Memory leak problem

Discussion in 'ESET Smart Security' started by BALTAGY, Jan 21, 2013.

Thread Status:
Not open for further replies.
  1. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    We assume that not many people are affected as the conditions leading to the issue themselves were weird and unusual. In particular, in the middle of downloading a file the connection was terminated the standard way as it happens when the download has finished successfully.
     
  2. SweX

    SweX Registered Member

    Joined:
    Apr 21, 2007
    Posts:
    6,429
    I see, yeah I too don't think that so many are affected by it since we haven't seen reports from a lot of people here on the forum, but then it's possbile they contacted Customer Care right away instead of posting here, but I guess that's something you know better than me :D
     
    Last edited: Mar 12, 2013
  3. tommy456

    tommy456 Registered Member

    Joined:
    Jun 11, 2011
    Posts:
    137
    After reinstalling my os Win XP SP3 due to a failing HDD , this was a clean install, and there is little 3rd party software installed so far, the first install attempt of the current version of ess, I got issues with the EGUI.EXE process (crashing randomly) several times a day, and then failing to restart again, things like adding a firewall rule or accepting a ssl cert would trigger the GUI to crash, as would watching /streaming somthing using flashplayer in a browser, the main EKRN.EXE also crashed a few times, but it wasn't set to create a full dmp ( suggestion it should be by defualt)
    The memory leak didn't show it's self, or it appeared not to, (could of been due to EKRN.EXE crashing /restarting ) without my knowlage,

    Yesterday i completely uninstalled ess, and clean installed it,and re configured everything again manually, the result no more crashing of the EGUI.EXE or EKRN.EXE as yet, (is also set to create DMP )But the memory leak issue is definately apparent, earlier today EKRN.EXE was holding over 200mb of RAM the machine had been idle for the previous 8-10hrs during which time it had acculmilated over 70mb just from updating it's self and sending stasticts,
    But instead of restarting my PC (which i should not have to keep doing) i opened maybe 100+ instances of firefox to use up the remaining ram, eventually EKRN.EXE released my ram and wrote it to the HDD paging file alsong with most of the other running processes, but EKRN.EXE is still acumillating eating my available ram, each time i open a browser or read my e-mail( outlook express) EKRN.EXE never fully releases the ram it needed whilst the application was open
    So is there any update as to when this updated module will be available ? even if it doesn't go on the update servers, those who are experiencing this problem, (which has been ongoing since soon after the release of V5) it's high time the solutution was made available to us, or what's the point in keeping on paying subscription to eset if they can't be bothered to fix things like this?
     
    Last edited: Mar 25, 2013
  4. terradon

    terradon Registered Member

    Joined:
    Nov 5, 2006
    Posts:
    78
     
  5. SweX

    SweX Registered Member

    Joined:
    Apr 21, 2007
    Posts:
    6,429
  6. tommy456

    tommy456 Registered Member

    Joined:
    Jun 11, 2011
    Posts:
    137
    Yes, but this keeps being said and no module has so far been released, no good telling people that it's going to be released soon when it obviously isn't and to keep saying that it will is IMO is treating people aka customers like lemings and that is an insult are you listening eset?

    February 25th, 2013 11:08 AM
    Marcos The fix will be included in the Internet protection module 1052 and newer. it goes even further back they don't really give a dam, is the truth
     
  7. SweX

    SweX Registered Member

    Joined:
    Apr 21, 2007
    Posts:
    6,429
    I agree that it is taking a long time, but of course they care otherwise they wouldn't have started to work on a fix in the first place.

    And "fixing" software isn't always easy, they can fix one thing and it will break another. And after it's been fixed is goes through a lot of testing before it's released, so yes it can take a lot of time unfortunately. :)
     
  8. tommy456

    tommy456 Registered Member

    Joined:
    Jun 11, 2011
    Posts:
    137
    Shame they didn't do that before they released the module that caused this problem in the first place as the early builds of ess v5 did not have this memory leak (well not in my case) infact i for testing some time ago installed one such build, and the memory use was low,and did not accumulate so matter what software i used ,
    But after i allowed it to update it's self, the problem was apparent, this wasn't fixed in V6 or even in this latest build, IMO They will never fix this issue, unless unintentionally (fixing another issue also fixes this one)
    +12mths and counting
     
  9. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    The problem with memory leaks discussed in this thread is not usual and should not happen at all. The cause of the issue is connections terminated in an unusal way (ie. not terminated with reset) so it appears that files were successfully downloaded even if they were actually terminated.
    The Internet protection module 1053 will be put on pre-release servers soon along with the Antivirus and antispyware module which needed to be updated as well.
    V5 didn't have this problem as v6 was the first to support continual scanning of downloaded files.
     
