Memory leak problem

[Marcos]

Originally Posted by SweX

Great news Marcos Even though i'm not personally affected by it

We assume that not many people are affected as the conditions leading to the issue themselves were weird and unusual. In particular, in the middle of downloading a file the connection was terminated the standard way as it happens when the download has finished successfully.

[SweX]

Originally Posted by Marcos

We assume that not many people are affected as the conditions leading to the issue themselves were weird and unusual. In particular, in the middle of downloading a file the connection was terminated the standard way as it happens when the download has finished successfully.

I see, yeah I too don't think that so many are affected by it since we haven't seen reports from a lot of people here on the forum, but then it's possbile they contacted Customer Care right away instead of posting here, but I guess that's something you know better than me

[tommy456]

After reinstalling my os Win XP SP3 due to a failing HDD , this was a clean install, and there is little 3rd party software installed so far, the first install attempt of the current version of ess, I got issues with the EGUI.EXE process (crashing randomly) several times a day, and then failing to restart again, things like adding a firewall rule or accepting a ssl cert would trigger the GUI to crash, as would watching /streaming somthing using flashplayer in a browser, the main EKRN.EXE also crashed a few times, but it wasn't set to create a full dmp ( suggestion it should be by defualt)
The memory leak didn't show it's self, or it appeared not to, (could of been due to EKRN.EXE crashing /restarting ) without my knowlage,

Yesterday i completely uninstalled ess, and clean installed it,and re configured everything again manually, the result no more crashing of the EGUI.EXE or EKRN.EXE as yet, (is also set to create DMP )But the memory leak issue is definately apparent, earlier today EKRN.EXE was holding over 200mb of RAM the machine had been idle for the previous 8-10hrs during which time it had acculmilated over 70mb just from updating it's self and sending stasticts,
But instead of restarting my PC (which i should not have to keep doing) i opened maybe 100+ instances of firefox to use up the remaining ram, eventually EKRN.EXE released my ram and wrote it to the HDD paging file alsong with most of the other running processes, but EKRN.EXE is still acumillating eating my available ram, each time i open a browser or read my e-mail( outlook express) EKRN.EXE never fully releases the ram it needed whilst the application was open
So is there any update as to when this updated module will be available ? even if it doesn't go on the update servers, those who are experiencing this problem, (which has been ongoing since soon after the release of V5) it's high time the solutution was made available to us, or what's the point in keeping on paying subscription to eset if they can't be bothered to fix things like this?

[terradon]

[quote=tommy456] EKRN.EXE was holding over 200mb of RAM the machine had been idle for the previous 8-10hrs during which time it had acculmilated over 70mb just from updating it's self and sending stasticts,
But instead of restarting my PC (which i should not have to keep doing) i opened maybe 100+ instances of firefox to use up the remaining ram, eventually EKRN.EXE released my ram and wrote it to the HDD paging file alsong with most of the other running processes, but EKRN.EXE is still acumillating eating my available ram, each time i open a browser or read my e-mail( outlook express) EKRN.EXE never fully releases the ram it needed whilst the application was open
QUOTE]

I just opened Task Manager, and opened a bunch of websites in seperate tabs. EKRN quickly expanded to the second largest Private Working memory of the 72 processes. Outlook, IE, Firefox, etc., would all quickly release the memory even before tabs were closed. EKRN retained everything that it grabbed, never letting go for hours.

This definitely explains why programs seem sluggish, like I don't have 8gig ram. ARGH!!

[SweX]

FYI see this post by Marcos: http://www.wilderssecurity.com/showp...7&postcount=24

Though I AM on Pre-release servers but I still haven't received the 1052 module

[tommy456]

Yes, but this keeps being said and no module has so far been released, no good telling people that it's going to be released soon when it obviously isn't and to keep saying that it will is IMO is treating people aka customers like lemings and that is an insult are you listening eset?

February 25th, 2013 11:08 AM
Marcos The fix will be included in the Internet protection module 1052 and newer. it goes even further back they don't really give a dam, is the truth

[SweX]

Originally Posted by tommy456

they don't really give a dam, is the truth

I agree that it is taking a long time, but of course they care otherwise they wouldn't have started to work on a fix in the first place.

And "fixing" software isn't always easy, they can fix one thing and it will break another. And after it's been fixed is goes through a lot of testing before it's released, so yes it can take a lot of time unfortunately.

