Ekrn.exe CPU and memory high

[BerndH 0]

Hi,

need advice how to fix our current issue with Citrix Xenapp servers. Any help or idea to solve is highly appreciated.

 

What I have:

Citrix Xenapp 4.5 on Windows 2003 Enterprise

Endpoint Security 5.0.2228

around 30 servers in service, medium load

 

What's the issue:

For unknown reason server are getting slower till a full stop where it's completly unusable. It seems to be random but depends on server load. Server with higher load are often. What I see is the ekrn.exe takes one or two cores and starts to take more and more memory, up to 900MB. On two servers I get a chance to kill ekrn.exe and the issue went immediatly away. In the last three months I had around 12 "server down".  7 from 12 this week :-(.

 

What I did:

Check for Windows Updates

Upgrade for 5.0.2225 to 5.0.2228

Update RA to the 5.1.3.8

Change some servers to Windows File Server Security (need maintenance time)

 

Any idea? Any hotfix or any configuration to check?

[Marcos 5,281]

Please generate a dump of ekrn.exe when taking up too much memory by running "procdump -ma ekrn". When done, compress the dump and convey it to Customer care for further analysis.

[BerndH 0]

Update while I'm still waiting for a callback or email from support:

 

All servers are now on Windows File Server Security version. The number of threads for scanning are increased to 4. I still see a one or two cores full load from eset.exe. But ... the slow down of a server didn't happened till now.

In esetgui I see "Boots" as the last file scanned (?). Is this the boot sector or boot files scan?

 

[Marcos 5,281]

There has been an issue with ekrn spiking cpu recently which was caused by specially crafted (corrupt) xml files but this was already fixed earlier this week.

Please drop me a download link to the ekrn dump so that I can check it out.