j-gray 35 Posted December 21, 2021 Share Posted December 21, 2021 We're running the latest version of Server Security and agent on our servers. The only ones that seem to be having performance issues are the file servers. Both high CPU and high memory usage attributable ekrn and causing excessive paging throughout the day. These are basic Windows 2012 R2 servers with low utilization otherwise. All non-file servers with ESET are not experiencing issues, only file servers. ESET policies are pretty much default and applied to all member servers. I've tried uninstalling and reinstalling ESET thinking that possibly in-place ESET upgrades over time may be causing issues, but there has been no improvement. This issue has been consistent and ongoing over several months. Any insight is appreciated. Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted December 22, 2021 ESET Moderators Share Posted December 22, 2021 Hello @j-gray, we will need the logs to be able to check what is going on there. Does the issue start right after the server reboot, or it takes some time to manifest? For the start please create the Diagnostic dump (Advanced setup -> Tools -> Diagnostics) when the CPU and RAM usage by ekrn is high, collect the logs by ESET Log Collector, upload it to a safe location and send me the download details via a private message with reference to this forum topic. I'm sorry to hear of such issues, hopefully we will be able to tackle them together. Peter Link to comment Share on other sites More sharing options...
ESET Staff IggyPop 20 Posted December 22, 2021 ESET Staff Share Posted December 22, 2021 Hi @j-gray, One question are you not using a Datto RMM within your environment? Thanks. Ingemar j-gray 1 Link to comment Share on other sites More sharing options...
j-gray 35 Posted December 22, 2021 Author Share Posted December 22, 2021 2 hours ago, IggyPop said: Hi @j-gray, One question are you not using a Datto RMM within your environment? Thanks. Ingemar No, we are not. Link to comment Share on other sites More sharing options...
j-gray 35 Posted December 22, 2021 Author Share Posted December 22, 2021 3 hours ago, Peter Randziak said: Hello @j-gray, we will need the logs to be able to check what is going on there. Does the issue start right after the server reboot, or it takes some time to manifest? For the start please create the Diagnostic dump (Advanced setup -> Tools -> Diagnostics) when the CPU and RAM usage by ekrn is high, collect the logs by ESET Log Collector, upload it to a safe location and send me the download details via a private message with reference to this forum topic. I'm sorry to hear of such issues, hopefully we will be able to tackle them together. Peter @Peter Randziak Thanks for your reply. I don't have logging far back enough to see how soon it starts after a reboot. We only reboot once a month after Patch Tuesday. The condition is flagged between 9 and 14 times per day, every day. There seems to be small patterns when it will happen sometimes every 2 hours (more or less), every 3 hours, or every 4 hours. We're on holiday break now, so hardly any staff are present. The condition does not coincide with usage. I'm watching for alerts of the condition recurrence and hope to collect logs soon. Thanks again. Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted December 23, 2021 ESET Moderators Share Posted December 23, 2021 Hello @j-gray, O.K. that makes sense, when it comes to holiday the situation is similar here 😉 I guess further logs might be needed, but the dump might give us a clue and is very easy to get (just please make sure to take it, when the resources consumption is high). Do you know what is the actual CPU usage and RAM consumption by ekrn? 18 hours ago, j-gray said: The condition is flagged between 9 and 14 times per day, every day. There seems to be small patterns when it will happen sometimes every 2 hours (more or less), every 3 hours, or every 4 hours. So the resource consumption goes up, later drops, stays O.K. for a while and later goes up again in few hours? The other logs I had in mind require rebooting the server so good to know, that you are restarting just after the patch Tuesdays... 😉 Peter Link to comment Share on other sites More sharing options...
j-gray 35 Posted January 4, 2022 Author Share Posted January 4, 2022 Memory consumption is pretty minimal, staying consistently around between 50-70MB. CPU utilization for ekrn averages around 35%. This is on a 4 proc, 3GHz Windows 2012 R2 server with 4GBs of RAM. I haven't been able to catch it during high utilization. I get alerts from our monitoring system (Microsoft SCOM) and if I'm in the office at the time, whatever is causing it has cleared and its returned to ~35% utilization. However, we don't see that high average CPU utilization on any other servers. Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted January 18, 2022 ESET Moderators Share Posted January 18, 2022 @j-gray do you happen to know how long the high CPU utilization lasts? Possibly, if that are just short peaks they might be related to ESET update and consequent Startup scan. If you have any new data / observations, let us know... Peter Link to comment Share on other sites More sharing options...
j-gray 35 Posted January 18, 2022 Author Share Posted January 18, 2022 @Peter Randziak Thanks for the follow-up. I have around 50 servers with the same version of ESET installed. I have only two file servers and these are the only servers exhibiting these symptoms on a regular basis. They see low resource utilization historically. I have a feeling the excessive utilization is due to random file scanning during the day, though I still haven't been able to catch it as it's happening. Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted January 20, 2022 ESET Moderators Share Posted January 20, 2022 Hello @j-gray you are welcome. It is quite an interesting report so I wanted to have it checked. On 1/18/2022 at 5:28 PM, j-gray said: I have a feeling the excessive utilization is due to random file scanning during the day, though I still haven't been able to catch it as it's happening. Not sure what kind of files are stored on those servers, but the not executable ones are being scanned very quickly. It seems the issue is hiding well 🙂, which makes the troubleshooting harder 😞 Peter Link to comment Share on other sites More sharing options...
Recommended Posts