Jump to content

Seems like a memory leak


Recommended Posts

So far ESET 8.0.319.0 seems like a winner of the memory eating contest on my computer. Right now it's working set is 514 MB. It would be ok except when I run SQL server (allowing it to take 12post-10992-0-98363200-1455849654_thumb.png GB out of 16) and with other programs taking some RAM I do see too much swapping. Any advice would be appreciated.

 

Task manager screenshot is attached.

 

D.

 

Link to comment
Share on other sites

  • Administrators

Could you please create a complete application memory dump of ekrn.exe from that state? Are you able to reproduce it with the latest version 9?

Link to comment
Share on other sites

Could you please create a complete application memory dump of ekrn.exe from that state? Are you able to reproduce it with the latest version 9?

 

I am sure other users create ekrn.exe dumps every day. But I am not that proficient yet. Could you tell me how to do it, please?

And I never tried V9. When I try to update through the GUI it does not offer V9. And there is no point in reinstalling.

 

Thank you and sorry for a late reply.

Link to comment
Share on other sites

 

Could you please create a complete application memory dump of ekrn.exe from that state? Are you able to reproduce it with the latest version 9?

 

I am sure other users create ekrn.exe dumps every day. But I am not that proficient yet. Could you tell me how to do it, please?

And I never tried V9. When I try to update through the GUI it does not offer V9. And there is no point in reinstalling.

 

Thank you and sorry for a late reply.

 

 

Actually, don't answer that. I found a "create dump" menu item in the task manager. Now what do I do with it? It is too big to post it here (108 MB compressed with rar).

Link to comment
Share on other sites

 

 

Could you please create a complete application memory dump of ekrn.exe from that state? Are you able to reproduce it with the latest version 9?

 

I am sure other users create ekrn.exe dumps every day. But I am not that proficient yet. Could you tell me how to do it, please?

And I never tried V9. When I try to update through the GUI it does not offer V9. And there is no point in reinstalling.

 

Thank you and sorry for a late reply.

 

 

Actually, don't answer that. I found a "create dump" menu item in the task manager. Now what do I do with it? It is too big to post it here (108 MB compressed with rar).

 

 

Well, should I just shut up and go away with my problem. Seems nobody cares. And EKRN.EXE consumed 606 MB of RAM already.

Link to comment
Share on other sites

Thank you for the instructions. But it kind of kills the point of creating a memory dump. Instructions require a restart after which for about a week EKRN.exe process will allocate pretty low amount of memory. I will have to wait for a week before I can make a dump.

Link to comment
Share on other sites

 

(dimulec)  Instructions require a restart after which for about a week EKRN.exe process will allocate pretty low amount of memory. I will have to wait for a week before I can make a dump.

oops, too late (2 answers before I sent mine). Read on nonetheless if you have the 108 MB ".rar" still...

 

 

(dimulec) (...) Well, should I just shut up and go away with my problem. Seems nobody cares. And EKRN.EXE consumed 606 MB of RAM already.

 

a definite no.

 

 

(dimulec) (...) Now what do I do with it? It is too big to post it here (108 MB compressed with rar).

 

Well done. If you have a Dropbox account, you could proceed as described here, https://forum.eset.com/topic/7274-eset-ss9-huge-memory-leak-with-outlook-2016/#entry40499,

or, untested, so take the necessary precautions, you could upload it here, https://labstack.com/up,when uploaded proceed as mentioned above already.

 

Whether using Dropbox, LabStack or any other 3rd party service think about privacy, ie. a memory dump, especially a complete memory dump, shouldn't go unsecured over the internet (no 'https') to ESET. (Ie. you should encrypt the compressed file locally on your PC and upload this. And PM the password too of course.)

 

The primary question on the other hand is if you effectively have a memory leak. It could be a memory leak with higher probability, if and only if the memory size of ekrn.exe goes up and never (significantly) down. On my Win7 PC, ESS V9.0.349.0, memory size is between 180 - 437 MB. Thus 606 MB seems to be a little bit high, but ... Conclusion: check the memory size of ekrn.exe immediately after starting your PC / laptop, after every AV update, every half hour, and before shutting your PC / laptop down. And try to correlate with what you have done.

 

 

Link to comment
Share on other sites

 

 

(dimulec)  Instructions require a restart after which for about a week EKRN.exe process will allocate pretty low amount of memory. I will have to wait for a week before I can make a dump.

oops, too late (2 answers before I sent mine). Read on nonetheless if you have the 108 MB ".rar" still...

 

 

(dimulec) (...) Well, should I just shut up and go away with my problem. Seems nobody cares. And EKRN.EXE consumed 606 MB of RAM already.

 

a definite no.

 

 

(dimulec) (...) Now what do I do with it? It is too big to post it here (108 MB compressed with rar).

 

Well done. If you have a Dropbox account, you could proceed as described here, https://forum.eset.com/topic/7274-eset-ss9-huge-memory-leak-with-outlook-2016/#entry40499,

or, untested, so take the necessary precautions, you could upload it here, https://labstack.com/up,when uploaded proceed as mentioned above already.

