Knowledge Center

SMTP loop and high CPU utilization on ws_inv-smtp process occurs when the EWS Appliance scans a specific Excel attachment
Technical Articles ID:   KB73020
Last Modified:  2/14/2014


McAfee Email and Web Security Appliance 5.x


When the EWS Appliance scans a specific Excel attachment, an SMTP loop and high CPU utilization on the ws_inv-smtp process occurs.
When this issue occurs, System Load (Troubleshoot, Tools, System Load) displays statistics similar to the following: 

Diagnostics: Process Information

Command     %CPU %MEM State
/opt/NETAwss/proxies/ws_inv-smtp -c /opt/NETAwss/mgmt/proxy.d/smtp smtp smtp 52 24.9 Running
/opt/NETAwss/proxies/ws_inv-smtp -c /opt/NETAwss/mgmt/proxy.d/smtp smtp smtp 48 24.9 Running
/opt/NETAwss/proxies/ws_inv-smtp -c /opt/NETAwss/mgmt/proxy.d/smtp smtp smtp 48 24.9 Running
/opt/NETAwss/proxies/ws_inv-smtp -c /opt/NETAwss/mgmt/proxy.d/smtp smtp smtp 46 24.9 Running


While scanning a specific Excel file, the file cannot be extracted for content scanning, causing the SMTP scan loop and this causes the Email and Web Security Appliance to suffer high CPU utilization. 


This issue is resolved in EWS 5.6 Patch 3, which is available by logging in to the ServicePortal at: https://support.mcafee.com/downloads.

Patches are cumulative; therefore, Intel Security recommends that you install the latest one.

To review the Release Notes for this patch, see PD23672.


When the issue occurs, the interim solution to this is to disable Content Scanning.

  1. Open the EWS Dashboard. 
  2. Select Email, Email Policies, Scanning Policies, Content, Content Scanning.
  3. For Enable content scanning for <Policy_Name>, select No.
  4. Apply configuration changes.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.