McAfee Management Service & WWAN AutoConfig maxing out machine resources

[Former Member]

Im hoping someone can assist, i am experiancing high CPU and RAM usage everyday on login into windows 10.

McAfee Management Service sits at 98% CPU usage & WWAN AutoConfig sits at 99% RAM usage making it impossoble to work for around 1-2 hrs.

We have removed the agent for a day and system is fine however as a paying customer that has no protection this is not how we want to run our systems "un-protected".

System Information
Computer Name: XXXXXXX

McAfee Agent
Version number: 5.0.6.220
Status: Managed
SuperAgent: Peer to Peer
Last security update check: 2018/06/22
Last agent-to-server communication: 2018/06/22
Agent to Server Communication Interval (every): 1 hour
Policy Enforcement Interval (every): 1 hour
ePO Server/Agent Handler

McAfee Endpoint Security
Version number: 10.5

Thanks & Regards,

nox emulator

[vnaidu]

Dear @Former Member Since you are using ENS 10.5.X and Agent 5.X which is good. However, I would like you to run the MER tool and also run the Profiler tool which would collect the required logs. Once you have these logs handy, you may raise a service request with McAfee.

Because to solve this issue, we definitely require logs for analysis. It is better to share the logs to McAfee rather than in this forum.

I wish your issue is resolved soon.

Cheers!!

[jess_arman]

@Former Member It is possible that there is something that occurs during your login time which is scanned or processed in excess or potentially something that is conflicting with our drivers' attempts to fully engage. In these scenarios, typically the issues can be resolve by implementing some strategic OAS exclusions. Have you tested on an affected system with the ZZZ test to see if the issue resolves? This test would show us if an exclusion would be able to resolve the issue. 

I am surprised to see that it is MMS which is experiencing high CPU instead of the scanner, but this does not rule out the scanner as being involved until the above test is completed. It is possible that the high memory consumption by WWAN AutoConfig is causing us to have adverse behavior due to lack of available memory, then causing MMS (which is attempting to manage our other processes/drivers) to attempt to compensate for the delays introduced. Though WWAN AutoConfig is a process that is recommended to be enabled for module adapters/network is it possible to test disabling this on a system and seeing how the login behavior and the performance of MMS may change?

What modules of ENS do you have installed? Do you have any 3rd party software which also does any type of active monitoring of your system?

I respectfully disagree with vnaidu's data collection suggestion as the McAfee Profiler would not give the level of insight necessary to investigate this behavior at the beginning.
If you would like to go the route of a Service Request with McAfee Support, please look to answer the above questions, and if possible, we would actually request that you enable debug logging, and attempt to collect a bootlogging ProcMon and AMTrace (I realize this may be diffcult due to the level of duress at login, but it would give us critical insight if you were able to collect it) or boot Windows Performance Recorder capture. Instructions for doing so are outlined in KB86691. Then, once complete, please collect a MER.

Personally, I would say that doing one of the previously recommended tests before looking to collect this data would best in order to get better context to the situation at hand.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?