Knowledge Center

Use the following diagnostic procedure to identify the component causing the high CPU usage. Identify the component in McAfee software involved in the resource usage issue:
Verify that the real-time anti-malware scanner is part of the issue with the "ZZZ" test, by configuring the real-time anti-malware scanner to only deliver files with a .zzz extension to the scan engine. This will eliminate the scan engine from involvement. If this causes CPU utilization to drop significantly, then the scan engine is the cause.

• For all Endpoint Security platforms, configure the What to Scan setting to ZZZ in the On-Access Scan policy:
  • On the client:
    1. Click Threat Prevention.
    2. Click Show Advanced.
    3. Click On-Access Scan.
    4. Scroll down to the section Processes Settings.
    5. Find the What to Scan setting.
    6. Click Specified file types only.
    7. Enter a value of ZZZ.
    8. Click Apply.
    9. If Configure different settings for High Risk and Low Risk processes is enabled, click the High Risk and Low Risk tabs of the Process Types section and repeat the above steps.
        
       NOTE: If using High Risk and Low Risk process scan settings, it may be helpful to test these one at a time.
        
  • In ePolicy Orchestrator:
     
    NOTE: You may choose to set a unique policy for this test and assign it only to test systems. Copy either the production policy or the McAfee Default policy and make the following modifications. Use the Modify Policy on a Single System function from the System Tree's Action menu to modify policy assignment.
     
    1. Open Policy Catalog and select the On-Access Scan policy.
    2. Click Show Advanced.
    3. Scroll down to the section Processes Settings.
    4. Find the What to Scan setting.
    5. Click Specified file types only.
    6. Enter a value of ZZZ.
    7. Click Save.
    8. If Configure different settings for High Risk and Low Risk processes is enabled, click the High Risk and Low Risk tabs of the Process Types section and repeat the above steps.
        
       NOTE: If using High Risk and Low Risk process scan settings, it may be helpful to test these one at a time.
        
• For MOVE AV Agentless/Multi-platform 4.0.x or 4.5.x, set the File Types to Scan to ZZZ in the On-Access Scan policy:
   
  NOTE: You may choose to set a unique policy for this test and assign it only to test systems. Copy either the production policy or the McAfee Default policy and make the following modifications. Use the Modify Policy on a Single System function from the System Tree's Action menu to modify policy assignment.
   
  1. In ePolicy Orchestrator, open Policy Catalog.
  2. Click the On-Access Scan policy.
  3. Click Show Advanced.
  4. Scroll down to File Types to Scan.
  5. Click Following only.
  6. Click Add.
  7. Enter a value of ZZZ.
  8. Click OK.
  9. Remove any other extensions already listed.
  10. Save the policy.
  11. Use an Agent wake-up call with the forced policy option to enforce the policy on the system. Alternatively, on Agentless SVMs, use the cmdagent -c -e function from /opt/McAfee/agent/bin/ in the console, or in Multi-platform SVMs, use the Check New Policy button on that system's Agent Status Monitor.
       
• For MOVE AV Agentless/Multi-platform 3.6.x, set the File Types to Scan to ZZZ in the On-Access Scan policy:
   
  NOTE: You may choose to set a unique policy for this test and assign it only to test systems. Copy either the production policy or the McAfee Default policy and make the following modifications. Use the Modify Policy on a Single System function from the System Tree's Action menu to modify policy assignment.
   
  • For Agentless:
    1. In ePolicy Orchestrator, open Policy Catalog.
    2. Click the Scan policy.
    3. Scroll down to File Types to Scan.
    4. Click Following only.
    5. Click Add.
    6. Enter a value of ZZZ.
    7. Click OK.
    8. Remove any other extensions already entered.
    9. Save the policy.
    10. Use an Agent wake-up call with the forced policy option to enforce the policy on the system. Alternatively, use the cmdagent -c -e function from /opt/McAfee/agent/bin/ in the console.
     
