Determine which file is being scanned by ENS

[braindope]

Hi,

How can I know what are the files/processes being scanned by ENS, I'm having problems with McAfee Scanner Service which taking up alot of memory. Specially in my production servers which I cannot restart when I end the mcafee services. I've already tried the ZZZ exclusion from this kb https://kc.mcafee.com/corporate/index?page=content&id=KB89354&actp=null&viewlocale=en_US&locale=en_U...

Anyone having the same problem?

[denn]

Use McAfee Pofiler tool

[braindope]

Thanks, will test it now

[Pmaquoi]

Like Denn said,, Mcafee Profiler too is the solution and it could also be imported into ePO and launched remotely

[braindope]

How can I get the data if I were to launched it via ePO? will the profiler send the data back to ePO and them I will access it via some kind of dashboard?

[Former Member]

McAfee Profiler tool . Use it. It is effective.

[braindope]

I have test the tool, however I don't quite understand the reports, which of the reports on the profiler will tell me the file being scanned by the scanner (ex. ENS TP) and consuming the most CPU and Mem.

[jess_arman · Accepted solution]

@braindope For more information and description regarding McAfee Profiler reporting and use, please see KB69683.

McAfee Profiler does not output performance information as it appears you're seeking; it shows frequency information, essentially. If you are looking for performance tracing then you need to use Process Monitor or Windows Performance Recorder. However, if you're just looking for what files are being scanned the most (which contributes to resource consumption), then Profiler is your desired tool and will be much clearer to read and understand. You can look to make exclusions based on what it sees in order to reduce impact.

I also advise that you review the following article for troubleshooting high CPU issues KB89354.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please give kudos or select "Accept as Solution" in my reply, as appropriate, so together we can help other members?

[denn]

If you are using McAfee ENS ATP you can faced the performance issue. Affected versions 10.5.4, 10.6. 

RAM and CPU consumption. Only workaround is to remove McAfee ATP.

I have open case for ATP performance issue still waiting answer.

[Former Member]

Hi,

Enable debug logging for threat prevention. It is verbose logging in ENS. So, it should list the files which are scanned by ENS.

Regards