7i Patch 2 or later, and also run Perfmon to monitor the Process object and Handle count. We are often the victim of a poorly behaving process that leaks handles to file objects.