5 Replies Latest reply on Jun 15, 2010 2:44 AM by Attila Polinger

    VSE 8.5p8 crippeling W2K3 without high CPU Load

      Hi,

       

      lately we have a strange behaviour on 3 W2K3 servers. The System respond more or less in slow montion but Mcshield or any other McAfee related process shows no significant CPU Load or Memory Usage. In the application Log there are 5051 events stating that Mcshield used more then 90000 ms to scan some file.


      As soon i disable the McAfee Services the machine runs smooth again. but this happens only on 3 out of 300+ similar configured Servers (so far).

       

      System Setup:

       

      W2k3 SP2

      2 GB Ram

      2 core Xeon 2.4 Ghz

      VirusScan Enterprise 8.5.0.781.Srv

      McAfee Agent 4.0.0.1494

       

       

       

      I hope somebody can give me a hint how to fix that problem.

       

      Thanks,

       

      Norbert

       

      PS: When i check the Virusscanners i've noticed a difference. The about Box shows not correctly on the systems that are affected (see Screenshots)

       

       

      Nachricht geändert durch nkowallik on 10.06.10 03:44:27 CDT
        • 1. Re: VSE 8.5p8 crippeling W2K3 without high CPU Load
          jmcleish

          Hi Norbert,

           

          Do these servers running any  applications - i.e. SQL, Exchange etc.

           

          What file does  it have problems scanning?

           

          Are there any other similar  entries in the on-access scan log that suggest something is having problems?

           

          Regards

          Jane

          • 2. Re: VSE 8.5p8 crippeling W2K3 without high CPU Load

            Hi,

             

            there are applications running (including databases) but these Paths are excluded from scanning. The Timout errors occur on basicly random Files. Some dlls in system32 , nothing that points out.

             

            Regards,

            Norbert

            • 3. Re: VSE 8.5p8 crippeling W2K3 without high CPU Load

              I've seen those same problems with the about screen though I'm not sure if that indicates a corrupt VSE install or not.  Have you tried uninstall/reboot/reinstall yet on any of these three systems to see if that resolves the issue?  It may be worth a shot if it's a corrupted installation.

               

              Andrew

              • 4. Re: VSE 8.5p8 crippeling W2K3 without high CPU Load
                wwarren
                In the application Log there are 5051 events stating that Mcshield used more then 90000 ms to scan some file.


                Timeout events should not be ignored (unless you were expecting them). There are 2 kinds of timeouts, graceful and fatal.

                They both mean that a file has gone unscanned, but the latter also means the scanner had to self-terminate in order to abort the scan.

                 

                These events should be investigated and understood why they are occurring, especially if occurring in numbers that suggest it's frequent, or if found to be from touching the same filename.

                 

                 

                The About screen anomaly means we failed to pull the proper text strings from our strings binary. This is cosmetic. You can close and open the window again without issue. It would be "curious" to find there is a relationship between timeouts occurring and the About window displaying like that.

                • 5. Re: VSE 8.5p8 crippeling W2K3 without high CPU Load
                  Attila Polinger

                  Hi,

                   

                  just a tip: please use a File Monitor application to see what file is that VSE could be scanning at time of slowdown...

                   

                  Attila