VSE 8.8 p4 - High CPU load on network traffic even if all McAfee services disabled

[Former Member]

My reference to Hyper-V was for VMs, not the hosts themselves. We are virus scanning our hosts with exclusions and so far no issues.

I am curious, knowing now the existence of this new feature of Server 2012 (npsvctrig.sys filter driver - 'Named Pipe Service Trigger Provider'), whether it is involved in the issue. I don't believe that Server 2008 R2 uses it as it is a new Microsoft architecture added to 2012 and newer.

Have you run the same scenario but with 2008 R2? That would be great to know!

[Former Member]

Interestingly, my test scenario, run on physicals, does not have the same slowness. Have you run your tests on physical servers (same config otherwise)?

[rgijsen]

Dean, you stated yourself this doesn't happen of physical machines, only on VM's. In my scenario it's the same, although I don't have dedicated test-physical machines, the ones I have in production do not show this issue. I am currently rolling out 2 2008R2 VM's but our production ones behave the same as 2012R2 - slow with VSE.

[Former Member]

Weird that it doesn't happen on physicals, eh? I am curious to see the results of your test on 2008 R2 VMs. I can't recall if I ever did a test on that. P3 only ran on 2012 and so I couldn't use that on 2008 R2 to test.

In general how have you found VSE 8.8 P4? We are planning an upgrade and I am a bit worried about some known, published issues with P4. P5 is too far out for us, timing-wise. We might only go to 8.8 P2 (plus its hotfixes). We have thousands of servers to upgrade and want to get it right.

[rgijsen]

2008R2 VM's behave the same in my environment. So I have a good test setup for this case now I believe. p4 in general works pretty well for us. I had no real choice either as we have a lot of 2012R2 machines, that are supported only in p4 - p3 worked, but wasn't supported.

[Former Member]

Good to know that you get the same results with 2K8R2. Means less likely to be OS specific and more likely McAfee's own issue. We are tempted to disable the McAfee mini-firewall driver file in the meantime until McAfee addresses the problem.

Ballpark, how many servers do you have running P4? Are they a mixed bag of server OSes? 2003, 2008, 2008 R2, 2012, 2012 R2?

[Former Member · Accepted solution]

McAfee is fully aware of the issue since May.
They have "alpha" (POC) driver and should prepare HF or include it in one of the next patches.

Please report your issue, you can mention my SR 4-5606236293.

[rgijsen]

psolinski, thanks for your input as well. I've forwarded the ticketnumber to my own ticket. They have had a remote session and I was able to clearly show them the issue on both 2008R2 as well as 2012R2. Ofcourse I can't see your ticket and conclude it's the exact same issue, however I asked for clarification on that. If it's the same issue it really disturbs me we are paying a lot of money for this while a serious issue like this takes about half a year now to fix and still not fixed? Insane. However as said, I'll give them the benifit of the doubt until I get some clarification from them. I'll keep you informed.

Can you spare more details on your ticket psolinski, and about the alpha driver and such?

[Former Member]

thank you for that psolinski.

[rgijsen]

I got the 'POC' patch from support, and that seems to work fine so far, no CPU load issues anymore. Although they told me not to use this in production. I also got a p4 hotfix that should contain the same fix, which is in fact released and supported. It's HF929019 for those that want to ask support for it. Still yet, they recommend to use it only on those machines that really need it, and for all other machines wait for p5, which is due around January in support, and about a month later available for all users.

I'm thinking about installing the HF to atleast our fileservers as they show this issue quite badly.