 

Whether using Dropbox, LabStack or any other 3rd party service think about privacy, ie. a memory dump, especially a complete memory dump, shouldn't go unsecured over the internet (no 'https') to ESET. (Ie. you should encrypt the compressed file locally on your PC and upload this. And PM the password too of course.)

 

The primary question on the other hand is if you effectively have a memory leak. It could be a memory leak with higher probability, if and only if the memory size of ekrn.exe goes up and never (significantly) down. On my Win7 PC, ESS V9.0.349.0, memory size is between 180 - 437 MB. Thus 606 MB seems to be a little bit high, but ... Conclusion: check the memory size of ekrn.exe immediately after starting your PC / laptop, after every AV update, every half hour, and before shutting your PC / laptop down. And try to correlate with what you h

 

 

 

(dimulec)  Instructions require a restart after which for about a week EKRN.exe process will allocate pretty low amount of memory. I will have to wait for a week before I can make a dump.

oops, too late (2 answers before I sent mine). Read on nonetheless if you have the 108 MB ".rar" still...

 

 

(dimulec) (...) Well, should I just shut up and go away with my problem. Seems nobody cares. And EKRN.EXE consumed 606 MB of RAM already.

 

a definite no.

 

 

(dimulec) (...) Now what do I do with it? It is too big to post it here (108 MB compressed with rar).

 

Well done. If you have a Dropbox account, you could proceed as described here, https://forum.eset.com/topic/7274-eset-ss9-huge-memory-leak-with-outlook-2016/#entry40499,

or, untested, so take the necessary precautions, you could upload it here, https://labstack.com/up,when uploaded proceed as mentioned above already.

 

Whether using Dropbox, LabStack or any other 3rd party service think about privacy, ie. a memory dump, especially a complete memory dump, shouldn't go unsecured over the internet (no 'https') to ESET. (Ie. you should encrypt the compressed file locally on your PC and upload this. And PM the password too of course.)

 

The primary question on the other hand is if you effectively have a memory leak. It could be a memory leak with higher probability, if and only if the memory size of ekrn.exe goes up and never (significantly) down. On my Win7 PC, ESS V9.0.349.0, memory size is between 180 - 437 MB. Thus 606 MB seems to be a little bit high, but ... Conclusion: check the memory size of ekrn.exe immediately after starting your PC / laptop, after every AV update, every half hour, and before shutting your PC / laptop down. And try to correlate with what you have done.

 

Thank you. I uploaded the old process dump to one of my hostings and will try to notify Marcos. But now I am thinking that since I will have to renew my license in less than a month anyway and this time it will be V9 so maybe there is no point in investigating this issue.

Link to comment
Share on other sites

 

Thank you for the instructions. But it kind of kills the point of creating a memory dump. Instructions require a restart after which for about a week EKRN.exe process will allocate pretty low amount of memory. I will have to wait for a week before I can make a dump.

 

A week ? I can make ekrn.exe reach the 400-600mb interval within 6 hours or so. Still, ESET do want a complete memory dump for analysis, so even if you have to wait a week, the full dump will include what they need to possibly find the issue that cause it.

 

When the dump is created you have to compress it before you upload it, I don't do it myself since my upload speed is too slow so it would take an eternity to get the dump uploaded.

 

But perhaps the old dump you uploaded and notified Marcos about will be enough, we have to wait and see I guess.

 

But now I am thinking that since I will have to renew my license in less than a month anyway and this time it will be V9 so maybe there is no point in investigating this issue.

 

I would say there is since I have experienced the leak with both V8 and V9.

Edited by SweX
Link to comment
Share on other sites

I have recently built a new gaming rig  and ist's running  WIN7 x64 ultimate , i installed the not so greatest but latest version of eset on that rig, and over a period of around 2 days that hogging  main eset process was hogging around 2-300mb and that is on an almost ildle machine with very few 3rd party software /drivers installed , The version 7  however seems to run and remain at around 130mb 

 

IMO Eset had a reputation for providing a robust security solution  that was one of if not THE lightest on system resources this was very popular amongst  online gamers and others who enjoy a snappy PC  but over the recent past eset seems to have almost abandoned  what they where good at

and followed like sheep the other security suite vendors  with it's annual new versions, as well as adding imo some bloat, All i can guess is eset are aiming at the clueless home user now,

 

Just why does the latest version consume more physical memory and other resources ?

Link to comment
Share on other sites

Just why does the latest version consume more physical memory and other resources ?

No, it doesn't consume that much more memory, around 140MB is normal for V9. If it reaches 300MB as you mention in your post then you are probably affected by the leak. If you have a fast upload connection and are willing to help out, then create a complete memory dump and uploaded it somewhere so ESET can download and analyze it, and hopefully it will shed some light on why some users are having this problem.

