topic Re: XDR Client version 7.5.0 High Memory Usage in Cortex XDR Discussions

XDR Client version 7.5.0 High Memory Usage

mbahen — Fri, 10 Sep 2021 21:31:01 GMT

We recently upgraded our XDR Clients from 7.4.2 to 7.5.0. Since the upgrade a lot of our Windows Servers seem to be using a lot more memory that what I recall other client versions using. For example, older versions where like 200-400MB of usage but with 7.5.0 they are using like 650MB up to 1GB of memory on the Cortex XDR Service (cyserver.exe). I can reboot the service and the memory usage goes down but slowly starts to creep up again.

I opened a ticket with support but they are like "Whaaaaaaaat?" They are still reviewing all the data we submitted

Anyone else having similar issues? Just wondering.

Thanks!

Re: XDR Client version 7.5.0 High Memory Usage

CraigV123 — Mon, 13 Sep 2021 12:22:33 GMT

Haven't had the issue "yet" per say. Getting ready to update our departments workstations to 7.5 today actually. This is good to know. I wish they'd stop EOL'ing their versions so fast. Making it hard to keep up and operate efficiently. I'll keep you posted on our results too. Thanks for the heads up on this.

Re: XDR Client version 7.5.0 High Memory Usage

mbahen — Mon, 13 Sep 2021 17:49:20 GMT

Just to Update I monitored a server over the weekend. The memory usage of the Cortex XDR service continually went up. Starting at 400MB on Friday and now, on Monday, it's at 700+. If I restart the service or machine, it goes back down to a more normal range of 250-350MB and the memory usage starts slowly creeping up again.

Nothing helpful or insightful to add from the Support crew either. Just a lot of file uploads and analyzing.

Will update if I hear something.

Re: XDR Client version 7.5.0 High Memory Usage

CraigV123 — Mon, 13 Sep 2021 19:25:09 GMT

I cancelled my IT workstation update for today until I/we can learn more. I hope they have a 7.5.1 version coming soon to maybe address some of these issues.

Re: XDR Client version 7.5.0 High Memory Usage

Alexandre_Jodoin — Tue, 14 Sep 2021 14:21:19 GMT

We got a server where cyserver.exe is taking 20GB of memory. Also in contact with support.

Re: XDR Client version 7.5.0 High Memory Usage

mbahen — Wed, 15 Sep 2021 16:05:02 GMT

Is it version 7.5.0 too?

Re: XDR Client version 7.5.0 High Memory Usage

Alexandre_Jodoin — Wed, 15 Sep 2021 16:06:40 GMT

yup, 7.5.0.36150

Re: XDR Client version 7.5.0 High Memory Usage

jcandelaria — Wed, 15 Sep 2021 16:45:24 GMT

@Alexandre_Jodoin

Please work with support on this one, using 20GB is really really really too high. This needs to be investigate thoroughly..

They probably need to look deeper at the low level logs on this one.

Re: XDR Client version 7.5.0 High Memory Usage

Alexandre_Jodoin — Wed, 15 Sep 2021 16:47:42 GMT

Yes, I have CASE 01947582 open for this issue.

Re: XDR Client version 7.5.0 High Memory Usage

mbahen — Thu, 23 Sep 2021 21:39:41 GMT

Just to update the thread. We've been working with support on this issue. They stated it may be an issue with the Network Packet Inspection module of the client. They released some new content releases to try and resolve the issue. So far with those releases (197 and 198) they appear to at least slow the memory leaking. Still working to see if we have to restart the cyserver.exe process to make the "fix" take hold or not

Re: XDR Client version 7.5.0 High Memory Usage

CraigV123 — Fri, 24 Sep 2021 09:52:02 GMT

Thanks for the update! Definitely appreciated.

Re: XDR Client version 7.5.0 High Memory Usage

mbahen — Tue, 05 Oct 2021 11:20:35 GMT

Final Update: It appears that between the Content Update 198 and restarting the servers or cyserver.exe at least, the memory issues have leveled off. We've closed our ticket with support.

Re: XDR Client version 7.5.0 High Memory Usage

CraigV123 — Tue, 05 Oct 2021 11:47:37 GMT

Thanks for the update!

Re: XDR Client version 7.5.0 High Memory Usage

Alexandre_Jodoin — Tue, 05 Oct 2021 12:49:41 GMT

content version 198 was the fix.