High use of Memory by ESET Internet Security

[AlSky 4]

14 hours ago, itman said:

My memory usage has been in the 95 MB range all day after increasing from 40 MB or so at system startup time. However, this is double the amount observed yesterday. 

The point here is that your memory usage changes. It grows and decreases. It fluctuates. Mine only grows or, at best, remains high without decreasing. And it seems that administrators don't give a solution. I'm still waiting for an answer.

[Marcos 5,071]

1 hour ago, BeanSlappers said:

My friend had this problem too, even with his PC wouldn't boot back into windows normally.   So he removed eset.

I assume this was a different issue. Even a memory leak would not prevent Windows from booting since memory use would be low at the beginning. We'd like to look into it and ask the user to contact us for assistance.

[itman 1,659]

What I am observing is after an extended power down state such a return from Win 10 sleep mode, ekrn.exe will release memory. Also as I observed yesterday, the same will happen if the PC is idle for an extended period of time. Otherwise, memory usage keeps increasing. But I have not seen it exceed 100 MB or so on my device excluding Eset off-line scan use.

I also suspect that if a device has a background app task constantly running, Eset won't release memory. Therefore, one possible source here is additional security, backup, or the like software running.

Edited April 5, 2021 by itman

[AlSky 4]

2 hours ago, itman said:

What I am observing is after an extended power down state such a return from Win 10 sleep mode, ekrn.exe will release memory. Also as I observed yesterday, the same will happen if the PC is idle for an extended period of time. Otherwise, memory usage keeps increasing. But I have not seen it exceed 100 MB or so on my device excluding Eset off-line scan use.

I also suspect that if a device has a background app task constantly running, Eset won't release memory. Therefore, one possible source here is additional security, backup, or the like software running.

I didn't observe the release of memory after extended power down state. My computer may be up 13 hors without use and when I switch on it again the usage of RAM by ESET is the same as when I switched it off. Don't know what's the cause and I'd appreciate the support of administrators. because this happened recently, it dodn't happen previously.

[AlSky 4]

On 4/5/2021 at 10:19 AM, Marcos said:

I assume this was a different issue. Even a memory leak would not prevent Windows from booting since memory use would be low at the beginning. We'd like to look into it and ask the user to contact us for assistance.

Marcos, look the screenshot. After scaning the computer the usage of RAM raised above 500 Mb and doesn't return to normal usage. That's too much! Does it means I can't make scans of the computer?

I sent you a week ago the Log Collector you asked me for, no news. Wha's happening with my ESET product?

 

[AlSky 4]

More than 600 Mb...

[itman 1,659]

Are you letting Windows control the size of your page file? One possibility here is the page file size file is not large enough resulting in processes including ekrn.exe to use more memory than they normally would.

[AlSky 4]

12 hours ago, itman said:

Are you letting Windows control the size of your page file? One possibility here is the page file size file is not large enough resulting in processes including ekrn.exe to use more memory than they normally would.

The problem appeared in last days. That's the point. I didn't change anything, but ESET started to work badly.

[AlSky 4]

7 hours ago, BeanSlappers said:

I personally don't use pagefile at all and never had this problem.  It looks like this but from the screenshot looks like the user is using 8 or 8.1.

Yes, you are right, it's Windows 8.1. I found out that the problem happens just after on-demand computer scan. The first time was the March 28th, after scan, the usage of RAM reached 821 Mb and 25% of RAM. I uninstalled the ESET product in Safe Mode and reinstalled it. Immediately after installation the use of RAM was 164 Mb (normal) which grew to stop at 340 Mb. (This hapened last March 29th.) Yesterday I did a new scan and RAM usage reached over 700 Mb. I switched off the computer, waited more than 13 hours before switching on. No, like the previous time , more than 13 hours later and memory had not been free.

I forced the switched off of computer (it must not be done, but I didn't find another solution to close the process ekrn.exe without uninstalling again) and after this forced switched off the use of memory is relatively normal again: right now 270 Mb.

A computer friend of mine has told me that, in the absence of other problems with the computer or programs, ESET being the only one affected, it seems as if after on-demand scan the antivirus could not free the memory used. But then it would be a problem of the antivirus.

So, right now I can't use the on-demand computer scan except if I'm ready to uninstall and reinstall ESET every 10-15 days, or to force the switched off of the computer. And no, I don't want to do either.

I wonder if something has changed in the way ESET does on-demand computer scan. Until mid-March the analysis record did not show something that since the end of March it does: Working Memory = C :\Windows\explorer.exe - is correct

May it be the cause?

