XDR Client version 7.5.0 High Memory Usage

[mbahen]

We recently upgraded our XDR Clients from 7.4.2 to 7.5.0. Since the upgrade a lot of our Windows Servers seem to be using a lot more memory that what I recall other client versions using. For example, older versions where like 200-400MB of usage but with 7.5.0 they are using like 650MB up to 1GB of memory on the Cortex XDR Service (cyserver.exe). I can reboot the service and the memory usage goes down but slowly starts to creep up again.

I opened a ticket with support but they are like "Whaaaaaaaat?" They are still reviewing all the data we submitted

Anyone else having similar issues? Just wondering.

Thanks!

[CraigV123]

Haven't had the issue "yet" per say. Getting ready to update our departments workstations to 7.5 today actually. This is good to know. I wish they'd stop EOL'ing their versions so fast. Making it hard to keep up and operate efficiently. I'll keep you posted on our results too. Thanks for the heads up on this. 

[mbahen]

Just to Update I monitored a server over the weekend. The memory usage of the Cortex XDR service continually went up. Starting at 400MB on Friday and now, on Monday, it's at 700+. If I restart the service or machine, it goes back down to a more normal range of 250-350MB and the memory usage starts slowly creeping up again.

Nothing helpful or insightful to add from the Support crew either. Just a lot of file uploads and analyzing. 

Will update if I hear something.

[CraigV123]

I cancelled my IT workstation update for today until I/we can learn more. I hope they have a 7.5.1 version coming soon to maybe address some of these issues. 

[Alexandre_Jodoin]

We got a server where cyserver.exe is taking 20GB of memory. Also in contact with support.

[mbahen]

Is it version 7.5.0 too?

[Alexandre_Jodoin]

yup, 7.5.0.36150

[jcandelaria]

@Alexandre_Jodoin 

Please work with support on this one, using 20GB is really really really too high. This needs to be investigate thoroughly..

They probably need to look deeper at the low level logs on this one.

[Alexandre_Jodoin]

Yes, I have CASE 01947582 open for this issue.

[mbahen]

Just to update the thread. We've been working with support on this issue. They stated it may be an issue with the Network Packet Inspection module of the client. They released some new content releases to try and resolve the issue. So far with those releases (197 and 198) they appear to at least slow the memory leaking. Still working to see if we have to restart the cyserver.exe process to make the "fix" take hold or not

[CraigV123]

Thanks for the update! Definitely appreciated.

[mbahen]

Final Update: It appears that between the Content Update 198 and restarting the servers or cyserver.exe at least, the memory issues have leveled off. We've closed our ticket with support.

[CraigV123]

Thanks for the update! 

[Alexandre_Jodoin]

+1

content version 198 was the fix.