cdm probe alarms due to high cpu usage caused by mcafee scan

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management On-Premise (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

A customer has a machine that runs a virus scan at a set time. During this time period the McAfee mcshield.exe process consumes 100% of cpu for the duration of the scan ( 1 1/2 hr - 3 hrs) causing the cdm probe to alarm on total cpu usage. The customer did not want to process the alarm when the McAfee scan was in progress.

Environment

• Release: UIM, any
• cdm probe
• McAfee scan

Resolution

Using the nas probe, create a preprocessing rule.

probe: cdm
robot: <source_robot_name>
message string: /.*total cpu is.*/
Action: exclude (delete) or make the alarm invisible

Optionally, set the 'Operating Period' of the profile as desired so the preprocessor rule will only be active during those hours.

Additional Information

It is also advisable to visit the McAfee support web site and search the Knowledge Center for 'high CPU usage':

Troubleshooting high CPU usage related to Disk I/O and McShield
https://kc.mcafee.com/corporate/index?page=content&id=KB67891

FAQs about McShield.exe and high CPU utilization when running On-Demand scans
https://kc.mcafee.com/corporate/index?page=content&id=KB85299&snspd-0815

How could I limit McAfee's CPU usage during scans?
https://community.mcafee.com/thread/81746?tstart=0