 

[itman 1,659]

It would have been helpful if you stated initially you were using Win 8.1.

Since almost everyone is using Win 10 currently with a few Win 7 "hold-outs," finding the source of this issue on your build might take a while,

I also recommend you open a tech support request with your local in-country Eset representative.

[AlSky 4]

8 minutes ago, itman said:

It would have been helpful if you stated initially you were using Win 8.1.

Since almost everyone is using Win 10 currently with a few Win 7 "hold-outs," finding the source of this issue on your build might take a while,

I also recommend you open a tech support request with your local in-country Eset representative.

I did it. That's why I came here looking for help. Technical support recommended uninstall and reinstall the ESET product. When it was seen that it didn't solve the problem, the support told me "it is a problem of your computer" without asking not even a Log Collector nor any other additional analysis. Simply they washed their hands of the problem. It's outrageous. The technich computer I mentioned above told me that you can't say so lightly that it's a problem on my computer without aditional tests. Just it's that: ESET is washing their hands of the problem.

Edited April 7, 2021 by AlSky

[itman 1,659]

High memory usage on Win 8.1 is nothing new. Back in 2014 or so it was traced back to an improperly configured network adapter setting:

https://www.youtube.com/watch?v=FzmzR3FFS8w

https://learningpenguin.net/2014/03/20/fixed-high-memory-usage-in-windows-8-1/

Microsoft supposedly fixed this via a Win Update patch.

However, here is the same behavior you're complaining about occurring in FireFox: https://www.bleepingcomputer.com/forums/t/696212/high-memory-usage/

Bottom line - I would "cut Eset some slack" on finding the source of the problem. You might also consider upgrading to Win 10.

[itman 1,659]

Since you're narrowed down the issue to Eset on-demand scanning, a few additional comments.

I have already posted there is an issue.  I observed on my Win 10 build that ekrn.exe allocated in the 240 MB range after the scan completed. It thereafter only released a portion of this with 170 MB still being used.

As to the possible source of this, I suspect WMI scanning. I noticed that WMI scan times have vastly improved recently. One possible reason is Eset may be using a lot more memory in the scanning process. When you perform your next on-demand scan, do a Custom scan and uncheck WMI scanning. When the scan completes, verify that ekrn.exe memory usage is still abnormally high.

Why this issue is more pronounced on your build is because it appears you have a lot of memory installed. Also, there appears to be a lot of free memory available. Eset therefore is using more memory on your device than on one with lesser memory installed.

Edited April 7, 2021 by itman

[AlSky 4]

5 hours ago, itman said:

Since you're narrowed down the issue to Eset on-demand scanning, a few additional comments.

I have already posted there is an issue.  I observed on my Win 10 build that ekrn.exe allocated in the 240 MB range after the scan completed. It thereafter only released a portion of this with 170 MB still being used.

As to the possible source of this, I suspect WMI scanning. I noticed that WMI scan times have vastly improved recently. One possible reason is Eset may be using a lot more memory in the scanning process. When you perform your next on-demand scan, do a Custom scan and uncheck WMI scanning. When the scan completes, verify that ekrn.exe memory usage is still abnormally high.

Why this issue is more pronounced on your build is because it appears you have a lot of memory installed. Also, there appears to be a lot of free memory available. Eset therefore is using more memory on your device than on one with lesser memory installed.

Thanks, itamn, for answering me, which the administrators don't do.

High RAM usage is the first time I've noticed it. Otherwise, I wouldn't worry. But it is the first time, before the use of RAM was rarely exceeding 200 Mb.

Nor would I worry if ESET used a lot of RAM for scan and then returned to normal. It is normal, programs and processes use more RAM during their operation. The problem is that it doesn't return to normal level, I already said: the RAM used is permanently occupied even if I switch off the computer and the only way to recover it is by uninstalling the ESET product or forcing the shutdown of the computer (forced shutdown). This is neither normal nor acceptable.

That's why it seems like a memory leak problem that is only solved by closing the process (forced shutdown is a way to close the process) or reinstalling the program... until you ask him to do again (scan) which causes the problem.

I think something has had to change in some recent update of the scan module and so now it looks like what I indicated above: now the scan record show "Working Memory = C :\Windows\explorer.exe - is correct". Working Memory, RAM. And that may be causing the problem. But in ESET nobody wants to know anything, it is easier to say, without proof, without even a Log Collector: "It is a problem of your computer". It's the most easy answer. Outrageus.

