This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSPService, high memory usage in win10 - multiple systems

Hey all,

SSPService.exe is bringing numerous windows 10 pro machines to a crawl in my department where the memory usage is 99-100% as seen under Processes in the task manager.  This appears to be 100% of the time.  

What is the current solution?  These machines are all on latest updates for Sophos and windows.   

Thanks,

matt



This thread was automatically locked due to age.
  • Just had a helpdesk call for this very issue--slow computer and can't print.  I disabled tamper, killed the SSPService.exe process and now it's running fine. So that's a workaround for now, but what's the solution?

  • A couple of options:

    1. Run Process Monitor (Microsoft/Sysinternals) to see what's going on, might hint at possible exclusion.

    2. Collect a General Profile ETL trace while the problem is happening. E.g.

    wpr.exe -start GeneralProfile

    Leave for a couple of minutes while you have the issue, then run:

    wpr.exe -stop C:\generalprofile.etl

    You can open the etl in Windows Performance Analyzer, which you can get from the Store or by installing the Windows Performance Toolkit from the SDK.

    You will not have symbols for the SSPService.exe process, but you might still be able to see what APIs it's calling, with the Microsoft Symbols loaded.  

    In either case, Support can use these files.

  • Hello,

    We are also experiencing the same problem, it is really bogging down some desktops. We have also had the issue on one of our Windows servers.

    The windows server in question has 16GB of RAM allocated to it (simple file server) yet the SSP Service was using around 12GB of this. Killed the service and restarted it and it is now okay. Have had to upgrade the RAM on a few machines in the last week or so due to reported slowness, I think this may be the cause.

    All Sophos software is fully up to date.

  • Strangely only seems to be affecting some machines and not others, despite all being on the same windows and sophos versions.

  • That memory consumption is not right and sounds like a bug.  Do you know how it grows?

    If you restart SSPService and start

    typeperf "\Process(sspservice)\Working Set - Private" -si 30 -o C:\ssp.csv

    What does C:\ssp.csv look like after say 3 hours?  Has it grown?  Maybe after 6 hours?  Is it a straight line or does it step up at certain times.

    It would be good to get a ETL trace when it's leaking, e.g. From an admin prompt:

    wpr.exe -start VirtualAllocation

    leave it for up to 4 mins, ideally when leaking based on previous data. Then run:
    wpr.exe -stop C:\VirtualAllocation.etl

    Should be possible for Support to use this trace and the csv to say why the memory is growing, at least in the captured time frame.  Problem being, it could be memory is allocated that is freed just outside the trace.  The csv for a while first might make it apparent when would be a good time to trace,

    Hope it helps.

  • Hello,

    Thanks for the reply, I will try the above. The ssp service is not running currently as i have killed it off temporarily. However when you start it, the memory usage slowly goes up and up at a constant rate to around 9/10GB where it rounds off and sits.

  • OK, It might also be worth also creating a couple of process dumps, one after say 5 mins, then anohter after 1hr, if the mem usage has gone up enough to feel like the issue.  E.g.

    procdump -ma sspservice

    Having downloaded procdump from Microsoft first. The 2 dmp files would be useful.

