Jump to content

Performance issues on file servers


Recommended Posts

We're running the latest version of Server Security and agent on our servers. The only ones that seem to be having performance issues are the file servers. Both high CPU and high memory usage attributable ekrn and causing excessive paging throughout the day.

These are basic Windows 2012 R2 servers with low utilization otherwise. All non-file servers with ESET are not experiencing issues, only file servers. ESET policies are pretty much default and applied to all member servers.

I've tried uninstalling and reinstalling ESET thinking that possibly in-place ESET upgrades over time may be causing issues, but there has been no improvement. This issue has been consistent and ongoing over several months.

Any insight is appreciated.

Link to comment
Share on other sites

  • ESET Moderators

Hello @j-gray,

we will need the logs to be able to check what is going on there.

Does the issue start right after the server reboot, or it takes some time to manifest?

 

For the start please create the Diagnostic dump (Advanced setup -> Tools -> Diagnostics) when the CPU and RAM usage by ekrn is high, collect the logs by ESET Log Collector, upload it to a safe location and send me the download details via a private message with reference to this forum topic.

I'm sorry to hear of such issues, hopefully we will be able to tackle them together.

 

Peter

Link to comment
Share on other sites

3 hours ago, Peter Randziak said:

Hello @j-gray,

we will need the logs to be able to check what is going on there.

Does the issue start right after the server reboot, or it takes some time to manifest?

 

For the start please create the Diagnostic dump (Advanced setup -> Tools -> Diagnostics) when the CPU and RAM usage by ekrn is high, collect the logs by ESET Log Collector, upload it to a safe location and send me the download details via a private message with reference to this forum topic.

I'm sorry to hear of such issues, hopefully we will be able to tackle them together.

 

Peter

@Peter Randziak Thanks for your reply. I don't have logging far back enough to see how soon it starts after a reboot. We only reboot once a month after Patch Tuesday.

The condition is flagged between 9 and 14 times per day, every day. There seems to be small patterns when it will happen sometimes every 2 hours (more or less), every 3 hours, or every 4 hours.

We're on holiday break now, so hardly any staff are present. The condition does not coincide with usage.

I'm watching for alerts of the condition recurrence and hope to collect logs soon.

Thanks again.

Link to comment
Share on other sites

  • ESET Moderators

Hello @j-gray,

O.K. that makes sense, when it comes to holiday the situation is similar here 😉 

 

I guess further logs might be needed, but the dump might give us a clue and is very easy to get (just please make sure to take it, when the resources consumption is high).

 

Do you know what is the actual CPU usage and RAM consumption by ekrn?

18 hours ago, j-gray said:

The condition is flagged between 9 and 14 times per day, every day. There seems to be small patterns when it will happen sometimes every 2 hours (more or less), every 3 hours, or every 4 hours.

So the resource consumption goes up, later drops, stays O.K. for a while and later goes up again in few hours?

 

The other logs I had in mind require rebooting the server so good to know, that you are restarting just after the patch Tuesdays... 😉 

Peter

Link to comment
Share on other sites

  • 2 weeks later...

 Memory consumption is pretty minimal, staying consistently around between 50-70MB. CPU utilization for ekrn averages around 35%. This is on a 4 proc, 3GHz Windows 2012 R2 server with 4GBs of RAM.

I haven't been able to catch it during high utilization. I get alerts from our monitoring system (Microsoft SCOM) and if I'm in the office at the time, whatever is causing it has cleared and its returned to ~35% utilization.

However, we don't see that high average CPU utilization on any other servers. 

Link to comment
Share on other sites

  • 2 weeks later...
  • ESET Moderators

@j-gray do you happen to know how long the high CPU utilization lasts?

Possibly, if that are just short peaks they might be related to ESET update and consequent Startup scan. 

If you have any new data / observations, let us know...

Peter

Link to comment
Share on other sites

@Peter Randziak Thanks for the follow-up. I have around 50 servers with the same version of ESET installed. I have only two file servers and these are the only servers exhibiting these symptoms on a regular basis. They see low resource utilization historically.

I have a feeling the excessive utilization is due to random file scanning during the day, though I still haven't been able to catch it as it's happening.

Link to comment
Share on other sites

  • ESET Moderators

Hello @j-gray 

you are welcome.

It is quite an interesting report so I wanted to have it checked.

On 1/18/2022 at 5:28 PM, j-gray said:

I have a feeling the excessive utilization is due to random file scanning during the day, though I still haven't been able to catch it as it's happening.

Not sure what kind of files are stored on those servers, but the not executable ones are being scanned very quickly.

It seems the issue is hiding well 🙂, which makes the troubleshooting harder 😞 

Peter

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...