 

hxxp://support.eset.com/kb380/

Link to comment
Share on other sites

A comment about memory leak:

Note that constantly increasing memory usage is not necessarily evidence of a memory leak. Some applications will store ever increasing amounts of information in memory (e.g. as a cache). If the cache can grow so large as to cause problems, this may be a programming or design error, but is not a memory leak as the information remains nominally in use. In other cases, programs may require an unreasonably large amount of memory because the programmer has assumed memory is always sufficient for a particular task; for example, a graphics file processor might start by reading the entire contents of an image file and storing it all into memory, something that is not viable where a very large image exceeds available memory.

To put it another way, a memory leak arises from a particular kind of programming error, and without access to the program code, someone seeing symptoms can only guess that there might be a memory leak. It would be better to use terms such as "constantly increasing memory use" where no such inside knowledge exists.

 

Ref.:https://en.wikipedia.org/wiki/Memory_leak

Edited by itman
Link to comment
Share on other sites

A comment about memory leak:

Note that constantly increasing memory usage is not necessarily evidence of a memory leak. Some applications will store ever increasing amounts of information in memory (e.g. as a cache). If the cache can grow so large as to cause problems, this may be a programming or design error, but is not a memory leak as the information remains nominally in use. In other cases, programs may require an unreasonably large amount of memory because the programmer has assumed memory is always sufficient for a particular task; for example, a graphics file processor might start by reading the entire contents of an image file and storing it all into memory, something that is not viable where a very large image exceeds available memory.

To put it another way, a memory leak arises from a particular kind of programming error, and without access to the program code, someone seeing symptoms can only guess that there might be a memory leak. It would be better to use terms such as "constantly increasing memory use" where no such inside knowledge exists.

 

Ref.:https://en.wikipedia.org/wiki/Memory_leak

 

Thank you for trying to bring political correctness into the software development business. Except... I wrote my first program for a "system" based on КР580ИК80 (8080) CPU with 1 kilobyte of RAM. That was 31 years ago. Now I am working with 8 bit microcontrollers equipped with 2-32 KB of ROM and 256-1024 bytes of RAM. In my opinion, programmers which do not care how much RAM their programs are using just too young to work on serious projects.

 

I guess we can just close this topic as it seems that ESET people are not going to take a look at the memory dump that I sent to them. And this is ok as I prefer them to fight viruses first leaving other issues at the end of the list. It is easier for me to add another 16 GB of RAM to my computer than to change the proven antivirus engine.

Link to comment
Share on other sites

@itman

 

In this case it really is a leak. But it is not a consistent leak as it comes and goes with the module updates. The IPM (internet protection module) can get updated - and after that I can browse and browse and browse, and watch videos on websites using either Flash or html5 and the ram usage will stay within 140-150mb.

 

Then after the next IPM update, and I do the same procedure as above, the ram usage (if I am unlucky) can go up up up, starting at the normal 140mb and eventually hit the roof at 740mb.

 

All I can say is that this is not a normal behavior for the software as I have had leaks like this a couple of times with previous version, and they have been fixed after I've reported about them, there may be a usage of some kind of cache, but not that it can cause this huge increase. It most likely is a problem with that the ram doesn't get released correctly or something like that, but I am no programmer so I won't speculate.

 

Normal for ESET is that the ram usage is very steady and ekrn.exe stays around the same interval 140-150mb no matter if you run a on-demand scan or not, since the engine and the sigs are loaded in the ram all the time for the best system performance. Where some other AVs may use e.g 30mb of ram on idle - but when you start a scan the ram usage may increase to 300-400mb cause other parts of the software are loaded into the ram at that point. But ESET is not (and have never been afaik) designed/engineered that way.

 

(The exception is when the VSD get's updated, then it's perfectly normal that the ekrn.exe ram usage can go up to 200-300mb and then drop down to around 140mb as soon as the update procedure is finished. For example, the top usage for ekrn.exe today is 274mb, and I know that top usage happened during the VSD update procedure.)

 

If I had a faster upload speed then a memdump would have been sent to ESET for analysis ages ago, but I don't, so I leave this to other souls that are willing to help out.

 

@dimulec, We have not heard what they said about your dump yet, but it may not help at all since it was not a complete memory dump which usually is required and also recommended.

Edited by SweX
Link to comment
Share on other sites

We actually have another on going thread about this: https://forum.eset.com/topic/6317-eset-smart-security-9-memory-leak/

 

Would be good if we could keep all talk - and all information about it, in one thread.

 

This is a screenshot from yesterday of my ekrn.exe ram usage right before I shut the PC off...

 

post-320-0-26403800-1457080994_thumb.jpg

Link to comment
Share on other sites

  • 1 month later...

Well, should I just shut up and go away with my problem. Seems nobody cares. And EKRN.EXE consumed 606 MB of RAM already.

It's exactly what im thinking too

Link to comment
Share on other sites

 

Well, should I just shut up and go away with my problem. Seems nobody cares. And EKRN.EXE consumed 606 MB of RAM already.

It's exactly what im thinking too

 

They do care but they might need your help.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...