  10. tommy456

    tommy456 Registered Member

    Joined:
    Jun 11, 2011
    Posts:
    137
    V5 did have this memory leak once it was allowed to download the defective programe module (for me at least),

    V6 displays the same problem accumilating of RAM (EKRN.EXE) Support have in the past collected full memory dumps proc mon logs, you name it, they at first tried to blame third party software, then even the O/S infact anything but their erronus programing
     
  11. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    Internet protection module 1053 is now available on pre-release update servers. It contains a workaround for memory leaks in v6 occurring when a connection is terminated in an abnormal way.
     
    Last edited: Mar 26, 2013
  12. SweX

    SweX Registered Member

    Joined:
    Apr 21, 2007
    Posts:
    6,429
    Thanks, I got it. Internet Protection Module 1053 (20130318 ) :thumb:

    Though I wasn't affected by the issue so I can't really test the new module, but hopefully those who were affected can test it out and confirm that it has now been fixed.
     
  13. tommy456

    tommy456 Registered Member

    Joined:
    Jun 11, 2011
    Posts:
    137
    Updated to this new module , (Internet Protection Module 1053 (20130318 )

    EKRN.EXE appears to still be accumulating physical memory, although it doesn't appear to be as severe, but the problem is still apparent, So maybe it's down to something else ?

    At first it seems to start of by releasing most of the memory used to open a browser or e-mail client, but as the hours of uptime pass it seems to start accumulating memory, it also seems to hold memory any files that have downloaded (complete) until they are deleted ?? it shouldn't be doing this surely, but this i have observed
     
  14. SweX

    SweX Registered Member

    Joined:
    Apr 21, 2007
    Posts:
    6,429
    Hmmm but how much, is it still going up to several hundreds of MB?

    Yes maybe it's something else, but even if it is, it still needs to get fixed in a permanent way and the only way of doing that is with the help from users that are affected and are willing to help to get it sorted. But if it turns out to be a non ESET issue then there's nothing else ESET can do about it, but those who are affected by it have then at least tried to get it fixed. :)
     
  15. tommy456

    tommy456 Registered Member

    Joined:
    Jun 11, 2011
    Posts:
    137
    EKRN.EXE had accumilated +180mb of ram within 18hrs uptime, If download a 10gb test file the memory useage increases and only when the downloaded file is deleated does eset release some of it's hoard of my ram,
    The only workaround\way that i have found to free the ram it's hogging is by opening lots of instances of firefox or another app that uses a fair chunk of memory, eventually once the physical ram is used up the running processes start to release the ram they hold, EKRN.EXE is the last process to release the ram,
    But doing this isnt really a solution, as windows apps and third party apps can crash or fail to run and leave the system in a suspended state,(frozen state) which requires a hard reset via the power switch, so carries the risk of data corruption,ect

    As i have said, that in testing ( earlier last year) i was given a download link for one of the first builds of ess v5, which i downloaded ,after which i completely uninstalled the upto date build, ran eset uninstaller tool also, then rebooted the pc, and installed this earlier build (offline mode) i then imported all my settings, disabled updates, and ran it on my machine for several hours using it in the same way that i do at any other time, eset did not accumilate memory infact eset's memory consuption was on a par with V4, peaking @ 100mb whilst scanning files 75mb was the figure when idle
    But after i let ess update virus sigs and modules, the memory leak was again apparent and has been so ever since, this no one at eset seems to want to belive or they would sooner ignore what i found,

    So i belive it's one or more of the eset modules,and its interaction/compatability with the windows xp pro sp3 o/s that is the cause(on my pc at least) as since this issue started, my windows os has been clean installed, on a new HDD a lot of the third party apps i had installed are not yet installed currently,
     
  16. mikiki

    mikiki Registered Member

    Joined:
    Apr 27, 2012
    Posts:
    16
    I apologize I don't mean to hijack the thread but have any of you noticed memory leaks of other processes like Chrome browser?

    I normally have Chrome sit open at all times with 50+ tabs open. While I had ESS installed Chrome would eat up commit memory hour after hour starting from 5-6GB to 10-11GB after day or two. After uninstalling ESS this problem either went away or is much lower now.

