VSE for Linux scanner CPU usage increases when Host IPS for Linux is enabled

Technical Articles ID: KB85371
Last Modified: 11/12/2020

McAfee Host Intrusion Prevention (Host IPS) for Linux 8.0
McAfee VirusScan Enterprise for Linux (VSEL) 2.0.x, 1.9.x

The CPU usage for the VSEL scanner increases when Host IPS for Linux 8.0 is enabled.

Exclude the following folder from being scanned by VSEL:

/opt/McAfee/hip/log

Unmanaged (standalone) systems

Open the VSEL interface.
In the Configure section of the Navigation pane, select On-Access Settings.
Click Edit.

A new, blank line appears in the Paths Excluded from Scanning section.
Type the following path:

/opt/McAfee/hip/log
Click Add, and then click Apply.

ePolicy Orchestrator-managed systems

Open the ePolicy Orchestrator console.
Access the System Tree.
Access the Level, Group, or individual systems to check Assigned Policies.

NOTE: There could be multiple VSEL policies applied. There could also be two or more versions of VSEL in the environment. Ensure that you apply the exclusion change to each policy where Host IPS for Linux is deployed.
Create the exclusion:
1. In the Assigned Policies for the Linux systems or Policy Catalog, select VirusScan Enterprise for Linux from the Product drop-down list.
2. Select the applied On-Access Scanning Policy.
3. On the Detections tab, go to the What not to Scan section, click the + sign, and type the following path:
  
  /opt/McAfee/hip/log [version]
4. Click Save and push the policy to the Linux systems that you want.

Host Intrusion Prevention 8.0
Known Issue/Product Defect
VirusScan Enterprise for Linux 2.0.x
VirusScan Enterprise for Linux 1.9.x

This article is available in the following languages:

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center