1 2 Previous Next 10 Replies Latest reply on Nov 5, 2007 7:16 AM by molitorr

    VsTskMgr Eating Up Memory

    mmr4
      Hi All,

      I am an end user (not a sys admin) so I don't know exactly how VSE works, but I've had problems recently with the vstskmgr process grabbing a lot of memory (as much as 200MB) and holding on to it for a while (5-10 min). This happens several times a day during which time my laptop struggles and becomes a pain to work with.

      I've read some other posts about vstskmgr grabbing memory during the update process, but I'm not sure this is related. My IT department tells me that updates run automatically once a day (for me it's 2 PM which is another problem), and the memory problem occurs throughout the day. Other than that update period, this process is problematic without mcshield being a contributing factor (which it is during the update).

      Anyway, my IT support is stumped and says they know of no problems. Their solution was to uninstall/reisnstall VSE and the patch but that didn't work. They are now moving me to the head of the upgrade line and are going to give me a new PC.

      We're using VSE 8.5.0.781 with hotfix 1 (is that the same as patch 1?) and I have a 1.7 GHz Centrino laptop running WinXP Pro with 512 MB RAM (I hear that's low).

      Thanks for any thoughts or ideas. I'll pass them on to IT.

      Cheers,

      Mark
        • 1. RE: VsTskMgr Eating Up Memory
          twenden
          There is a hotfix that was not included in Patch 1 that fixes high cpu with that exe file. Have your IT dept search the McAfee knowledge base and they will find the hotfix which can be applied. The knowledge base article is 612309.

          Below is the information:

          Problem

          VsTskMgr.exe and McShield.exe cause high CPU usage during DAT Update [612309]

          Environment

          McAfee VirusScan Enterprise 8.5i
          Microsoft Windows


          Problem

          The following processes use up to 98% CPU (this generally lasts 4-8 minutes) during a local or ePO-managed AutoUpdate session:

          vstskmgr.exe
          mcshield.exe



          Change or Cause

          The McTaskManager service (vstskmgr.exe) is notified when virus definition (DAT) files are replaced. Vstskmgr.exe then notifies all scanner components to reload the DATs. The issue occurs when vstskmgr.exe receives multiple notifications that the DATs have been replaced, and attempts to reload the DATs for each the scanners.


          Solution


          This issue has been resolved with HotFix 320829, which is attached to this article.

          IMPORTANT: This HotFix is not included in VSE8.5i Patch 1. The HotFix should be installed post installation of Patch 1

          NOTE : After the HotFix is applied allow up to 15 second after a DAT update before verifying the DAT information has been populated throughout the product.
          For example, in About VirusScan Enterprise screen, an older DAT created on: date may be displayed for up to 15 seconds after an update.
          • 2. RE: VsTskMgr Eating Up Memory
            mmr4
            Thanks, I'll refer my IT to this KB article. I did see this but wasn't sure it was related because my problem seems to be memory utilization rather than CPU utilization and mcshield doesn't seem to be getting in the way.
            • 3. RE: VsTskMgr Eating Up Memory
              Hello

              We just deployed patch 3 to our 8.5i pilot users and I am getting similar reports now - the cpu usage of vstskmgr.exe seems normal, but its memory goes from under 1K to over 100Mb.

              I'm on the phone right now with Gold support and they have not heard of it before (but it is level 1 support thus far).

              Our vstskmgr.exe version is 8.5.0.857

              The ramp up in usage seems associated with some task activity. Here are snippets of log information from Agent_%computername%.log that were recorded during the high memory usage period:

