4 Replies Latest reply on Nov 7, 2011 7:45 AM by rackroyd

    Mscript_inuse.exe high CPU usage

      Recently on many of our machines which require a lot of CPU usage during the day, we are seeing McAfee processes taking up more than half the CPU usage.  Is there any way to make sure that all McAfee processes (I.e. McAfee engine, services, on access scanning) happen at the end of the day, like after 9 PM?  We cannot continue to have these specific machines losing CPU processing.  We also cannot continue to go through individually killing these processes when they decide to take up all the processing power of the machine.  I am currently using ePo version 4.5 Build 851 VirusScan Enterprise  Version number: 8.7i (8.7.0.570).

        • 1. Re: Mscript_inuse.exe high CPU usage
          hem

          I will suggest you to check if Update task is configured to run at 9:00 PM? If yes then I will suggest you to schedule it at the end of the day.


          This was the known issue and is fixed in VSE 8.7 patch4 ( KB#:KB68965).

          • 2. Re: Mscript_inuse.exe high CPU usage
            rackroyd

            Mcscript_inuse.exe runs in relation to the agent scripting engine (ie task-based stuff).

            Scheduling client tasks at non-critical periods or periods of low activity would seem to be a good idea if possible here.

             

            It's important to distnguish between cpu usage by process though, high cpu during update is not the same as high cpu during on-demand scan or high cpu during on-access scan.

             

            In VirusScan you might want to try creating Low-Risk Processes additions for the following processes:
                      McScript_InUse.exe
                      FrameworkService.exe
                      naPrdMgr.exe

             

            Also consider disabling 'Processes on enable' within VirusScan On-Access properties.

             

            You don't say which McAfee Agent is in use but you might also want to try implementing 'MA Lower Thread Priority' by applying this registry key and value:

            HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework
            Set the value:  LowerWorkingThreadPriority (DWORD) to 1

             

            You might also want to try profiling the apps that are causing on-access scans to hit often or hard and adjust their process priority in VirusScan too bearing in mind that performance vs scan coverage is often a trade-off rather than being a black or white decision.

             

            Perhaps after profiling you may find a particular file-type that causes VirusScan to take longer than expected to scan, you can then discuss it with McAfee Labs on what to do to improve matters for such files.

             

            Rgds,

             

            Rob

            • 3. Re: Mscript_inuse.exe high CPU usage

              Thank you for your help everyone.  So far I have added the few processes to the Low-Risk Processes field in Virus Scan.  Rackroyd, could you explain why that might help?  I was not sure why but I am trying to make fixes quickly since we have POS depending on my fixes.  I have a couple other questions too...

               

              I recently took over the ePo project/product for my company and I am not sure where to navigate for all policies/tasks.  Where would I go to find where my Update task is configured and what time it is configured to run?  Also, do I already have VSE 8.7 patch 4?... we are currently running 8.7i (8.7.0.570).

               

              Rackroyd, you spoke of possibly disabling 'Processes on enable' within VirusScan On-Access properties.  When I go to policies, I see two settings for On-Access General Policies: (1) Enable on-access scan at system startup and (2) Enable on-access system scan when policy is enforced.  Should these be unchecked?  Would I still have a scan done daily?

               

              Thanks in advance again as I continue to learn more about using this product.  Please also remember that I am using an older ePo version in version 4.5.  Thanks.

              • 4. Re: Mscript_inuse.exe high CPU usage
                rackroyd

                Processes on enable might be vse 8.8 only, it's literally named that. Anything else is not the same.

                 

                For process priority this support article is a worthy read:

                KB55139 - Understanding High-Risk, Low-Risk, and Default processes configuration and usage

                 

                For ePO it's probably best to put some time aside to review some of the product video tutorials on the McAfee servide portal (or on YouTube for that matter).

                 

                For example video tutorial TU30136

                KB65979 - How to manage policies and tasks for selected computers in ePO 4.5

                 

                https://mysupport.mcafee.com/Eservice/Default.aspx

                 

                Rgds,

                 

                Rob.