  • For Multi-platform:
    1. In ePolicy Orchestrator, open Policy Catalog.
    2. Select MOVE AV [Multi-Platform] Client 3.6.1 from the Product drop-down menu.
    3. Click the General policy.
    4. Click the Scan Items tab.
    5. Scroll down to File Types to Scan.
    6. Click Following only.
    7. Click Add.
    8. Enter a value of ZZZ.
    9. Click OK.
    10. Remove any other extensions already entered.
    11. Save the policy.
    12. Use an Agent wake-up call with the forced policy option to enforce the policy on the system. Alternatively, use the Check New Policy button on that system's Agent Status Monitor.
         
• For VirusScan Enterprise, set the What to scan property to ZZZ in the On-Access Scan module:
   
  • On the client:
    1. Right-click On-Access Scan and select Properties.
    2. Click All Processes.
    3. Click the Scan Items tab.
    4. For the What to scan property, click Specified File Types Only.
    5. Click Specified.
    6. Enter a value of ZZZ.
    7. Click Add.
    8. Click OK.
    9. Click Apply.
    10. Repeat these steps for High Risk processes and Low Risk processes if they are enabled.
         
        NOTE: If using High Risk and Low Risk process scan settings, it may be helpful to test these one at a time.
         
  • In ePolicy Orchestrator:
     
    NOTE: You may choose to set a unique policy for this test and assign it only to test systems. Copy either the production policy or the McAfee Default policy and make the following modifications. Use the Modify Policy on a Single System function from the System Tree's Action menu to modify policy assignment.
     
    1. Open Policy Catalog and select the On-Access Scan Default Processes Policy.
    2. Click the Scan Items tab.
    3. For the File Types to Scan property, click Specified File Types Only.
    4. Enter a value of ZZZ.
    5. Click Save.
    6. Repeat these steps for High Risk processes and Low Risk processes if they are enabled.
        
       NOTE: If using High Risk and Low Risk process scan settings, it may be helpful to test these one at a time.
        
    7. Use an Agent wake-up call with the forced policy option to enforce the policy on the system. Alternatively, use the Check New Policy button on that system's Agent Status Monitor.
        
• For VirusScan Enterprise for Linux, set the What to Scan property to ZZZ in the On-Access Scanning policy:
   
  NOTE: You may choose to set a unique policy for this test and assign it only to test systems. Copy either the production policy or the McAfee Default policy and make the following modifications. Use the Modify Policy on a Single System function from the System Tree's Action menu to modify policy assignment.
   
  1. In ePolicy Orchestrator, open Policy Catalog.
  2. Click the On-Access Scanning Policy.
  3. Click the Detections tab.
  4. Change the What to Scan setting to Specified file types.
  5. Enter a value of ZZZ.
  6. Click Save.
  7. Use an Agent wake-up call with the forced policy option to enforce the policy on the system. Alternatively, use the cmdagent -c -e function from /opt/McAfee/agent/bin/ in the console.
      

Progressively disable components in McAfee software to locate the specific component involved in the resource usage issue:
If the ZZZ test does not alleviate the high CPU utilization, the scan engine is efficiently scanning all the files that are sent to it. The next step is to determine exactly which subcomponent of the real-time anti-malware scanner is causing the symptom. To investigate, disable the various features of the product, one at a time. Between each, replicate the high CPU event and observe whether the high CPU utilization is alleviated.

• For all Endpoint Security platforms:
  1. Disable On-Access Scan. If the high CPU utilization drops, re-enable On-Access Scan and then disable the following options and test after each. Otherwise, continue to the next step.
     • Scan Boot Sectors
     • Scan Processes on enable
     • Scan Trusted installers (if there is an application installation involved)
     • ScriptScan
     • Scan on Network Drives
     • Scan when writing to disk
     • Scan when reading from disk
     • Find unknown unwanted programs and trojans
     • Find unknown macro threats
     • Scan inside archives
     • Decode MIME encoded files
     • Detect unwanted programs
  2. Disable Access Protection. If the high CPU utilization drops, re-enable Access Protection and then disable blocking and reporting on each of the Access Protection Rules and test after each. Otherwise, continue to the next step.
  3. Disable Exploit Prevention. If the high CPU utilization drops, re-enable Exploit Prevention and then disable each signature and Application Protection Rule and test after each.
      
