KB70009 ( https://mysupport.mcafee.com/eservice/Article.aspx?id=KB70009 ) has just been published:
When the ePO server is unavailable or unreachable, and an Agent-to-Server Connection Interval (ASCI) is attempted on a client computer, the frameworkservice.exe process starts using 95-100% CPU. The high CPU continues until you stop the frameworkservice.exe process. This does not occur in all environments and is specific to the McAfee Agent 126.96.36.1999 (Patch 1) build.
There are not Agent log entries at this time that will definitively qualify the issue.
When the agent attempts to ping an inaccessible Distributed Repository during processing of the SiteList.xml, the frameworkservice.exe process starts using 95-100% CPU. The high CPU continues until you stop the frameworkservice.exe process. This does not occur in all environments and is specific to the McAfee Agent 188.8.131.529 (Patch 1) build.
The Agent log shows the processing of SiteList.xml. When it locates the offending repository, SiteList processing stops and no further logging related to the SiteList.xml is present. CPU usage elevates at this point:
2010-09-16 12:14:17 I #3176 imsite Connecting to site = TestSite
2010-09-16 12:14:17 I #3176 imsite Site = Testsite.mcafee.com
2010-09-16 12:14:28 I #1952 Manage Loading plugin list from registry
2010-09-16 12:28:29 i #3728 Sched Scheduler: Invoking task [ePO_Update]...
If you experience these symptoms, contact McAfee Technical Support and quote this article number.
Once the appropriate data has been collected, implement the Workaround shown below to restore normal operations until a code based solution can be provided.
- Minimum Escalation Requirements (MER) files for your specific product. For Information on downloading the MERs for each McAfee product, see KB59385
- Other files/logs as requested by Technical Support.
In addition to the files above, please provide the following data:
- Affected Node Count
- Any information on the events that occurred immediately before the high CPU was noticed (for example, ePO server outage or network outage)
- Confirmation that this occurs only with the McAfee Agent 184.108.40.2069 (Patch 1) build
- Screenshots showing the CPU usage for the Frameworkservice.exe
Terminate the Frameworkservice.exe on the affected computer and downgrade to one of the following agent versions until a code based solution can be provided:
- McAfee Agent 4.5.0 RTW (220.127.116.110)
- McAfee Agent 4.0 Patch 3 (18.104.22.1684)