Thread Info
  • State Verified Answer
  • +9 person also asked this people also asked this
  • Locked Locked
  • Replies 71 replies
  • Answers 3 answers
  • Subscribers 24 subscribers
  • Views 89191 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Possible Memory Problem after Windows 10 1903 Update

Gareth Johnstone

 

 

Currently have Sophos Central with Sophos Endpoint running on several machines here, i was the first to update to the latest Windows 10 1903 Update and noticed after the machine sitting idle for a while that the above service is consuming a lot of RAM.

 

Any solutions to this?



This thread was automatically locked due to age.
Parents
  • +1

    Hi Guys!

    So i've been running the patch for a couple days now and Sophos is indeed now behaving itself!

     

    Sophs Tech say they will be releasing the patch on the 26th June (ish)!

  • 0 in reply to Gareth Johnstone

    Our observation is that with this patch SSPService memory consumption is greater on launch and increases steadily but very slowly over time.  So far we have not seen any runaway condition that has brought a system down so in that sense it does appear to be a fix.

    The steady increase over time remains a minor concern but at observed levels is not likely to be a problem on end user workstations.

     

     

  • 0 in reply to Jolyon Xerxes

    hmm, my machine has been on for about 72 hours and havent noticed any issues with the memory consumption 

  • 0 in reply to Jolyon Xerxes

    I've been working with support on this issue for over a week now; when I say work, I mean once a day they email me asking me to send Procdump and Procmon log files. I've found that after booting up, my system runs well for about 24 hours, the SSP process behaves and stays under 300 MB, but suddenly it will start to slow climb in memory usage and within the next 24 hours will consume most of my RAM, I have 32 GB of RAM.

    When I spoke to support 2 days ago, they were going to look into the status of the patch and call me back. I was hoping to install the patch to see if it resolves my issue. I haven't heard back.

  • 0 in reply to MR eSecurity

    I am also experiencing this behaviour.  Machine is OK for about 24 hours then memory usage climbs. It then fills up the paging file and basically hoses the system requiring a reboot.

    From System Event Log:

    Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: SSPService.exe (2984) consumed 60697669632 bytes

     

    That's 60 GB LOL.  Greedy little thing it is.

  • +1 in reply to Scott Wichall

    On Friday, 06/21/2019, I was provided with a patch. I applied the patch on Friday and my system has been running without any issues since (today is Monday). In the email from support where they provided the patch, they said something I don't quite understand, but then stated the patch will be release in GA on 06/26/2019. I've confirmed with support that the issues appears to be resolved.

    Support wrote:

    "We have identified an issue where ETW is no longer dropping events when the thread is deadlocked on Windows 10 1903.  ETW will now continue to save all events for processing until the thread consumes them or it runs out of memory.  I have confirmed that once the thread is released, it will process the gigabytes of ETW events in under 30 seconds."

    "If this confirms to resolve the issue we are planning to implement this in our Core Agent 2.4.0 release which is planned to start on the 26th June"

  • 0 in reply to MR eSecurity

    Yeah, it's not clear if they have fixed it to drop events when deadlocked or fixed whatever allows for the deadlock in the first place.

    Still, it does seem to have fixed the runaway memory consumption so ... good.

Reply Children
No Data
Unfiltered HTML