              20071017075317 I #2228 Agent Sending the next batch of immediate events
              20071017075317 i #2228 Agent Agent is looking for events to upload
              20071017075317 I #2228 Agent Agent did not find any events to upload
              20071017075317 I #2228 naCmnLib Random seed = 0xfcd0****
              20071017075317 i #2228 Agent Agent uploading 2 events to ePO Server
              20071017075317 I #2228 Agent Agent did not find any events to upload
              20071017075317 I #1320 Agent Started processing a package..
              20071017075317 I #2228 naCmnLib Random seed = 0x98f9****
              20071017075317 i #2228 Agent Agent uploading 6 events to ePO Server
              20071017075317 i #1320 Agent Agent communication session started
              20071017075317 I #1320 naCmnLib Random seed = 0xfb5f****
              20071017075317 i #1320 Agent Agent is sending EVENT package to ePO server
              20071017075317 i #1320 Agent Agent is connecting to ePO server
              20071017075317 I #1320 InetMgr UploadFile/package to ePO Server: -->
              20071017075317 I #1320 InetMgr Connecting to site = ePO_UTIL017,
              20071017075317 I #1320 InetMgr Connecting to ePO Server using IP address: 172.26.250.156
              20071017075317 I #1320 InetMgr HTTP Session initialized
              20071017075317 I #1320 InetMgr Connecting to HTTP Server in socket-mode
              20071017075317 I #1320 InetMgr Connecting to Real Server: 172.26.250.156 on port: 80
              20071017075317 I #1320 InetMgr Connected to Real Server: 172.26.250.156 on port: 80. No Proxy used!
              20071017075317 I #1320 InetMgr Uploading package to ePO Server...trial 1 / 6
              20071017075317 I #1320 InetMgr Uploading file C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Unpack\pkg00128371027973050000_9980.spkg to ePO Server...
              20071017075317 I #1320 InetMgr Connecting to Real Server: 172.26.250.156 on port: 80
              20071017075317 I #1320 InetMgr Connected to ePO Server: 172.26.250.156
              20071017075317 I #1320 InetMgr Uploading SPIPE HTTP header
              20071017075317 I #1320 InetMgr Uploading data in bytes: 1190
              20071017075317 I #1320 InetMgr Reading acknowledgement from ePO Server
              20071017075317 I #1320 InetMgr No package to receive from ePO Server, HTTP return code: HTTP/1.1 202 OK

              20071017075317 I #1320 InetMgr
              20071017075317 I #1320 InetMgr Downloading a file of total size: 0, content-length: 0
              20071017075317 I #1320 InetMgr Received response [202] from ePO Server
              20071017075317 I #1320 InetMgr client:no package to receive
              20071017075317 I #1320 InetMgr Uploaded file : C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Unpack\pkg00128371027973050000_9980.spkg to Server successfully
              20071017075317 i #1320 InetMgr Upload success and no package to receive
              20071017075317 I #1320 InetMgr HTTP Session closed
              20071017075317 I #1320 InetMgr ------------------------------------------------------------
              20071017075317 I #1320 InetMgr Adding site ePO_UTIL017 to failover list.
              20071017075317 I #1320 InetMgr After calling UploadFileResponse()
              20071017075317 i #1320 Agent No package received from ePO Server
              20071017075317 i #1320 Agent Agent communication session closed
              20071017075317 I #1320 Agent Started processing a package..
              20071017075317 i #1320 Agent Agent communication session started
              20071017075317 I #1320 naCmnLib Random seed = 0x0aa1****
              20071017075317 i #1320 Agent Agent is sending EVENT package to ePO server
              20071017075317 i #1320 Agent Agent is connecting to ePO server
              20071017075317 I #1320 InetMgr UploadFile/package to ePO Server: -->
              20071017075317 I #1320 InetMgr Connecting to site = ePO_UTIL017,
              20071017075317 I #1320 InetMgr Connecting to ePO Server using IP address: 172.26.250.156
              20071017075317 I #1320 InetMgr HTTP Session initialized
              20071017075317 I #1320 InetMgr Connecting to HTTP Server in socket-mode
              20071017075317 I #1320 InetMgr Connecting to Real Server: 172.26.250.156 on port: 80
              20071017075317 I #1320 InetMgr Connected to Real Server: 172.26.250.156 on port: 80. No Proxy used!
              20071017075317 I #1320 InetMgr Uploading package to ePO Server...trial 1 / 6
              20071017075317 I #1320 InetMgr Uploading file C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Unpack\pkg00128371027973360000_1431.spkg to ePO Server...
              20071017075317 I #1320 InetMgr Connecting to Real Server: 172.26.250.156 on port: 80
              20071017075317 I #1320 InetMgr Connected to ePO Server: 172.26.250.156
              20071017075317 I #1320 InetMgr Uploading SPIPE HTTP header
              20071017075317 I #1320 InetMgr Uploading data in bytes: 1118
              20071017075317 I #1320 InetMgr Reading acknowledgement from ePO Server
              20071017075318 I #1320 InetMgr No package to receive from ePO Server, HTTP return code: HTTP/1.1 202 OK