• For MOVE AV Agentless/Multi-platform 3.6.x and 4.x:
  1. Disable Scan files when writing to disk and test. If the high CPU utilization does not drop, continue to the next step.
  2. Disable Scan files when reading from disk and test. If the high CPU utilization does not drop, continue to the next step.
  3. Disable Scan files on network mounted volumes and test.
      
• For VirusScan Enterprise:
  1. Disable On-Access Scan. If the high CPU utilization drops, re-enable On-Access Scan and then disable the following components and test after each. Otherwise, continue to the next step.
     • Scan Boot Sectors
     • Scan Processes on enable
     • Scan Trusted installers (if there is an application installation involved)
     • ScriptScan
     • Scan on Network Drives
     • Scan when writing to disk
     • Scan when reading from disk
     • Find unknown unwanted programs and trojans
     • Find unknown macro threats
     • Scan inside archives
     • Decode MIME encoded files
     • Detect unwanted programs
  2. Disable Access Protection. If the high CPU utilization drops, re-enable Access Protection and then disable blocking and reporting on each of the Access Protection Rules and test after each. Otherwise, continue to the next step.
  3. Disable On-Delivery Email Scanner. If the high CPU utilization drops, disable all of the subcomponents of the On-Delivery Email Scanner and test after each.
      
• For VirusScan Enterprise for Linux:
  Disable On-Access Scan. If the high CPU utilization drops, re-enable On-Access Scan and then disable the following components and test after each.
  • Scan files when writing to disk
  • Scan files when reading from disk
  • Scan files on network mounted volumes
  • Find unknown program viruses
  • Find unknown macro viruses
  • Find potentially unwanted programs
  • Find joke programs
  • Scan inside multiple-file archives
  • Decode MIME encoded files

Review the logs for the problematic component:
After you have identified the problematic component, it is often helpful to review the logs for that component. The logs will frequently identify the cause of the issue. For example, the VirusScan Enterprise log for On-Access Scan might be saturated with scan time-out messages from specific directories. These may even all be associated with the same third-party application.

Most McAfee product logs for Windows systems are located under %programdata%\McAfee\. MOVE AV Multi-platform logs are located in the installation directory for the product at c:\program files (x86)\McAfee\MOVE AV Server. McAfee logs from Mac and Linux systems are more easily viewed by collecting a Minimum Escalation Requirements (MER) file from the particular system. Please review the following articles for instructions to collect a MER file:

KB88197 - How to collect the Minimum Escalation Requirements file for Endpoint Security for Linux Threat Prevention
KB87626 - How to collect Minimum Escalation Requirements for Endpoint Protection for Mac, Endpoint Security for Mac, and VirusScan for Mac
KB80097 - How to generate the MOVE AV AntiVirus Agentless MER file
KB67272 - How to generate the VirusScan Enterprise for Linux MER file

Identify third-party applications involved in the issue:
It can be very helpful to identify which program is causing the most disk activity, thereby resulting in the most scan activity. Usually, the scan process (such as McShield.exe, Nails, or oasmanager) will be the top resource consumer and the application prompting all the disk activity will be the second highest CPU consumer. However, not all cases are that straightforward. If further clarification is needed, reintroduce the high CPU state and then begin shutting down third-party applications. After you identify the problematic application, attempt to progressively disable subcomponents of that application where appropriate.

Uninstall McAfee software:
If none of the above progressive disablement has demonstrated a drop in the CPU utilization, uninstall the McAfee real-time anti-malware scanning software and then check the state of the CPU utilization.