Loading...

Knowledge Center


High CPU utilization on the macompatsvc process and delay in policy enforcement when using large policies
Technical Articles ID:   KB87272
Last Modified:  6/9/2016
Rated:


Environment

McAfee Agent 5.0.x

Problem

During policy enforcement, CPU utilization may spike on the macompatsvc process. The CPU utilization percentage may vary depending on how many processors the system has. For example, for a system using only one processor, the macompatsvc process may use up to 100% CPU utilization during policy enforcement. However, on a system using four processors, the macompatsvc process may only use up to 25% CPU utilization during policy enforcement. Typically this will last only a short time, as long as it takes to enforce the policies, which is usually less than a couple of minutes in this situation.

Problem

It may take several minutes before any new policies being enforced take effect. Normally, when the agent receives a new policy setting from the ePolicy Orchestrator server, you may notice that this policy takes effect immediately on the client system after you see the following log activity in masvc_<system name>.log:
Agent finished Enforcing policies
However, when using a large policy, you may not see any signs on the client system that the new policy has taken effect for several minutes. In cases where a very large policy is being used, it may take up to 10 minutes before the new policy takes effect on the client system.

The severity of this issue is largely dependent on the size of the policy file being sent to the client system. The larger the policy, the longer it will take to enforce the policy. The policy for McAfee Agent is stored in a file named mapolicy.db, which is typically located in one of the following directories:

C:\ProgramData\McAfee\Common Framework\DB
C:\ProgramData\McAfee\Agent\DB


In most cases, a typical size for the mapolicy.db file may be around 300 KB or less. With all cases experiencing this issue, the policy file is 2 MB or larger.

Cause

This issue is caused by a large amount of reads on the policy file (mapolicy.db) when a large policy exists. A large policy could be considered typical when using some products, such as Host Intrusion Prevention. 

Solution

This issue is resolved in McAfee Agent 5.0.4, which is available from the Product Downloads site at: http://mcafee.com/us/downloads/downloads.aspx

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Updates are cumulative; Technical Support recommends that you install the latest one.


This issue is also resolved in McAfee Agent 5.0.3 Hotfix 1131329, which is available from the Product Downloads site.

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Rate this document

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.