              20071017075318 I #1320 InetMgr
              20071017075318 I #1320 InetMgr Downloading a file of total size: 0, content-length: 0
              20071017075318 I #1320 InetMgr Received response [202] from ePO Server
              20071017075318 I #1320 InetMgr client:no package to receive
              20071017075318 I #1320 InetMgr Uploaded file : C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Unpack\pkg00128371027973360000_1431.spkg to Server successfully
              20071017075318 i #1320 InetMgr Upload success and no package to receive
              20071017075318 I #1320 InetMgr HTTP Session closed
              20071017075318 I #1320 InetMgr ------------------------------------------------------------
              20071017075318 I #1320 InetMgr Adding site ePO_UTIL017 to failover list.
              20071017075318 I #1320 InetMgr After calling UploadFileResponse()
              20071017075318 i #1320 Agent No package received from ePO Server
              20071017075318 i #1320 Agent Agent communication session closed
              20071017075318 i #1320 Agent Agent will connect to the ePO Server in 110 minutes and 0 seconds.
              20071017075458 I #3184 FrmSvc User SID is S-1-5-18 and SessionID is 0
              20071017075458 I #2400 Agent Forward immediate events request received
              20071017075458 I #2400 Agent Ignoring request, will try in 318 seconds
              • 4. High memory usage
                Hi

                We are about to install patch 3 for VSE 8.5i

                Currently we are experiencing problems with several machines running vstskmgr.exe with 118 Mb of memory.

                Has this been sorted out?
                Is there a work around?

                A lot of the systems in my environment are basic systems with the minimum amount of memory they can fit within them. This causes problems when processes unjustly holds onto memory.
                • 5. RE: High memory usage
                  I still have an open case with support on this. We have not made much progress on it. I'm going to try patch 4 when it comes out this week but I have my doubts it will help, since the read me file for it doesn't mention this.
                  • 6. RE: High memory usage
                    Please download this patch 612309_fVSE85HF320829.zip . i also meet this case ago.

                    Goodluck!
                    Thangvt.
                    • 7. RE: High memory usage
                      Thanks for the tip but we have been running that fix and still have the memory problem before patch 3. That fix is rolled into patch 3, which we deployed and still have the issue afterwards as well.

                      Our problem is that on only a few PC's, this process goes from under 1MB memory use to over 100MB use in a few minutes, then goes back down to under 1MB. The CPU activity is not present that this other hotfix addresses. Its a memory bloat, and only happens on a few machines.

                      It does seem to happen in the mornings only, after a new logon. We have not found a way to duplicate the conditions.
                      • 8. Same Problem as you
                        bspies;
                        Just found your issue while doing a search. We are having the same issue here. I've tried the hotfix, and Patch 3. We currently see the issue on three machines, or at least I have three persistent complaints about the issue.
                        The process races up and eats most of the resources about every five minutes. VSTSKMGR.EXE is currently the culprit and is most active when people are using IE, but it is the same exact issue you reported. If I can assist support with submitting some files, I'm certainly willing.

                        Tom
                        • 9. RE: Same Problem as you
                          Tech support has asked me for this:

                          1- Please ensure you have rebooted after installing patch 3.
                          2- Please obtain Process monitor with advanced output and reproduce the issue
                          3- Launch Perfmon, Right click within the graph chart on the right hand side and add counters *Process - All counters, and all instances *Memory
                          - All counters
                          4- Allow this to run for 3-5 minutes, Then right click and save as a *.tsv file
                          5- If you are using the latest Microsoft Windows Installer, on one machine can you remove Patch 3 and reboot? Does the issue still happen after a reboot, and are you able to reproduce?
                          6- What other scenarios do you see this happen on? Right now you have stated it is when you access the control panel. Is there anything else?


                          I have done 1 and 5. I have not been able to do 2/3/4 and 6 because I don't know what triggers it, and it isn't happening on my own PC. I have setup Perfmon Counter Logs so my problem machines log this data all day but, they don't accept that. I have complained about this and asked for options, and have not heard back from them. I have been trying to escalate this problem with our local McAfee reps but they still want this information I can't really give them.

                          If you could log a call with support on your end this might help speed things along. If you want to could reference my case, 1-317322180.
                          1 2 Previous Next