1 2 Previous Next 18 Replies Latest reply: May 12, 2015 10:12 AM by c14us RSS

    Slow shutdown >2min with HIP 8.0.0.2919

    Labnuke

      Client computers are taking >2min to shutdown with HIP 8.0.0.2919 installed. If HIPs is removed, then client shutdown takes <30sec. Any ideas?

       

      Clients are running agent 4.8.0.1500

       

      on 4/17/14 7:09:27 AM GMT-05:00
        • 1. Re: Slow shutdown >2min with HIP 8.0.0.2919
          konecnym

          Hello.

           

           

          We have the same problem. We had to escalate to McAfee Platinum (since 21.3.2014... so today is 29.4.2014 ).

          We are sure that problem is in Patch 4.

          For your test you can stop manually service "McAfee Host Intrusion Prevention IPC service" and after that you try ShutDown. It will be quick.

          This problem reported all users but users with SSD drives where times enormous increased (SSD drives have VIPusers only)

          We have suspicion to HIPS extension.

           

          We are using ePO 4.8.0.1500 (P2) and HIPS 8.0.0.2919 (P4) and ePO 5.0.1
          (we would like upgrade to ePO 5.1 long time but still isn´t compatible GTI Proxy.  )

           

           

          M.

          • 2. Re: Slow shutdown >2min with HIP 8.0.0.2919
            steflevy94

            Hello

             

            we have 450 laptops with HIPS 8.0.0.2919, ePO 4.8.0.887 and VSE 8.8.0.975 and don't have slow shutdown issues.

            We only use firewall rules and not IPS module.

             

            Did you test with only the HIPS firewall enabled ?

            Maybe the problem is with your IPS rules.

             

            K. Regards

            • 3. Re: Slow shutdown >2min with HIP 8.0.0.2919
              konecnym

              Hello.

              We can be more secure, we are using the last version McAfee products.
              I hope that new update is published that McAffe tested it well.
              Of course we are testing new update in our lab. But sometimes problem aren´t in testing enviroment.
              So then we have to use McAfee Platinum Support.

               

              HIPS and IPS and FW rules
              We are using hips since version 6.
              And IPS policy in HIPS 8 wasn´t long time changed. (So I think that problem isn´t there)
              Problem turned out to to P4.

               

              steflevy94 - you are using old VSE and old CMA ... there maybe isn´t problem.
              We can´t roll back to old version 12.000 clients.

               

              Patch 4 add some service "McAfee Host Intrusion Prevention IPC" and better communication with CMA.
              (We try some test with  old ePO Agent 4.6 P3 and there is ShutDown a little faster ...)

               

              I hope that  McAfee Platinum give us some solution.

              • 4. Re: Slow shutdown >2min with HIP 8.0.0.2919
                mlmarshall3

                What level of logging do you have for Firewall and IPS under the HIPs General > Client UI?  We were finding FireSVC.exe using a large chunk of CPU and slow start up/shut down.  Adjustment of this to "Error" eliminated that.

                • 6. Re: Slow shutdown >2min with HIP 8.0.0.2919
                  Labnuke

                  Our logging is set to Error/Error and we are seeing the same issue.

                  • 7. Re: Slow shutdown >2min with HIP 8.0.0.2919
                    b16811

                    Hello,

                     

                    same problem.

                     

                    McAfee HIPS 8.0.0.2919, VSE 8.8.0.1247, Agent 4.8.0.887, ePo 4.6.8 Build 112

                     

                    I.R.

                    • 8. Re: Slow shutdown >2min with HIP 8.0.0.2919
                      konecnym

                      Hello !

                       

                      It is still bad... but there is only the one workaround.

                       

                      • Could you set deployment tasks without selected Options-Run at every policy enforcement (Windows only).

                              I mean disable this options.

                       

                      After that settings you have to update policy on clients and you will try shutting down PC.

                      SSD is going to off about 20-40 seconds.

                      Before disable this options it was about 2min.

                       

                      Before HIPS P4 (so i mean HIPS with P2) it take about 6s ! (the same time like without McAfee products).
                      So our users know and they are sure what slow down their computers (Intel Mcafee)

                       

                      So there is some progress but we are not satisfied.

                       

                      Support haven't any fix (HFX or Patch or new product) :-(

                      (information from today 24.6.2014... we reported this problem on PlatinumSupport on 21.03.2014)

                       

                      Michal

                       

                      Note:
                      Does anyone have a better solution ?

                       

                      Message was edited by: konecnym on 6/24/14 1:12:38 PM CEST
                      • 9. Re: Slow shutdown >2min with HIP 8.0.0.2919
                        Pmaquoi

                        Did you try the last recent hotfix for Hips ? RTW last week.

                        1 2 Previous Next