Massive I/O reads during enabling HostMonitor tests

Jos Schermer · Post by **Jos Schermer** » Mon Mar 05, 2007 8:33 am

Hi,

I am using HostMonitor v6.54 on a Windows 2000 SP4 Server with 2 cpu's and 3Gb internal memory.

When I enable all HostMonitor tests in a folder with 20 subfolders (total 50..70 tests), one of the cpu's starts running on 100% usage.

After 10 minutes, the cpu's usage drops back to around 0%.

During the 100% cpu usage, my windows task managers shows a lot of page faults and I/O reads....for example 50.000.000.000 I/O reads in bytes....yes.....50 Gb I/O reads

This happens every time I enable or disable the same set of folders with tests...and everytime 50 Gb I/O reads

Has someone experienced the same problem? Can someone help me with this problem?

With regards,

Jos Schermer.

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Mar 05, 2007 9:10 am

Could you send all *.hml, *.lst and *.ini files from HostMonitor's folder to support@ks-soft.net? Could you, please, point out, what exact folder leads to such behavior? Please, compress the files before sending, if possible.

Regards,
Max

KS-Soft · Post by **KS-Soft** » Mon Mar 05, 2007 2:02 pm

Do you have some 3rd part software installed? Like Antivirus monitor, personal firewall, content monitoring software, non-standard winsock components?

Regards
Alex

Jos Schermer · Post by **Jos Schermer** » Mon Mar 05, 2007 11:50 pm

Hi,

3rd partij software installed on the windows server:
- HP System Management tools
- Oracle Client 9i
- McAfee Enterprise Virusscan v8.0.0

The *.hml and *.ini files contains logonid's and passwords for accessing our databases and applications...my company has compliancy rules about sending this kind of information to other companies.

So...I cannot send the *.hml and *.ini files.

Is there any tooling available to check the *.hml file for any errors like corrupt data of invalid structures?

Extra debug information ----> The same problem also occurs on another server (windows 2003 server SP1, same 3rd partij software, 2 cpu's, 5 Gb internal memory) with the same HostMonitor software (v6.54)

With regards,

Jos Schermer

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Mar 06, 2007 2:32 am

Jos Schermer wrote:- McAfee Enterprise Virusscan v8.0.0

Similar problems might be caused by antivirus. Symantec and McAfee real-time monitoring modules often leads to problems, especially related to SMTP protocol, it even can crash HostMonitor. At the same time antivirus scanners work fine (scanner - module that checks files and processes from time to time, scanners does not modify system DLLs and registry, does not intercept TCP traffic and so on). If you are unable to disable antivirus, we recommend at least to disable real-time protection module.

Regards,
Max

KS-Soft · Post by **KS-Soft** » Tue Mar 06, 2007 12:11 pm

Is there any tooling available to check the *.hml file for any errors like corrupt data of invalid structures

HostMonitor checks the file at startup/load time. So problems caused by corrupted file are possible but improbable.
Could you try to install HostMonitor on clean system (without McAfee)?

Regards
Alex

Jos Schermer · Post by **Jos Schermer** » Thu Mar 08, 2007 4:05 am

Hi Alex,

One of our HostMonitor installation is running since may 2006 (version 5.70)....we experienced the same problem on this installation

Running the HostMonitor on a clean system without McAfee is not possible....all of our server have McAfee installed and running.

But....if McAfee is the problem....then the McAfee proces should be running on 100% not the HostMonitor process.....correct?

In our case the HostMonitor process is running on 100%

With regards,

Jos Schermer.

KS-Soft Europe · Post by **KS-Soft Europe** » Thu Mar 08, 2007 5:39 am

Jos Schermer wrote:One of our HostMonitor installation is running since may 2006 (version 5.70)....we experienced the same problem on this installation

So, has it been working properly?

Jos Schermer wrote:Running the HostMonitor on a clean system without McAfee is not possible....all of our server have McAfee installed and running.

If you are unable to disable antivirus, we recommend at least to disable real-time protection module. At least you should try to add HostMonitor to the exceptions list of McAfee antivirus.

Jos Schermer wrote:But....if McAfee is the problem....then the McAfee proces should be running on 100% not the HostMonitor process.....correct?
In our case the HostMonitor process is running on 100%

Most of antiviruses, like McAfee, replace system DLLs or install drivers to intercept network packets, monitors incoming and outgoing traffic. For the most of software it does not matter, but not for the HostMonitor. HostMonitor checks local and remote systems resources, often sends and receives a lot of packets at once, so antiviruses may detect it as suspicious malware or malicious software and drop HostMonitor's packets. That's why we recommend to install HostMonitor onto clean system.

Regards,
Max

Jos Schermer · Post by **Jos Schermer** » Thu Mar 08, 2007 5:51 am

Hi Max,

This problem first occured somewhere in december 2006.

I have excluded HostMon.exe for McAfee Antivirus

I run my test.....big improvement.....100% cpu usage occured for only 10-20 seconds...without page fault and massige I/O reads.

So far so good....I will run more tests during the next week....

thankx for the support

With regards,

Jos Schermer

KS-Soft Europe · Post by **KS-Soft Europe** » Thu Mar 08, 2007 6:34 am

Jos Schermer wrote:I have excluded HostMon.exe for McAfee Antivirus
I run my test.....big improvement.....100% cpu usage occured for only 10-20 seconds...without page fault and massige I/O reads.

Sounds good.

Jos Schermer wrote:So far so good....I will run more tests during the next week....

Please, let us know how it works.

Jos Schermer wrote:thankx for the support

You are welcome.

Regards,
Max