Loading...

Knowledge Center


FAQs about McShield.exe and high CPU utilization when running On-Demand scans
Technical Articles ID:   KB85299
Last Modified:  7/27/2017
Rated:


Environment

McAfee VirusScan Enterprise (VSE) 8.8 Patch 5 and Later

For details of VSE 8.8 supported environments, see KB51111.

Summary

Customers who upgraded from VSE 8.8 patch 4 to patch 5 might report higher CPU utilization when running On-Demand scans (ODS). This is not necessarily a sign of incorrect function.

Why was this higher CPU usage not happening in patch 4?
That was most likely because patch 4 contained a known issue where it used only one scanning thread was used during ODS. This issue is resolved in patch 5, resulting in higher CPU utilization during ODS.

What changes were made in patch 5 for this specific behavior?
Engineering resolved the thread count issue from patch 4, and now multiple threads are used to finish the scan faster. This resolution is documented in the VSE 8.8 patch 5 Release Notes (PD25913).

Is there a safeguard in place to prevent CPU usage from exceeding a certain percentage for the process?
No. This feature does not currently exist.
If you require a change to product functionality, submit a new product idea at:

https://community.mcafee.com/t5/Enterprise-Product-Ideas/idb-p/business-ideas

The Ideas forum is accessible only to McAfee business and enterprise customers. To access the Ideas forum, click Sign In and enter either your McAfee ServicePortal (https://support.mcafee.com) or McAfee Community User ID and password. If you do not yet have a McAfee ServicePortal or McAfee Community account, click Register to register for a new account on either website.

For more information about product ideas, see KB60021.

NOTE: The Ideas forum replaces the previous Product Enhancement Request system.


Are you recommending that I stay on patch 4 to prevent this issue?
No. While patch 5 ODS does use higher CPU, scans finish faster. The product development team recommends upgrading to patch 5 when it is approved for your environment, because patch 5 also contains useful security updates.

Why would ODS use 95% CPU utilization when VSE was set to use low resource?
This relates to how the Windows Set priority Control API works, because VSE uses that API for system resource utilization and, in turn, allows the operating system to decide on the resource utilization and assignment function. You can find more details in Knowledge Base article KB55145.

If settings on the performance tab do not change this behavior, why is that option available?
Setting the system utilization on the performance tab to Low provides improved performance for other running applications. The Low setting is useful for systems with high end-user activity. Conversely, by setting the system utilization to normal, the scan completes faster. The normal setting is useful for systems that have large volumes and very little end-user activity. You can read more about this in the "Configuring Performance Improvements" section of the VirusScan Enterprise 8.8 Best Practices Guide (PD22940).

You can also make the following adjustments to ODS settings to improve performance, as required:
  • Enable scan cache.
  • Set up daily, targeted ODS for risky locations.
  • Set up complete ODS to run once a week.
  • Set up exclusions in ODS wherever needed, such as on an Exchange server.
  • Review KB74059 for Best Practice for On-Demand Scans in VSE 8.8.

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.