[tommy456]

Originally Posted by SweX

And "fixing" software isn't always easy, they can fix one thing and it will break another

Shame they didn't do that before they released the module that caused this problem in the first place as the early builds of ess v5 did not have this memory leak (well not in my case) infact i for testing some time ago installed one such build, and the memory use was low,and did not accumulate so matter what software i used ,
But after i allowed it to update it's self, the problem was apparent, this wasn't fixed in V6 or even in this latest build, IMO They will never fix this issue, unless unintentionally (fixing another issue also fixes this one)
+12mths and counting

[Marcos]

The problem with memory leaks discussed in this thread is not usual and should not happen at all. The cause of the issue is connections terminated in an unusal way (ie. not terminated with reset) so it appears that files were successfully downloaded even if they were actually terminated.
The Internet protection module 1053 will be put on pre-release servers soon along with the Antivirus and antispyware module which needed to be updated as well.
V5 didn't have this problem as v6 was the first to support continual scanning of downloaded files.

[tommy456]

Originally Posted by Marcos

The problem with memory leaks discussed in this thread is not usual and should not happen at all. The cause of the issue is connections terminated in an unusal way (ie. not terminated with reset) so it appears that files were successfully downloaded even if they were actually terminated.
The Internet protection module 1053 will be put on pre-release servers soon along with the Antivirus and antispyware module which needed to be updated as well.
V5 didn't have this problem as v6 was the first to support continual scanning of downloaded files.

V5 did have this memory leak once it was allowed to download the defective programe module (for me at least),

V6 displays the same problem accumilating of RAM (EKRN.EXE) Support have in the past collected full memory dumps proc mon logs, you name it, they at first tried to blame third party software, then even the O/S infact anything but their erronus programing

[Marcos]

Internet protection module 1053 is now available on pre-release update servers. It contains a workaround for memory leaks in v6 occurring when a connection is terminated in an abnormal way.

[SweX]

Originally Posted by Marcos

Internet protection module 1053 is now available on pre-release update servers. It contains a workaround for memory leaks in v6 occurring when a connection is terminated in an abnormal way.

Thanks, I got it. Internet Protection Module 1053 (20130318 )

Though I wasn't affected by the issue so I can't really test the new module, but hopefully those who were affected can test it out and confirm that it has now been fixed.

[tommy456]

Updated to this new module , (Internet Protection Module 1053 (20130318 )

EKRN.EXE appears to still be accumulating physical memory, although it doesn't appear to be as severe, but the problem is still apparent, So maybe it's down to something else ?

At first it seems to start of by releasing most of the memory used to open a browser or e-mail client, but as the hours of uptime pass it seems to start accumulating memory, it also seems to hold memory any files that have downloaded (complete) until they are deleted ?? it shouldn't be doing this surely, but this i have observed

[SweX]

Originally Posted by tommy456

Updated to this new module , (Internet Protection Module 1053 (20130318 )

EKRN.EXE appears to still be accumulating physical memory, although it doesn't appear to be as severe, but the problem is still apparent, So maybe it's down to something else ?

At first it seems to start of by releasing most of the memory used to open a browser or e-mail client, but as the hours of uptime pass it seems to start accumulating memory, it also seems to hold memory any files that have downloaded (complete) until they are deleted ?? it shouldn't be doing this surely, but this i have observed

Hmmm but how much, is it still going up to several hundreds of MB?

Yes maybe it's something else, but even if it is, it still needs to get fixed in a permanent way and the only way of doing that is with the help from users that are affected and are willing to help to get it sorted. But if it turns out to be a non ESET issue then there's nothing else ESET can do about it, but those who are affected by it have then at least tried to get it fixed.

[tommy456]

EKRN.EXE had accumilated +180mb of ram within 18hrs uptime, If download a 10gb test file the memory useage increases and only when the downloaded file is deleated does eset release some of it's hoard of my ram,
The only workaround\way that i have found to free the ram it's hogging is by opening lots of instances of firefox or another app that uses a fair chunk of memory, eventually once the physical ram is used up the running processes start to release the ram they hold, EKRN.EXE is the last process to release the ram,
But doing this isnt really a solution, as windows apps and third party apps can crash or fail to run and leave the system in a suspended state,(frozen state) which requires a hard reset via the power switch, so carries the risk of data corruption,ect

As i have said, that in testing ( earlier last year) i was given a download link for one of the first builds of ess v5, which i downloaded ,after which i completely uninstalled the upto date build, ran eset uninstaller tool also, then rebooted the pc, and installed this earlier build (offline mode) i then imported all my settings, disabled updates, and ran it on my machine for several hours using it in the same way that i do at any other time, eset did not accumilate memory infact eset's memory consuption was on a par with V4, peaking @ 100mb whilst scanning files 75mb was the figure when idle
But after i let ess update virus sigs and modules, the memory leak was again apparent and has been so ever since, this no one at eset seems to want to belive or they would sooner ignore what i found,

So i belive it's one or more of the eset modules,and its interaction/compatability with the windows xp pro sp3 o/s that is the cause(on my pc at least) as since this issue started, my windows os has been clean installed, on a new HDD a lot of the third party apps i had installed are not yet installed currently,

[mikiki]

I apologize I don't mean to hijack the thread but have any of you noticed memory leaks of other processes like Chrome browser?

