cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Tthreshold percentage for CPU usage not working?

Jump to solution
I have limit the CPU usage to 60% and I still getting alarm on 100% CPU usage when On-Demand Scan is active. How do I limit On-demand Scan below 100% CPU usage? Is the option 'Scan only when the system is idle' a better option?
1 Solution

Accepted Solutions
AdithyanT
Employee
Employee
Report Inappropriate Content
Message 2 of 7

Re: Tthreshold percentage for CPU usage not working?

Jump to solution

Hi @User12964808,

Thank you for your post. The threshold value defined only works on ENS 10.7 endpoints.

This value is applicable only to the "mcshield.exe" process which performs the on demand scan and not for the whole machine.

The 65% limit will ensure mschield.exe stays within 65% usage and not more than that.

The more you restrict this maximum value, the more time it would take to complete on demand scan.

Scan only when idle is a great option however, you can expect scans to take few days or weeks should the user keep the machine busy all the time without idle time. It would be more apt to be used on environment where we expect the machines to reach idle state quite often or over a longer period of time.

I would recommend limiting mcshield's CPU usage value to a lower number (lowest being 25%) and also understand and anticipate longer scan duration for each machine in the environment.

I sincerely hope this helps.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T

View solution in original post

6 Replies
AdithyanT
Employee
Employee
Report Inappropriate Content
Message 2 of 7

Re: Tthreshold percentage for CPU usage not working?

Jump to solution

Hi @User12964808,

Thank you for your post. The threshold value defined only works on ENS 10.7 endpoints.

This value is applicable only to the "mcshield.exe" process which performs the on demand scan and not for the whole machine.

The 65% limit will ensure mschield.exe stays within 65% usage and not more than that.

The more you restrict this maximum value, the more time it would take to complete on demand scan.

Scan only when idle is a great option however, you can expect scans to take few days or weeks should the user keep the machine busy all the time without idle time. It would be more apt to be used on environment where we expect the machines to reach idle state quite often or over a longer period of time.

I would recommend limiting mcshield's CPU usage value to a lower number (lowest being 25%) and also understand and anticipate longer scan duration for each machine in the environment.

I sincerely hope this helps.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T

Re: Tthreshold percentage for CPU usage not working?

Jump to solution

I noticed an important factor in KB93411, on designing policys for On-Demand Scan.

I wasn't aware that IF you have any exclusion, CPU limit feature does'nt work.

 

Environment

McAfee Endpoint Security (ENS) Threat Prevention 10.7.x

Summary

ENS Threat Prevention 10.7.x on-demand scan (ODS) includes a feature to limit CPU usage when an ODS is running. When running an ODS task with Limit maximum CPU usage set, the CPU usage might exceed the CPU usage set in the policy.

Solution

This behavior is as designed because this feature does not work when exclusions are set in the ODS policy.

chrys777
Level 7
Report Inappropriate Content
Message 4 of 7

Re: Tthreshold percentage for CPU usage not working?

Jump to solution

Hi,

I have exactly the same problem as the user "User12964808":
I have Limit maximum CPU usage set to: 50% and I still getting alarm on 100% CPU usage when ODS is active (running on the Virtual Machines).


Solution

This behavior is as designed because this feature does not work when "exclusions" are set in the ODS policy.

please confirm exactly which one ("exclusions") it indicates?
McAfee Endpoint Security --> Threat Prevention --> ON-DEMAND SCAN --> Exclusions

 

What if I don't have any exclusions, and the problem with very high CPU usage (~100%) still occurs, ... what else can I check?

 

Thank You.

BR

AdithyanT
Employee
Employee
Report Inappropriate Content
Message 5 of 7

Re: Tthreshold percentage for CPU usage not working?

Jump to solution

Hi @chrys777,

Thank you for your post. There are 2 situations where CPU limit can be crossed:

1. The ODS Scan task (or Policy if it is a policy based on Demand Scan!) has any exclusions configured under the scan.

2. The Scan task is showing High CPU during initial part of the scan where it scans Memory for running processes or Registry keys. Please note that CPU limit can work only for scanning Files and hence the initial part of a Full Scan is not bound to honor the CPU limit owing to the scan by default happening over memory and registry.

Please ensure the Endpoint is running latest possible version and kindly contact Support with a Service Request should the issues exists outside the above 2 scenarios.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
chrys777
Level 7
Report Inappropriate Content
Message 6 of 7

Re: Tthreshold percentage for CPU usage not working?

Jump to solution

Dear @AdithyanT,

Thank you for your answer. You wrote that there are 2 situations where CPU limit can be crossed:

1. The ODS Scan task (or Policy if it is a policy based on Demand Scan!) has any exclusions configured under the scan.

please clarify which Exclusions you mean:

       a] McAfee Endpoint Security --> Settings (Show Advanced) --> Options --> Self Protection --> Exclude these processes 

or

      b] McAfee Endpoint Security --> Settings (Show Advanced) --> Options --> Threat Prevention --> ON-DEMAND SCAN --> Exclusions

or both a/b?

 

2. The Scan task is showing High CPU during initial part of the scan where it scans Memory for running processes or Registry keys. Please note that CPU limit can work only for scanning Files and hence the initial part of a Full Scan is not bound to honor the CPU limit owing to the scan by default happening over memory and registry.

Yes - I know about initial part of a Full Scan --> high CPU utilization during scanning: Memory, Boot Sectors, Master Boot Records, Registry.
But in my case during Weekly Full Scan [ODS]  Scanning Files consumes +90 % CPU by proces: McShield.exe. This process is able to take as much as the operating system can give it ;].
I have CPU maximum usage threshold limit set to: 50%. There is an entry in the OnDemandScan_Activity.log about assigned CPU maximum usage thresold limit: 50.


Thank you in advance.

BR

AdithyanT
Employee
Employee
Report Inappropriate Content
Message 7 of 7

Re: Tthreshold percentage for CPU usage not working?

Jump to solution

Hi @chrys777,

Thank you for your kind response.

Please find below my answers:

1. Answer is b) only. ODS Scan Exclusions alone has impact on this feature.

2. That is definitely worrisome. I would recommend creating an SR with Support for investigation. There could be aspects that we may not be able to find/investigate here whiteout taking a look at the issue or collecting additional information/logs and hence we would suggest an SR to be open for the same.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use our Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from product experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by employees.
Join the Community
Join the Community