3 Replies Latest reply on Feb 26, 2009 11:40 AM by HAFOTA

    Disabling VSE 8.7i ODS estimation?

      The Question
      Does anyone know how to disable the estimating feature of an On-Demand Scan, so I can minimize the disruption to my users? I do not see any EPO configuration options to support this, so I'm guessing it's either a registry entry or a hotfix I can get from McAfee.

      I'm running 50 machines in a VSE 8.7i pilot, and I've noticed the On-demand Scan tasks are taking 75-90% of their total run time just to estimate the job. I have one hour to scan the target, but the scans are taking between 4 and 6 hours to complete, with 4-5 hours comprising task estimation.

      For example, User A calls yesterday at 4 PM complaining that Scan32.exe is using 11% of CPU and causing the system to lag every 10-15 seconds. His machine is in the pilot group, and the EPO policy is programmed to execute a targeted, OnDemandScan on the logged-in users profile folder every day at noon.

      We opened the VSE Console on his machine, and we opened up the progress window for the ODS task. The ODS scan was still estimating the task nearly four hours after it started. Now, we were able to cancel the task estimation and interesting enough the actual ODS scan completed some 30 minutes later.

      Supporting Info
      The original idea behind scanning the profiles at lunch time was to rid my enterprise of web related bugs that manage to creep through the HTML streams and seed themselves in temp internet files and cookies. The OAS sometimes misses, so I didn't want to wait for the weekend Full ODS to clean the machines, however, if I'm blowing up 50 machines now, than I'm not going to conduct the same exercise on 5,000 machines.

      All help is appreciated, but please keep your comments professional and to the point. I'm not here to incite the VSE haters, and I only bring this up because I'm surrounded by the McAfee haters club at my work. My colleagues remind me on a weekly basis that Sabari, Avari, Norton, and Trend all kick McAfee's @$$, but what they don't realize is that I've keep our 5,000 node enterprise outbreak free for 6 years with EPO. That's no joke.

      Thank you in advance,

      Mr. HAFOTA
        • 1. RE: Disabling VSE 8.7i ODS estimation?
          I thought the ODS estimation only applied when you actually opened the interface.

          my scheduled OD scans take around the same amount of time as if I remote to a VSE console and start them from there and switch off the estimation on the same machine while I watch.
          • 2. Hum...
            Thanks for the feedback.

            I'm going to open a case with support on this one, because something is not correct and I'm receiving more reports.

            I'll post a follow up when I get a resolution.
            • 3. I guess not
              Short Answer:

              1. The ODS estimation phase...it can not be disabled.

              Long Answer:

              I chatted it up with support and it was interesting. I've pasted my convo in for everyone to read. Let's say that I'm not 100% satisfied with the answer, but it works.