  • (PDH-CSV 4.0) (GMT Daylight Time)(-60),Process(sspservice)\Working Set - Private
    06/28/2022 14:20:26.458,59428864
    06/28/2022 14:20:56.465,80326656
    06/28/2022 14:21:26.473,84545536
    06/28/2022 14:21:56.478,92495872
    06/28/2022 14:22:26.488,92868608
    06/28/2022 14:22:56.492,96006144
    06/28/2022 14:23:26.497,96096256
    06/28/2022 14:23:56.502,96186368
    06/28/2022 14:24:26.507,102445056
    06/28/2022 14:24:56.512,102858752
    06/28/2022 14:25:26.517,103731200
    06/28/2022 14:25:56.521,105353216
    06/28/2022 14:26:26.525,105349120
    06/28/2022 14:26:56.530,105365504
    06/28/2022 14:27:26.536,106070016
    06/28/2022 14:27:56.542,106090496
    06/28/2022 14:28:26.545,106344448
    06/28/2022 14:28:56.550,106377216
    06/28/2022 14:29:26.555,106696704
    06/28/2022 14:29:56.560,106762240
    06/28/2022 14:30:26.563,109686784
    06/28/2022 14:30:56.567,109686784
    06/28/2022 14:31:26.573,109973504
    06/28/2022 14:31:56.576,110186496
    06/28/2022 14:32:26.582,111980544
    06/28/2022 14:32:56.586,112066560
    06/28/2022 14:33:26.591,112099328
    06/28/2022 14:33:56.595,112455680
    06/28/2022 14:34:26.599,112537600
    06/28/2022 14:34:56.606,112623616
    06/28/2022 14:35:26.611,112668672
    06/28/2022 14:35:56.616,114192384
    06/28/2022 14:36:26.621,114597888
    06/28/2022 14:36:56.624,292380672
    06/28/2022 14:37:26.628,526237696
    06/28/2022 14:37:56.631,760905728
    06/28/2022 14:38:26.637,996491264
    06/28/2022 14:38:56.692,1187725312
    06/28/2022 14:39:26.699,1360867328
    06/28/2022 14:39:56.703,1587359744
    06/28/2022 14:40:26.707,1800630272
    06/28/2022 14:40:56.715,2014617600
    06/28/2022 14:41:26.720,2217496576
    06/28/2022 14:41:56.727,2434723840
    06/28/2022 14:42:26.733,2653696000
    06/28/2022 14:42:56.738,2863337472
    06/28/2022 14:43:26.775,3077095424
    06/28/2022 14:43:56.781,3299995648
    06/28/2022 14:44:26.785,3496865792
    06/28/2022 14:44:56.788,3711782912
    06/28/2022 14:45:26.789,4055142400
    06/28/2022 14:45:56.794,4283002880
    06/28/2022 14:46:26.837,4500381696
    06/28/2022 14:46:56.841,4713910272
    06/28/2022 14:47:26.846,4928405504
    06/28/2022 14:47:56.849,5142044672
    06/28/2022 14:48:26.855,5348343808
    06/28/2022 14:48:56.864,5557387264
    06/28/2022 14:49:26.882,5775171584
    06/28/2022 14:49:56.887,5995999232
    06/28/2022 14:50:26.893,6208286720
    06/28/2022 14:50:56.898,6426951680
    06/28/2022 14:51:26.903,6633881600
    06/28/2022 14:51:56.910,6849871872
    06/28/2022 14:52:26.915,7082323968
    06/28/2022 14:52:56.919,7333470208
    06/28/2022 14:53:26.924,7568183296
    06/28/2022 14:53:56.931,7797641216
    06/28/2022 14:54:26.938,8013692928
    06/28/2022 14:54:56.942,8241111040
    06/28/2022 14:55:26.945,8488599552
    06/28/2022 14:55:56.951,8712019968
    06/28/2022 14:56:26.958,8932618240
    06/28/2022 14:56:56.964,9164881920
    06/28/2022 14:57:26.967,9392046080
    06/28/2022 14:57:56.971,9574977536
    06/28/2022 14:58:26.975,9594064896
    06/28/2022 14:58:56.979,9617920000
    06/28/2022 14:59:26.982,9632935936
    06/28/2022 14:59:56.987,9650221056
    06/28/2022 15:00:26.991,9668907008
    06/28/2022 15:00:56.996,9684529152
    06/28/2022 15:01:26.999,9705332736
    06/28/2022 15:01:57.002,9724690432
    06/28/2022 15:02:27.005,9727123456
    06/28/2022 15:02:57.011,9727123456
    06/28/2022 15:03:27.015,9727123456
    06/28/2022 15:03:57.020,9727123456
    06/28/2022 15:04:27.026,9727123456
    06/28/2022 15:04:57.029,9727123456
