High memory usage after client upgrade to Endpoint protection 14.3 RU4 on Windows 2016/2019 servers

Products

• Endpoint Protection

Issue/Introduction

• High memory utilization on multiple servers causes performance issues
• Memory keeps growing until all available memory exhausts on the machine
• After manual restart, the servers temporarily recover from the issue and eventually increase until server becomes unresponsive.
• Paged pool and non-paged pool usage are high on the servers. 

WPR indicates sysfer.dll being top contributor in leaking pool tags:

Environment

Endpoint Protection (SEP) 14.3 RU4 ( Build: 14.3.7393.4000 )

OS : Windows Server 2016/2019 64 bit

Cause

This issue is caused due to User Mode EFA failing in Sysplant and it leaks file handles.

Resolution

This issue is fixed in SEP 14.3 RU5.

Workaround : Disable Sysplant from registry on one system and see if that helps.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysPlant
value name "Start" and the DWORD value "4".

[Note : Backup the Windows registry before making any change].

In the next reboot the Driver should not load.

If there are more systems, HI policy can be used to make the above registry change.