[AlSky 4]

13 hours ago, BeanSlappers said:

Hey Alsky,

Have you thought about upgrading to windows 10 IF your not getting windows updates??  I ask this because I found this:

https://docs.microsoft.com/en-us/lifecycle/products/windows-81

So I am thinking, that if your not getting windows updates at all, then might as well upgrade to 10, and see if that problem persists. 

Hello. I'm getting Windows updates monthly. Microsoft will release updates till January 2023. Here it's explained: https://answers.microsoft.com/en-us/windows/forum/all/windows-81-support-will-end-on-january-10-2023/68a198b3-7f64-44bb-bd1d-a8099958f6a5 So, by now, I'll receive updates as usual. Last update was in March with absolute normality.

On the other hand, I plan to buy new computer this year, I won't wait till 2023.

But the solution to this problem isn't to buy a new computer with Windows 10 or upgrade to that OS. The problem I'm currently experiencing is related to ESET and there is no guarantee that I won't suffer it on Windows 10 as well. This ESET problem has appeared recently, something fails, although since version 13.2.14.0 and later the ESET product gives me numerous bugs and erratic behavior (de-synchronization of the update module, problems updating (one day stopped searching for updates and there was no way I could update, I had to reinstall), protected browser that stops working) that technical support has been unable to fix.

My technic friend told me that if the problem affects only one program, the logical thing is to first rule out bugs in that program.

Microsoft told me the same thing. I explained the problem, and I was told that if the problem affects a single program and that program isn't part of Windows, first I should ask the program support service for help. And here I am, but those who can do something don't.

Edited April 8, 2021 by AlSky

[itman 1,659]

Win 8.1 market share of installed Win desktop installations is .38%.

The number of Eset installations on Win 8.1 would lower this figure more.

Personally, I can't see Eset expending resources to resolve this issue. If they do, it is assumed it will be a low priority matter.

[AlSky 4]

41 minutes ago, itman said:

Win 8.1 market share of installed Win desktop installations is .38%.

The number of Eset installations on Win 8.1 would lower this figure more.

Personally, I can't see Eset expending resources to resolve this issue. If they do, it is assumed it will be a low priority matter.

But all customers pay the same when we purchase our license. It isn't a valid argument that ESET has no interest in fixing problems for customers using a minority OS. I paid the same as you and everyone and I have the right to demand the same support. And if not, let ESET warn: "If you use the following OS (list) we won't be responsible for how the ESET product will work or solve any problems that arise".

But they don't, so I have right to support. No more than others, no less than others.

On the other hand, we don't know if the problem is related with the OS. Maybe yes, maybe not. So far, in the absence of a thorough analysis, the evidence points to a memory leak problem after doing an on-demand scan. The memory used is not free after it as it used to be (and as it should be anyway). Memory leak isn't a problem of the OS but of the specific software, in this case it's the ESET software.

On the other hand, I don't understand the apathy of the administrators. I thought that the Spanish support was bad, but I have seen that here is even worse. Administrator Marcos answered quickly requesting to dump of ekrn and log with Log Collector. As the English language isn't my native league and there are technical words that I don't understand well, I asked to indicate me with some screenshot how to do a dump of ekrn because I wanted neither to lose my time nor that of other persons doing a dump incorrectly. In other threads I have seen that are shown screenshots with the options that there is necessary to enable and disable in order to do some things. It isn't to ask too much the same deference. But there was no answer.

With something of patience on the same night I managed to do a dump of ekrn and the Log Collector (that last yes I knew how to do it). I sent it two times through PM to the administrator, two times because sometimes the reception of the MP can fail. No answer. Marcos has answered in this same thread to other users (to you between them) but not to the author of the thread.

Honestly, I don't understand the behavior of the administrator. In any case, he does a disservice to ESET.

[Marcos 5,071]

A ticket was created for developers several days ago and it's still pending for being processed. So far I have no news for you. Will keep you posted.

[AlSky 4]

7 hours ago, Marcos said:

A ticket was created for developers several days ago and it's still pending for being processed. So far I have no news for you. Will keep you posted.

Hello, Marcos. Thanks for answer. I sent you through PM the link with a new Log Collector I did just after the last event of high usage of RAM after on-demand scan. It will have more useful information than previous one, because the one I sent you first was done after reinstalling the ESET product. Also is possible comparing both logs and check differences of ESET working before and after on-demand scan.

[AlSky 4]

1 hour ago, BeanSlappers said:

Hey Marco's,

 

Well I hope this gets fixed because Alsky is right, he pays the same as us, and so therefor it shouldn't matter if he is using different to windows 10, this should be fixed and shouldn't be low priority.   This can tell people they they are not important enough to even been considered with their bugs etc.  I never intended to be a apart of a company with being an insider for this type of arrogance.