    06/28/2022 15:05:27.032,9727242240
    06/28/2022 15:05:57.035,9727262720
    06/28/2022 15:06:27.040,9727254528
    06/28/2022 15:06:57.045,9727275008
    06/28/2022 15:07:27.048,9727299584
    06/28/2022 15:07:57.052,9727287296
    06/28/2022 15:08:27.056,9727295488
    06/28/2022 15:08:57.061,9727291392
    06/28/2022 15:09:27.067,9725644800
    06/28/2022 15:09:57.071,9726660608
    06/28/2022 15:10:27.076,9725452288
    06/28/2022 15:10:57.080,9724338176
    06/28/2022 15:11:27.085,9732124672
    06/28/2022 15:11:57.089,9755738112
    06/28/2022 15:12:27.092,9769054208
    06/28/2022 15:12:57.097,9785245696
    06/28/2022 15:13:27.102,9807208448
    06/28/2022 15:13:57.106,9825140736
    06/28/2022 15:14:27.110,9845714944
    06/28/2022 15:14:57.172,9869881344
    06/28/2022 15:15:27.184,9880129536
    06/28/2022 15:15:57.188,9880133632
    06/28/2022 15:16:27.193,9880002560
    06/28/2022 15:16:57.196,10016993280
    06/28/2022 15:17:27.199,10155802624
    06/28/2022 15:17:57.205,10335399936
    06/28/2022 15:18:27.210,10519040000
    06/28/2022 15:18:57.214,10697105408
    06/28/2022 15:19:27.226,10828603392
    06/28/2022 15:19:57.229,11003703296
    06/28/2022 15:20:27.233,11178434560
    06/28/2022 15:20:57.240,11352551424
    06/28/2022 15:21:27.243,11530559488
    06/28/2022 15:21:57.247,11603230720
    06/28/2022 15:22:27.252,11798773760
    06/28/2022 15:22:57.256,11861561344
    06/28/2022 15:23:27.260,11935592448
    06/28/2022 15:23:57.263,12117635072
    06/28/2022 15:24:27.267,12256423936
    06/28/2022 15:24:57.269,12185374720
    06/28/2022 15:25:27.274,12305600512
    06/28/2022 15:25:57.279,12506542080
    06/28/2022 15:26:27.283,12671156224
    06/28/2022 15:26:57.286,12807131136
    06/28/2022 15:27:27.290,12770263040
    06/28/2022 15:27:57.293,12587966464
    06/28/2022 15:28:27.297,12589879296
    06/28/2022 15:28:57.300,12555370496
    06/28/2022 15:29:27.304,12484022272
    06/28/2022 15:29:57.307,12324458496
    06/28/2022 15:30:27.312,12417359872
    06/28/2022 15:30:57.324,12301557760
    06/28/2022 15:31:27.328,12274298880
    06/28/2022 15:31:57.331,12274364416
    06/28/2022 15:32:27.336,12356751360
    06/28/2022 15:32:57.339,12425469952
    06/28/2022 15:33:27.342,12426596352
    06/28/2022 15:33:57.347,12547010560
    06/28/2022 15:34:27.350,12615790592
    06/28/2022 15:34:57.354,12579577856
    06/28/2022 15:35:27.358,12577247232
    06/28/2022 15:35:57.363,12568354816
    06/28/2022 15:36:27.368,12579176448
    06/28/2022 15:36:57.372,12611710976
    06/28/2022 15:37:27.376,12648513536
    06/28/2022 15:37:57.379,12680724480
    06/28/2022 15:38:27.383,12698955776
    06/28/2022 15:38:57.387,12713439232
    06/28/2022 15:39:27.390,12724203520
    06/28/2022 15:39:57.397,12708950016
    

    Wouldnt let me upload the .csv so I have converted it to .txt but here. I could only run for an hour and a half before users started to complain of slowness.. You can see it gradually increase to 9727123456 where it hovers for a bit before continuing to 12708950016.

    Noticed this happening on another server now. Server had a total of 8GB RAM but had 20GB committed to the sspservice...eating into the storage as a "virtual memory/page file" (as i understand it anyway)

  • Sorry I missed the reply, given it grows so quickly I would run:

    wpr.exe -start VirtualAllocation

    Leave it for 3 minutes while growing, then run:

    wpr.exe -stop C:\VirtualAllocation.etl

    if you give that to Sophos they should be able to see the stacks responsible for the mem allocations.