              > Your representative has arrived.
              Miniketan: Hi,
              Miniketan: How can I help you today?
              Mr. HAFOTA: he
              Mr. HAFOTA: I need some help with the VSE OnDemand Scans
              Miniketan: ok
              Mr. HAFOTA: Is there a way to disable the estimation phase of the scan?
              Mr. HAFOTA: I've noticed that it takes a long time to run and a short time to run the actual scan. 70/30 split. 70% estimating & 30% scanning
              Miniketan: What is the version of ePO?
              Mr. HAFOTA: 4.0 SP3
              Mr. HAFOTA: VSE 8.7i
              Miniketan: ok, let me check about it
              Mr. HAFOTA: k
              Mr. HAFOTA: http://forums.mcafeehelp.com/showthread.php?p=551570&posted=1#post551570
              Mr. HAFOTA: I posted on the mcafee help forums if you would like to read the problem in detail
              Miniketan: ok, May I request you to stay on-line for a moment?
              Mr. HAFOTA: sure
              Miniketan: Thank you for staying on-line; I appreciate your patience
              Miniketan: Minimum for on demand scan is 10 %
              Miniketan: coompletely it can't be disabled.
              Mr. HAFOTA: wait...you can't disable task estimation phase? It's taking 4 hours to estimate and 1 hour to run the actual scan.
              Miniketan: ok, What is the size of RAM in system?
              Mr. HAFOTA: hang on - i have to query user...give me 2 minutes. Anything else I need to ask the user?
              Miniketan: sure... the issue you are saying , is possible if RAm is very low.
              Mr. HAFOTA: the user is telling me that the OnDemand Scan is scanning the whole computer. I have configured the task to just scan the following areas
              Miniketan: Did you check the RAM size?
              Mr. HAFOTA: Memory for Rootkits; Running Processes; User Profile Folder; Cookies; and Registry
              Miniketan: they might have selected to scan in ePO and force that policy to clients, so it is doing.
              Mr. HAFOTA: I'm waiting for him to answer
              Mr. HAFOTA: 2 GB of ram
              Miniketan: you have to select only those option in ePO console and force policy, which you want, as per that it will scan.
              Mr. HAFOTA: well..I have those options set and the user is insisting that the job is scanning the entire c drive
              Miniketan: yes, it will scan entire c:drive untill you make exclusion of any other file or folder.
              Mr. HAFOTA: We're not understanding each other
              Mr. HAFOTA: wait
              Mr. HAFOTA: the user just updated me with a critical piece of info
              Mr. HAFOTA: the user has 10 GB of files in their profile :eek:
              Miniketan: ok
              Mr. HAFOTA: let me ask you this
              Mr. HAFOTA: would the memory for rootkits option cause the scan32.exe to scan the entire c drive?
              Miniketan: I would suggest to uncheck the rootkit scan.
              Mr. HAFOTA: you haven't answered my question. Does the memory for rootkits option cause the Scan32.exe to scan the entire C: drive or just the root of the drive?
              Miniketan: memory for rootkits will scan the memory
              Miniketan: and Scan32.exe scans all the drive available on systems also.
              Miniketan: Scan32.exe will scan all the option which you have selected toscan.
              Mr. HAFOTA: You do not understand what I am asking.
              Mr. HAFOTA: If I select the Memory for Rootkits location in my On-Demand Scan. Will it scan the entire C: drive?
              Mr. HAFOTA: Better question - what does it do?
              Miniketan: NO.
              > representative Miniketan asked to share the customer's screen.
              > customer Mr. HAFOTA accepted request to share screen.
              Miniketan: Can you make it single screen?
              Mr. HAFOTA: do you see my EPO console?
              Mr. HAFOTA: no
              Miniketan: no
              Miniketan: because in dual screen I can see.
              Miniketan: can't
              Mr. HAFOTA: you see nothing? or just 1 screeN?
              Mr. HAFOTA: can I move my console to the other screen and you will see it?
              Miniketan: In dual screen all the display will be very small. I cant read any thing.
              Mr. HAFOTA: Let's be basic
              Mr. HAFOTA: can the task estimation be cancelled ? You said no.
              Miniketan: I will tell you steps, just follow once.
              Mr. HAFOTA: ok
              Miniketan: Open the VSe console on your system.
              Mr. HAFOTA: k
              Miniketan: Double click on full scan
              Miniketan: cancel the scanningnow.
              Mr. HAFOTA: ok - the progress window has apepared
              Mr. HAFOTA: stopped
              Miniketan: Only do the thing requested.
              Miniketan: close the scanning wondow
              Miniketan: window*
              Mr. HAFOTA: k
              Miniketan: First unlock the VSe console, so you can acccess all the option and seed details
              Mr. HAFOTA: done
              Miniketan: Open the full scan properties.
              Mr. HAFOTA: k'
              Miniketan: select the memory for rootkits and click on edit.
              Miniketan: And see the details
              Miniketan: I hope that you want to know
              Mr. HAFOTA: yes - this is good
              Mr. HAFOTA: i just wish we could disable the task estimation
              Miniketan: Disable option is not available minimum 10% to 100%
              Miniketan: because scanning will take cpu uses, can't be disable.
              Miniketan: Only manage up and down.
              Mr. HAFOTA: yes, I understand that, but my desire is to disable the first phase of the scan - the estimation where the task determines how long it will run. I just want it to run.
              Mr. HAFOTA: but it sounds like it's not possible.
              Miniketan: yes, you are right. because VSE will estimate the data available of HDD and then only it show the time meter, that how much scan has ben completed and how much left
              Mr. HAFOTA: that is what I wish to disable
              Mr. HAFOTA: disable the data estimate
              Miniketan: I hope that is not possible.
              > Clipboard sent by Mr. HAFOTA accepted by Miniketan.
              Mr. HAFOTA: ok - I appreciate the help. please close the case.
              Miniketan: sure...
              Miniketan: Is there anything else that I can help you out with?
              Mr. HAFOTA: No. Thank you.
              Miniketan: ok, your welcome.
              Miniketan: Thank you for contacting McAfee Gold Support
              Miniketan: bye.