I normally have Chrome sit open at all times with 50+ tabs open. While I had ESS installed Chrome would eat up commit memory hour after hour starting from 5-6GB to 10-11GB after day or two. After uninstalling ESS this problem either went away or is much lower now.

I'd really like to hear if any of you experienced such behavior.

[Marcos]

Originally Posted by mikiki

I normally have Chrome sit open at all times with 50+ tabs open. While I had ESS installed Chrome would eat up commit memory hour after hour starting from 5-6GB to 10-11GB after day or two. After uninstalling ESS this problem either went away or is much lower now.

Check Network connections (under Tools) and make sure that none or only a few connections are open. Each open connection allocates certain amount of memory for scanning in principle.

[vigen]

Hello,

Same problem with Firefox on Win 7 64 bits up to date, module 1053.

About one hours or two ekrn.exe up to 160 mb.

(When Windows start +/- 90 mb).

After closing Firefox, value remains at 160 and will not drop.

If I close all the connections, the value is equal.

I installed NOD32 for comparison, and the value remains stable at 93 mb (module 1053 to).

What makes me lean towards a "trouble" with the firewall module, or the module internet protection.

Regards;

Vigen.


Edit: Maybe the solution.

An update of the driver for my network card is edited in three days. I perform the update, and ekrn.exe process more than 90 mb for now, even with multiple tabs open, and a download in progress.

I will look at the evolution ...

Sorry for my bad English.

[Marcos]

Originally Posted by vigen

About one hours or two ekrn.exe up to 160 mb.
After closing Firefox, value remains at 160 and will not drop.

Are you able to reproduce it with Protocol filtering disabled?

Originally Posted by vigen

If I close all the connections, the value is equal.

What do you exactly mean by connections? Opened tabs in Firefox? And equal value means 160 MB?

I installed NOD32 for comparison, and the value remains stable at 93 mb (module 1053 to).

Just to make sure that protocol filtering works fine in this case, try to download the eicar test file and make sure it's detected by the HTTP scanner.

[vigen]

Hello Marcos;

It is not easy for me to "talk" with translation tools

"Are you able to reproduce it with Protocol filtering disabled?"

No, because since the update the driver for the network card, ekrn process does not exceed the 101MB (with tabs open in two different browser, and downloadable files)with ESS.

"What do you exactly mean by connections? Opened tabs in Firefox? And equal value means 160 MB?"

By connection, I meant network connections.

I meant with NOD32 whatever conditions the value remained stable at 93 mb.

I did not get the value of 160 mb with ESS, not NOD32.

Yes the protocol filtering works fine.

Regards;

Vigen.


Edit:

I unchecked, the "active mode" for IE in the module web protection, and ekrn.exe process does not exceed the value of 95/98mb.


http://www.bild.me/bild.php?file=2392576process.png

[vigen]

Hello,

Today, the process of getting a new value of + / - 160 MB.

Just with a Firefox tab, and two simultaneous downloads.

This is a two download and RAR..

Is the analysis of the archive that could increase the consumption of ram?

Regards,

Vigen.

Process and Network screenshot.

[vigen]

Hello,

Any idéas?

Regards;

Vigen.

[Marcos]

Smaller archives are unpacked in memory without being saved to the disk which might account for small increase of memory consumption. If memory isn't freed after the download, generate a dump of ekrn.exe and send it to me for analysis.

[vigen]

Hello Marcos;

Thank you for your reply.

Indeed, the value does not drop, and "idle", it is rare to fall below a value of 100/110 MB (without the browser running).

I also saw the appearance of error message in the events viewer, I do not have with other products.

As soon as I have five minutes, I sent you the dump.

Thank you.

Regards;

Vigen.

[vigen]

Here is an example of the events viewer.

I'm switching from another product pending resoltuion the problem of memory consumption.

But I'll reinstall ESS you generate a dump.

As you can see from the screenshot attached, since the installation of the other products, I have only one error message about readyboost (it is disabled for my SSD) so this error is "normal" .

In column 7 days (or so the period was install ESS)

Have seen a number can raise error in Kernel:

"Failed to start the "NT Kernel Logger" session with the following error: 0xC0000035"

Regards;

Vigen