cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
194
Views
5
Helpful
2
Replies
AndrewCirel
Beginner

Cisco AMP for Endpoints on Windows 2016 grabs more and more memory until it crashes

On our Windows 2016 Servers, Cisco AMP for Endpoints gradually takes more and more memory until the server crashes with memory exhaustion errors.  I looked at the memory usage on one of the servers just before it crashed and sfc.exe (Cisco AMP for Endpoints Connector) was using 18,661,428 Commit (KB), 227,656 Working Set (KB), 33,060 Shareable (KB) and 194,596 Private (KB).  So, Cisco AMP for Endpoints Connector has grabbed over 18GB of Memory.

I've upgraded to the latest version of Cisco AMP for Endpoints and it doesn't make a difference.

Any idea what could be causing this?

2 REPLIES 2
Jim2k
Beginner

first question i have is what does your policy look like? I have version 7.1.5 on 41 2016 servers and i have not seen that issue. with that said i only have it on my servers to capture trajectory info for investigation purposes. when i installed it i used the /skiptetra 1 So Av part of Clamav would not get installed.

 

a suggestion i have is to put it in debug mode and then look at the logs to see what files it is hitting. you may need some exclusions

Thanks for the reply.

I've tried the debug and it hasn't showed any issues.

Can I ask what the sfc.exe memory usage (Commit / Working Set / Shareable / Private) is for one of your servers running Cisco Amp that hasn't been rebooted for a couple of months.

I'm going to temporarily disable some of the components in a test lab and see if that isolates what is causing the issue.

Content for Community-Ad