    I'd really like to hear if any of you experienced such behavior.
     
  17. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    Check Network connections (under Tools) and make sure that none or only a few connections are open. Each open connection allocates certain amount of memory for scanning in principle.
     
  18. vigen

    vigen Registered Member

    Joined:
    Mar 28, 2011
    Posts:
    60
    Hello,

    Same problem with Firefox on Win 7 64 bits up to date, module 1053.

    About one hours or two ekrn.exe up to 160 mb.

    (When Windows start +/- 90 mb).

    After closing Firefox, value remains at 160 and will not drop.

    If I close all the connections, the value is equal.

    I installed NOD32 for comparison, and the value remains stable at 93 mb (module 1053 to).

    What makes me lean towards a "trouble" with the firewall module, or the module internet protection.

    Regards;

    Vigen.


    Edit: Maybe the solution.

    An update of the driver for my network card is edited in three days. I perform the update, and ekrn.exe process more than 90 mb for now, even with multiple tabs open, and a download in progress.

    I will look at the evolution ...

    Sorry for my bad English.
     
    Last edited: Apr 29, 2013
  19. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    Are you able to reproduce it with Protocol filtering disabled?
    What do you exactly mean by connections? Opened tabs in Firefox? And equal value means 160 MB?

    Just to make sure that protocol filtering works fine in this case, try to download the eicar test file and make sure it's detected by the HTTP scanner.
     
  20. vigen

    vigen Registered Member

    Joined:
    Mar 28, 2011
    Posts:
    60
    Hello Marcos;

    It is not easy for me to "talk" with translation tools :)

    "Are you able to reproduce it with Protocol filtering disabled?"

    No, because since the update the driver for the network card, ekrn process does not exceed the 101MB (with tabs open in two different browser, and downloadable files)with ESS.

    "What do you exactly mean by connections? Opened tabs in Firefox? And equal value means 160 MB?"

    By connection, I meant network connections.

    I meant with NOD32 whatever conditions the value remained stable at 93 mb.

    I did not get the value of 160 mb with ESS, not NOD32.

    Yes the protocol filtering works fine.

    Regards;

    Vigen.


    Edit:

    I unchecked, the "active mode" for IE in the module web protection, and ekrn.exe process does not exceed the value of 95/98mb.


    http://www.bild.me/bild.php?file=2392576process.png
     
    Last edited: Apr 29, 2013
  21. vigen

    vigen Registered Member

    Joined:
    Mar 28, 2011
    Posts:
    60
    Hello,

    Today, the process of getting a new value of + / - 160 MB.

    Just with a Firefox tab, and two simultaneous downloads.

    This is a two download and RAR..

    Is the analysis of the archive that could increase the consumption of ram?

    Regards,

    Vigen.

    Process and Network screenshot.
     

    Attached Files:

  22. vigen

    vigen Registered Member

    Joined:
    Mar 28, 2011
    Posts:
    60
    Hello,

    Any idéas?

    Regards;

    Vigen.
     
  23. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    Smaller archives are unpacked in memory without being saved to the disk which might account for small increase of memory consumption. If memory isn't freed after the download, generate a dump of ekrn.exe and send it to me for analysis.
     
  24. vigen

    vigen Registered Member

    Joined:
    Mar 28, 2011
    Posts:
    60
    Hello Marcos;

    Thank you for your reply.

    Indeed, the value does not drop, and "idle", it is rare to fall below a value of 100/110 MB (without the browser running).

    I also saw the appearance of error message in the events viewer, I do not have with other products.

    As soon as I have five minutes, I sent you the dump.

    Thank you.

    Regards;

    Vigen.
     
  25. vigen

    vigen Registered Member

    Joined:
    Mar 28, 2011
    Posts:
    60
    Here is an example of the events viewer.

    I'm switching from another product pending resoltuion the problem of memory consumption.

    But I'll reinstall ESS you generate a dump.

    As you can see from the screenshot attached, since the installation of the other products, I have only one error message about readyboost (it is disabled for my SSD) so this error is "normal" .

    In column 7 days (or so the period was install ESS)

    Have seen a number can raise error in Kernel:

    "Failed to start the "NT Kernel Logger" session with the following error: 0xC0000035"

    Regards;

    Vigen
     

    Attached Files:

Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.