After installing the Linux version ot the EPO agent, I see that it's creating 18 seperate processes named "cma" and consuming a total amount of RAM around 600MB. This is just too much RAM to consume on servers already loaded down.
Can anybody help me figure out how to reduce the memory footprint and not lose any functionality?
I've attached the listing from top to the post.
Message was edited by: michaelvotaw on 10/31/13 6:49:37 AM CDT
What you are seeing is threads, not processes and is an artifact of how 'Linux Native threads' represents
Please refer to McAfee Support article: KB69690 - McAfee Agent 4.x for Linux displays many CMA Processes
Basically that observation is normal.
From that KB article:
The McAfee runtime environment uses Linux Native threads through the Light Weight Process implementation.
Utilizing Linux Native threads causes each thread to show as a separate process on the client computer.
The same behavior will be seen with any McAfee product that uses threading along with the McAfee runtime.
For additional information on Light-weight process:
Note that the top listing count also aggregates that memory usage incorrectly, so it appears exaggerated - for you it is actually only using 1/18th of that at any one time.
So in your case the agent is really only using around 33Mb.
It's no illusion. All of those processes (and they are seperate unix processes with unique PIDs) are comsuming over 500 MB of RAM. By all indications I have, they have reserved and are holding 33MB of RAM 18 times. That's 500MB of RAM that is now unavailable to my other processes. Now, each othose processes are running at different cpu utilization rates, but they are all holding 33MB each.
How do you know that top is incorrectly aggregating the memory calculations?
I know because I have seen this exact same request before and discussed it with the McAfee Linux Agent development team.
The pmap command is preferable for exactly this reason, see:
So pmap <PID> -d ought to provide a more accurate representation of real memory usage.
I admit it's a little odd to see each having a unique PID but that may also be an artifact.