1 2 3 4 Previous Next 37 Replies Latest reply: Mar 2, 2015 4:15 PM by wwarren RSS

    VSE 8.8 p4 - High CPU load on network traffic even if all McAfee services disabled

    rgijsen

      Hi,

      the subject says it all actually. I had to track down high CPU load in our environment. Practically all machines are Hyper-V guests. but we also have some physical machines running, some of which have VSE installed. All VSE installations are managed through epo. The machines are either 2008R2 or 2012R2. All show the same behaviour: When VSE 8.8p4 is installed, network traffic generates as much as100% cpu on one thread (I think always on CPU0). This slows down the machines tremendously. This is not so obvious with small transfers, but when we transfer an .ISO file or another large file, the machines become really slow. Traffic is as fast as 80/100MB/sec (gbit backbone). The CPU load is not 'bound' to a process when I look in taskmanager, but rather is it Kernel time. So I suspect some low-level driver being the culprit. Now when I uninstall VSE this issue is completely gone. CPU load with large traffic is about 10-20%, and I get the full 120MB/sec (gbit) without any issue.

       

      One might say 'exclusions, network scanning and archive scanning'. All that has been covered, those are disabled and it didn't help. In fact, I disabled ALL McAfee services on a few testnodes, and CPU was still very high. As no services are running, no McAfee processes are running (atleast not visible to me). Uninstall VSE and it's running perfectly again. This is 100% reproducable here on both virtual machines as physical ones, and is a serious issue for us.

       

      So in short, with VSE installed but even when completely disabled, very high CPU load with network traffic. VSE uninstalled: all systems running fine. Anyone has a clue, can we disable a low-level-network driver (I don't need network traffic to be scanned, I need files to be scanned when they are created or read)? I found no KB articles on this whatsoever.

       

      To show what happens two screenshots, the first one with VSE installed but both source and destination location and network excluded from scan AND VSE services disabled (so no mcshield.exe running). Second screenshot with VSE uninstalled. First machine running at about 80MB/sec, second machine at 120MB/sec.

      with vse.png

      without vse.png

        1 2 3 4 Previous Next