Thank you very much for your support. This is what we all need, people committed to helping and improve things.

[itman 1,659]

This is noteworthy.

I just ran an Eset custom scan of my OS drive excluding WMI and registry scanning; something I asked the OP to do. When the scan started, ekrn.exe was using approx. 90 MB. I monitored ekrn.exe memory usage for a while when the scan ran. I observed ekrn.exe memory usage rise and fall during the scan but never exceeding 120 MB, and at times using less memory than when the scan started. Unfortunately, the PC entered sleep mode while I was away, so I wasn't able to determine what ekrn.exe memory usage was at the end of the scan. Upon resume from sleep mode however, ekrn.exe was using 50 MB of memory.

"My money is on" WMI probably, and/or registry scanning as the culprit. Scanning of these areas have been problematic since Eset started doing so.

 

[AlSky 4]

9 hours ago, BeanSlappers said:

Welcome.   I have beta tested for other companies as well, but honestly, Zone alarm listened, a few others didn't, microsoft is finally listening more to us insiders.  I know eset listens most times, apart from the odd comeback with "my PC is not doing that"  well duh, all systems are different haha.   But it's the reason I do my best to help and present problems that rise for me, but also I don't like the arrogance at times either.  But then again most times the end results is better then during diags.

Thank you very much once again. We'll see what's the answer and what's the cause of the problem.

[AlSky 4]

12 hours ago, itman said:

This is noteworthy.

I just ran an Eset custom scan of my OS drive excluding WMI and registry scanning; something I asked the OP to do. When the scan started, ekrn.exe was using approx. 90 MB. I monitored ekrn.exe memory usage for a while when the scan ran. I observed ekrn.exe memory usage rise and fall during the scan but never exceeding 120 MB, and at times using less memory than when the scan started. Unfortunately, the PC entered sleep mode while I was away, so I wasn't able to determine what ekrn.exe memory usage was at the end of the scan. Upon resume from sleep mode however, ekrn.exe was using 50 MB of memory.

"My money is on" WMI probably, and/or registry scanning as the culprit. Scanning of these areas have been problematic since Eset started doing so.

 

This is the way my ESET product was working usually. I don't have the habit of checking the Task Manager, but the times I did it moved by curiosity to see how much RAM/disk/CPU use some particular process or several working simultaneously (browser, player, antivirus, etc.), I found that ESET rarely exceeded 200 Mb. When I did a scan it would increase, yes, but after finishing the scan it would return to normal levels. And now, simnce end of March, that doesn't happen: doesn't rturn to normal levels even by switching off and restarting the computer. I have to force a shutdown or reinstall the product. It's what's not normal. If during the scan it reached 600-700-800 Mb and then returned to normal use, ok. But it doesn't, it still uses RAM and keeps consuming more and more RAM and don't know why. (Last time I did on-demand scan the use of RAM after scan was 530 Mb and less than one hour after the scan was finished, instaed diminishing, it reached 700 Mb. Switching off and restarting the computer didn't help, I needed to force the shutdown. I suppose it close completely the ekrn.exe process and that's why the memory gets free again... till the next.)

[itman 1,659]

I just ran another Eset off-line scan. This time its was the default Smart scan which included WMI, registry, and a second internal HDD with two partitions that I have installed.

I also stated monitoring scan memory usage using Win Task Manger and switched to Process Explorer which gives much more detail on what is going on.

I can say with confidence, WMI and registry scanning are not factors in ekrn.exe memory usage. What was significant using Process Explorer was ekrn.exe fairly consistent memory usage. Starting at approx. 90 MB; rising to 114 MB; and staying at that level for the most part. Of interest was ekrn.exe memory usage when scanning a large file such as a Win 10 Feature Update .iso stored as a backup on the non-boot HDD. Ekrn.exe memory usage dropped to 54 MB while scanning this file.

Now for an of interest scan behavior. There were instances during the scan where "spikes" occurred in Win page file usage. The largest was a page file fault delta per Process Explorer of 2690. This indicates to me that either ekrn.exe or the OS itself will go to the page file as needed. If there is a problem there, I assume ekrn.exe will fallback to real memory usage. This confirms my prior suspicion there may be a page file configuration issue with this Win 8.1 device. It may be very well Eset has recently modified off-line scan behavior to use the page file more extensively and this is the reason for the high memory usage on this device.

Edited April 9, 2021 by itman

[Marcos 5,071]

@AlSkydoes temporarily disabling SSL filtering in the advanced setup and rebooting the machine make a difference in memory consumption?