High CPU usage after install

[sbateman17]

We have just installed AMP for endpoints on all of our workstations.  We now seem to be getting a lot of complaints about slowness, when I go into Task Manager on there PCs the process (sfc.exe) is a lot of times consuming their CPU.  I checked too see if it was scanning which it is not per the workstation or Dashboard.  Is there any steps we can take on the Sourcefire connector to keep the CPU usage fairly low.

[Rick Rowe]

We had the same issue with servers and had to create exclusion lists for several types of devices. Did you try the recommended exclusion list from cisco? If so, the check the DIAG tool.

http://www.cisco.com/c/en/us/support/docs/security/advanced-malware-protection-endpoints/118802-technote-fireamp-00.html

[sbateman17]

Thanks Rick, this helped a lot.  It seems the generic exclusions Cisco had for McAfee were a little outdated from what we have with McAfee.  McAfee recently upgraded their Endpoint Solution to ePolicy cloud based solution, so the file paths which they had us exclude were actually not valid on our Endpoints.  I thought this would have covered it (CSIDL_PROGRAM_FILES\Common Files\McAfee) but it apparently does not, maybe I am wrong here but I added this Path: to our exclusions list. 

Path: C:\Program Files\Common Files\McAfee\AVSolution\mcshield.exe

After doing so the sfc.exe process drastically dropped to <1% on my CPU usage.  I will continue to monitor but I believe this helped.   Thanks again.  

[Jetsy Mathew]

Hello Sbateman,

The behaviour what you saw with the latency is expected if you didnt use the exclusions. To isolate the issue as a best practice , you can try installing the Fireamp in a test machine and put these exclusions and monitor for few days.

http://www.cisco.com/c/en/us/support/docs/security/advanced-malware-protection-endpoints/118802-technote-fireamp-00.html

If it still continues check the policy that has applied for this machines .If the behaviour continues, then as the second test please disable the policy and see if the latency reduces. 

Rate and mark the answers correct and the posts which helps you

Regards

Jetsy