Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
6757 Views 20 Replies Latest reply: Dec 12, 2013 3:28 AM by pankajs RSS 1 2 3 Previous Next
passmaster16 Newcomer 26 posts since
Nov 8, 2009
Currently Being Moderated

Nov 5, 2012 5:26 PM

VSE 8.8 P2 Hangs System At DAT Update

I have an open case with support but wanted to get insights here.  We're running ePO 4.6.3 with Global Updating enabled.  We recently upgraded from VSE 8.7 P5 to 8.8 P2 and on some of our systems we've experienced hangs/freezes during the DAT file update process.  When this happens, the system goes out to lunch and is completely unresponsive for 1-2 minutes.  When the system comes back to life, we can see that the OAS timed out and killed the process.  We assume that it's during the restart of the mcshield process that hangs the system.  In the event long we can see a 5051 event.  The thread address is always the same but the object being scanned usually changes.  It's odd that it only happens on some systems even once that have fresh XP builds on them.  We never saw the issue with VSE 8.7 P5.  The issue seems very similar to this post https://community.mcafee.com/message/100166#100166 related to 8.7 and it seemed like the consensus there was ePO Global Updating was to blame.  Any ideas on what this could be?   Below is an example of the event log error

 

Event Type: Error
Event Source: McLogEvent
Event Category: None
Event ID: 5051
Date:  11/5/2012
Time:  1:25:31 PM
User:  NT AUTHORITY\SYSTEM
Computer: workstation123

Description:
A thread in process C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request.
The process will be terminated. Thread id : 4036 (0xfc4)
Thread address : 0x7C90E514
Thread message :

 

Build VSCORE.15.0.0.466 / 5400.1158
Object being scanned = \Device\HarddiskVolume1\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.C RT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.6195.policy
by \??\C:\WINDOWS\system32\csrss.exe
7200(0)(0)
7595(0)(0)
7005(0)(0)
7004(0)(0)
5006(0)(0)
5004(0)(0)
5003(0)(0)
5002(0)(1)

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    1. Nov 13, 2012 4:29 AM (in response to passmaster16)
    Re: VSE 8.8 P2 Hangs System At DAT Update

    We are experiencing similar problems, except we upgraded from VSE 8.8 P1 to P2.

     

    McAfee hangs shortly *after* the daily update process has completed, and all windows end up 'Not Responding' for about a minute and a half, after which we receive the same event log message as you and the system is fine.

     

    This happens on a clean install as well, with VSE 8.8 P2 repost installed directly (no upgrade).

     

    Will let you know if we get anywhere on our McAfee case, I think we are up to Level 4 on the escalation ladder now...!

     

    Kind regards,

    Chris

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    2. Nov 13, 2012 4:48 AM (in response to Minkus)
    Re: VSE 8.8 P2 Hangs System At DAT Update

    P.S. Some of the things already attempted to resolve:

    • McAfee suggested excluding the files that are being scanned - but it is quite often different files on different PCs so this is no good.
    • Setting up low/high risk policies as per https://kc.mcafee.com/corporate/index?page=content&id=PD22940 - reduced the errors somewhat, but did not eliminate
    • Increasing 'Maximum Scan Time' from 45 to 55 seconds - still no good (just increases the timeout from 90000ms to 110000ms in the event, making them hang for longer)
    • Re-downloading our VSE 8.8 P2 and VSE 8.8 P2 Repost packages and reinstalling to a computer - didn't do any good
    • Make sure 'Processes on Enable' is disabled, and that Artemis sensitivity is set to Medium - which they both are already.

     

    I have also independently tried changing the DAT update time - ours is not using Global Updating but instead a task which is set to 'Run if missed' 10 minutes after the system boots. I tried changing this to 5 minutes in case it was conflicting with another system process but this didn't help.

     

    We can see *very* clearly in the logs that the issue only occurred after Patch 2 was installed (the dates match up perfectly) but McAfee are insistent this is not the cause...

  • pierce Champion 401 posts since
    Feb 22, 2011
    Currently Being Moderated
    3. Nov 13, 2012 6:33 AM (in response to passmaster16)
    Re: VSE 8.8 P2 Hangs System At DAT Update

    Have you followed the best practice guides for VSE? I had terrible performance with VSE until I followed that and excluded a few more VSE exe's from being scanned. Might be worth a look to check your getting the best performance out of your systems.

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    4. Nov 13, 2012 6:45 AM (in response to passmaster16)
    Re: VSE 8.8 P2 Hangs System At DAT Update

    Yep, that's PD22940 described above. We've got pretty much all of this implemented already, certainly the performance related stuff. Didn't seem to do any good.

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    6. Nov 14, 2012 4:53 AM (in response to passmaster16)
    Re: VSE 8.8 P2 Hangs System At DAT Update

    It may be related to what the user is doing on the system at the time - hence why only some machines are displaying the problem.

     

    We also sent a Process Monitor scan across a couple of days ago and are waiting for a response.

     

    Glad to hear it's not just us experiencing the problem!

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    8. Nov 27, 2012 6:22 AM (in response to passmaster16)
    Re: VSE 8.8 P2 Hangs System At DAT Update

    Passmaster16,

     

    I got the same article, and also found that excluding all files works (at least the one time I tried) - but of course this doesn't prove anything and the problem is intermittent anyway.

     

    Our event logs are very clear that the issue started occurring when we installed Patch 2, and once I pointed this out again and had a bit of a moan I got up to Tier III who are now investigating for me.

     

    I would suggest you push this angle as well - if you can install 8.8 Patch 1 onto a machine, demonstrate that the problem does not occur, and then upgrade to 8.8 Patch 2 and demonstrate that it does, you may have better luck in convincing them to escalate.

     

    Good luck!

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    9. Nov 27, 2012 6:27 AM (in response to Minkus)
    Re: VSE 8.8 P2 Hangs System At DAT Update

    Further status update: The chap at Tier III has asked me to enable LogLevel 8 for McAfee Agent (KB56207), set up debug logging for VSE, set up etltrace, Process Monitor, and replicate the error. Once this is done I am hopeful it'll get up to the engineering level.

     

    Will let you know how I get on.

1 2 3 Previous Next

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points