Loading...

Knowledge Center


Large amounts of memory being consumed by EngineServer.exe
Technical Articles ID:  KB59962
Last Modified:  03/04/2014
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.7i Patch 4 and earlier
Microsoft Outlook

For VSE supported environments, see KB51111.

Summary

Background information about the EngineServer.exe service, which is new to VSE 8.7i
In previous versions, scanner components ran inside the process they were protecting. This is also known as running 'in-process'. For example, EmailScan, providing scanning for Outlook, would cause the Outlook.exe process and memory space to load the Engine and DAT files, increasing its memory usage footprint significantly by adding the size of the DAT files and Engine. This design had a limitation. If the Engine and DAT files encountered a serious problem, it would impact the entire process, potentially causing the process to fail or stop responding. This would require restarting the application.

VSE 8.7i and later introduced EngineServer.exe, where the DATs and Engine are loaded to provide scanning services for scanner features (EmailScan, ScriptScan, and the Root-kit scan portion of On-Demand Scan). This is known as 'out-of-process'. The design solved the issue that resulted when the Engine and DATs encountered a problem.

EngineServer.exe loads an instance of the engine for each scanner that is running, as described. To improve memory management, EngineServer.exe retains instances of the Engine and DAT files in memory only if there are active scan requests for the scanner using that instance. If it is idle for 30 seconds or more, that instance of the Engine and DAT files is released from memory. A new scan request for that scanner causes an instance to be loaded again.

NOTE: When there are multiple instances of an application that uses a scanner (for example multiple instances of Outlook.exe) all instances share the same engine instance.

Problem

The following could be reported on systems running VSE 8.7i Patch 4 and earlier releases:

  • Memory usage is higher than expected 
  • Systems where Outlook is installed and where the EngineServer service is using more than 150 MB of memory (that is, more than three instances of the Engine and DAT files), shows the memory is not being released after being idle for more than 30 seconds.

    NOTE: Due to the size of virus definition files, it is reasonable to expect to use 50 MB of memory for a single instance of the Engine and DAT files. 

Cause

The OutlookScan feature can fail to release an instance of the scan engine that was loaded via EngineServer.exe. This can lead to symptoms of EngineServer.exe using large amounts of memory, until the service was restarted.

Solution

This issue is resolved in VSE 8.7i Patch 5, which is available from the McAfee Downloads site using a valid Grant Number. The Outlook UI library now properly releases the engine instance on exit of Outlook.

The following is stated in the VSE 8.7i Patch 5 Release Notes (PD23040):

Issue: The Outlook Scan feature could fail to release an instance of the scan engine that was loaded via EngineServer.exe. This could lead to symptoms of EngineServer.exe using large amounts of memory, until the service was restarted. (Reference: 539488 )
Resolution: The Outlook UI library now properly releases the engine instance on exit of Outlook.
 
Patches are cumulative; therefore, McAfee recommends that you install the latest one.

McAfee product software, upgrades, maintenance releases, and documentation are available from the McAfee Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

NOTE:
 You will need a valid Grant Number for access. KB56057 provides additional information about the McAfee Downloads site, as well as alternate locations for some products.

Workaround

When EngineServer.exe's memory usage is high, restarting the service will reset the amount used.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.
United States - English
© 2003-2013 McAfee, Inc.