McAfee VirusScan Enterprise 8.7i HotFix HF539488 (EngineServer.exe)

EngineServer.exe memory usage

Summary
This article explains expected behavior for the EngineServer.exe service, which is new to VirusScan Enterprise (VSE) 8.7i.

In the previous version (VSE 8.5i), scanner components ran inside the process they were protecting. This is also known as running "in-process." For example, EmailScan, providing scanning for Outlook, would cause the Outlook.exe process and memory space to load the Engine and DAT files, increasing its memory usage footprint significantly by adding the size of the DAT files and Engine.

This design had a limitation. If the Engine and DAT files encountered a serious problem, it would impact the entire process, potentially causing the process to fail or stop responding. This would require restarting the application.

VirusScan Enterprise 8.7i introduced EngineServer.exe, where the DATs and Engine are loaded to provide scanning services for scanner features (EmailScan, ScriptScan, and the Root-kit scan portion of On-Demand Scan). This is known as "out-of-process." The design solved the issue that resulted when the Engine and DATs encountered a problem.

EngineServer.exe loads an instance of the engine for each scanner that is running, as described. To improve memory management, EngineServer.exe retains instances of the Engine and DAT files in memory only if there are active scan requests for the scanner using that instance. If idle for 30 seconds or more, that instance of the Engine and DAT files is released from memory. A new scan request for that scanner causes an instance to be loaded again.

NOTE: When there are multiple instances of an application that uses a scanner (for example multiple instances of Outlook.exe) all instances share the same engine instance.

Problem 1
The OutlookScan feature can fail to release an instance of the scan engine that was loaded via EngineServer.exe. This can lead to symptoms of EngineServer.exe using large amounts of memory, until the service was restarted.

Problem 2
Memory usage is higher than expected

Because of the present (March 2010) size of virus definition files, it is reasonable to expect to use 50 MB of memory for a single instance of the Engine and DAT files.

If you find that the EngineServer service is using more than 150 MB of memory (in other words, more than three instances of the Engine and DAT files), and this memory is not released after being idle for more than 30 seconds, please install the hotfix.

Solution

Install the hotfix (HF539488)!

The Outlook UI library will now properly release the Engine instance on exit of Outlook.

The hotfix will be included in Patch 4 for VirusScan Enterprise 8.7i. Patch 4 is targeted for general availability release in mid-August 2010.

All SCF Members will receive download link via PM, simply post request in to reply to this Topic. Wink