Jump to content
Cody

ESET Endpoint Security 7.1 uses more and more RAM as time goes on

Recommended Posts

Over the course of several days, if ESET Endpoint Security 7.1.2045.5 is left running, it will gradually use up more and more memory, and ESET's ekrn process will climb to the top of the process usage chart in Task Manager, sometimes consuming up to 70% of the machine's memory by itself, even surpassing the memory usage of Chrome with 20+ tabs open. After just a few days of running, the computer becomes almost unusable, showing audio and video skipping and other symptoms of low RAM availability for other applications. This is all happening on computers running Windows 10 1803, with 8 or 16 GB of RAM installed, which is well within the hardware requirements.

When I uninstall Endpoint Security, the problem goes away.

I tested out version 6.5 something like a year ago, and reported identical problems to support, but the problem was never resolved. Hoping that it had been fixed a whole year later, I downloaded version 7.1, and it still seems to be having similar memory usage problem. 

Share this post


Link to post
Share on other sites

Please carry on as follows (run all commands as an administrator):
- temporarily disable self-defense and reboot the machine
- enable heap tracing for ekrn by running wpr -HeapTracingConfig ekrn.exe enable
- reboot the machine
- run wpr -HeapTracingConfig ekrn.exe and make sure Heap tracing is enabled for process ekrn.exe is displayed
- start tracing by running wpr -start Heap -filemode
- reproduce the issue (ekrn memory usage should be above 200-300 MB)
- stop tracing by running wpr -stop heap_trace.etl
- re-enable Self-defense and reboot the machine
- compress heap_trace.etl, upload it to a safe location and drop me a personal message with a download link.

Share this post


Link to post
Share on other sites

Marcos,

 

Thanks for the reply. When you say "temporarily disable self-defense," which ESET features are you referring to?

Share this post


Link to post
Share on other sites

We have pinpointed a memory leak in the memory dumper. A fix is being reviewed and will be released through an automatic module update next week.

Share this post


Link to post
Share on other sites

Thanks for the reply. We've been having some trouble getting a decent memory dump while this problem is occurring, but I am looking forward to seeing whether this fix mitigates the problem or not. Is there any way that you could reply here with the version number when that fix is released so that we can test it out as soon as possible?

 

Thanks.

Share this post


Link to post
Share on other sites

It was fixed in the Antivirus and antispyware module 1553.  You can download it even now by switching the update channel to pre-release updates in the advanced update setup.  We'll start releasing it gradually in batches to all users as of the next week.

Share this post


Link to post
Share on other sites

I've tested with latest build but still facing the same issue..

 

image.png.797041c4b79273d66b8dba73213432b0.png

 

image.png.f3db3e7a28e2b9c8a4495639d9aaf9e4.png

Share this post


Link to post
Share on other sites
21 minutes ago, Ali Akbar said:

I've tested with latest build but still facing the same issue..

Then please follow my instructions above that I posted on June 11.

Share this post


Link to post
Share on other sites
Posted (edited)

Marcos,

The memory usage doesn't seem to climb quite so high, even after several days of running the newer versions.

However, we are still experiencing audio "artifacting" or "glitching" when ESET is installed and a computer is run for several days, and audio is playing in any program. When ESET is uninstalled, this does not happen. When there is audio artifacting, I do notice that ESET's memory usage goes from about 0% up to 0.4% or 0.6% of about 16GB of available RAM. Is this a situation where we want to try and catch a memory dump while this error is occurring?

Edited by Cody

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...