Linux system running VirusScan Enterprise for Linux run slowly or stop responding under heavy load

Technical Articles ID: KB86276
Last Modified: 5/21/2020

Environment

McAfee VirusScan Enterprise For Linux (VSEL) 1.9.0, 1.9.1

Problem

A linux system is intermittently slow due to heavy load, and could become unresponsive when archive files such as .jar are scanned by the On-Access Scanner (OAS).

System dump analysis shows many application processes are waiting for the completion of the OAS, as seen in the following example stack trace:

PID: 28675 TASK: ffff88013c5f0ae0 CPU:2 COMMAND: "sm_sender"
#1 [ffff88013b193a40] doScan at ffffffffa0281341 [linuxshield]
#2 [ffff88013b193af0] SC_doScan at ffffffffa0281d6b [linuxshield]
#3 [ffff88013b193b50] openHook at ffffffffa27c773 [linuxshield]
#4 [ffff88013b193b90] invokeCallbacks at ffffffffa025bb25 [lshook]
#5 [ffff88013b193c80] fileOpenHook at ffffffffa025d387 [lshook]
#11 [ffff88013b193f30] custom_file_open at ffffffffa025d660 [lshook]

System event logs from the Web UI or ePolicy Orchestrator server show some .jar files timed out during OAS. The following is an example of message seen in the event log:

"Timeout scanning /usr/java/jdk1.7.0_67/jre/lib/rt.jar for user root using /usr/java/jdk1.7.0_67/bin/java"

Cause

Scanning archive file such as .jar files requires high CPU resources, and can sometimes result in scan timeouts. The process that was attempting to access the file is suspended. A timeout event occurs, then the scan request is released from the scanning queue in the kernel.

Solution

McAfee recommends that you add .jar files or other common archive file types be added to the OAS exclusion list. For details, see PD24617.

Affected Products

Configuration
VirusScan Enterprise for Linux 1.9.x

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Linux system running VirusScan Enterprise for Linux run slowly or stop responding under heavy load

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions:Draft for New Nav

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Linux system running VirusScan Enterprise for Linux run slowly or stop responding under heavy load

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title