cdm probe alarms due to high cpu usage caused by mcafee scan

Document ID : KB000046160
Last Modified Date : 14/02/2018
Show Technical Document Details

Problem:

A customer has a machine that runs a virus scan at a set time. During this time period the McAfee mcshield.exe process consumes 100% of cpu for the duration of the scan ( 1 1/2 hr - 3 hrs) causing the cdm probe to alarm on total cpu usage. The customer did not want to process the alarm when the McAfee scan was in progress.
 

Environment:

- Windows Server 2008 SR2
- cdm probe
- McAfee scan

Workaround:

Using the nas probe, create a preprocessing rule.

probe: cdm
robot: <source_robot_name>
message string: /.*total cpu is.*/
Action: exclude (delete) or make the alarm invisible

Optionally, set the 'Operating Period' of the profile as desired so the preprocessor rule will only be active during those hours.

Additional Information:

It is also advisable to visit the McAfee support web site and search the Knowledge Center for 'high CPU usage':

Troubleshooting high CPU usage related to Disk I/O and McShield
https://kc.mcafee.com/corporate/index?page=content&id=KB67891

FAQs about McShield.exe and high CPU utilization when running On-Demand scans
https://kc.mcafee.com/corporate/index?page=content&id=KB85299&snspd-0815

How could I limit McAfee's CPU usage during scans?
https://community.mcafee.com/thread/81746?tstart=0