High Memory usage by AexSVC.exe while trying to push the Symantec Management Agent

Products

• IT Management Suite

Issue/Introduction

The customer noticed that while trying to push the Symantec Management Agent, the Altiris Service (AeXSvc.exe) starts consuming a lot of memory until the point it runs out. This memory consumption is gradual before it runs out. 

You may noticed errors / failures in the NS logs while trying to reach some of the machines that the agent is pushed to.

Environment

ITMS 8.5

Cause

In this particular instance, the customer was pushing the Symantec Management Agent using a static computer list as target rather than the default one. The push agent process was pushing over and over to the same machines. As well the schedule used was too frequent.

After reviewing a memory dump collected while AexSvc.exe was consuming a lot of memory, it showed the following:

There is problem with .Net GC "Finalize" thread. It is busy (or stalled) during destruction of WMI objects and its queue gets filled with other objects waiting for destruction.
These WMI objects are spawned during discovery push operations to collect target agent information. If we will combine logs and dump, looks like windows WMI provider was dead - lot of errors that data can't be collected.

The memory usage issue is caused by this Microsoft API and the AeXSvc.exe is just a victim of that.

Resolution

Rebooting the SMP server should release the memory and clear out the faulty WMI objects.

If you still continue experiencing problems during Agent Push and its discovery task, you can try to tweak Push process to ignore WMI by this core setting:
  <customSetting key="PushDiscoveryAllowance" type="local" defaultValue="NetAPI, Registry"/>
 

So Agent Push process will not use AD or WMI to collect data. (all possible values are: AD, WMI, NetAPI, Registry)

By default, it is set to:
  <customSetting key="PushDiscoveryAllowance" type="local" defaultValue="All" />