6 Replies Latest reply: May 17, 2012 6:17 AM by zman RSS

    TMCSVC.EXE Killing Our VMs

    Apprentice

      So I finally got some time to upgrade to LDMS 9.0 SP3 on Monday night.  After the upgrade, everything went fine.  That is, until the next morning when systems started running their compliance scans.  Our VMWare cluster got hammered.  Apparently, all of the VMs cpu usage shot up to 100%.  The process responsible was TMCSVC.exe.  We shut down the core server, and that fixed the problem instantly.  After some troubleshooting with LANDesk, we determined that the cause of the tmcsvc.exe usage was from clients running their vulnerability scans.  LANDesk does a check to make sure the vulscan files are updated.  If not, it pulls them from the core.  Apparently, it uses multicast to do that.  The workload on the random servers was so much it crushed the host systems.  Random systems that aren't in our VM cluser were clocking 2-10% cpu usage for tmcsvc.exe.  We've only got 1500 clients in this subnet, and we have a 3 hour random scan window in the morning.  Has anyone else ever experienced something like this?  I figure that either I have LANDesk configured wrong, we have vmware configured wrong, or too many systems in the same subnet?  I'm just a little worried.  I don't want to be the one who killed all of our servers at the same time...even if it's only temporarily.

        • 1. Re: TMCSVC.EXE Killing Our VMs
          zman Master

          So were the clients also updated or just the core. I stalked tmcsvc.exe during a normal vulscan 0% utilization. I then smoked all my vulscan client configuration files, and then ran vulscan again - 0% utilization.  Vulscan did consume about 25%.  Any hips/Viruscan etc... on the vmware clients?

          • 2. Re: TMCSVC.EXE Killing Our VMs
            Apprentice

            Just the core for now.  I've been redeploying the agent as recommended, but I've only gotten to about 10% of the clients thus far.  It's only a problem when clients run their vuln scan for the first time after the core was updated (and before their agents were updated).  It seems like the majority of the problem has passed, but I'm more worried about getting this resolved so that when I apply a patch for the LDMS patching, it doesn't do this again.  Here is an excerpt from a TMCSVC.log file.  The system that I pulled this from has been bouncing from 0% to 20% CPU usage from tmcsvc.exe.  It was updated to SP3 yesterday morning.  It's relatively fine.  It's not until you have 50 VM systems all on the same VMWare host doing that at the same time.  I've been told that one of our Citrix servers has been shooting from 10% to 100% cpu usage from just TMCSVC.exe.

             

            TMCSVC.LOG:

             

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.187

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.165

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.102

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.40.218

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.111

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.212

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.194

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.211

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.33.122

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.30.39

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.125

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.248

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.83

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.20.235

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.54

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.103

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.139

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.23

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.40.64

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.23.5

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.201

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.64

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.15

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.66

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.99

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.177

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.30.5

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.183

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.48.242

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.207

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.7

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.225

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.20.219

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.83

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.47.245

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.40.54

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.252

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.137

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.232

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.20.253

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.47

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.34.216

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.191

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.157

            Wed, 16 May 2012 12:00:50 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.121

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.120

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.1

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.48.41

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.78

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.62

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.163

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.40.217

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.56

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.20.238

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.0.181

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.164

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.177

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.81

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.29

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.105

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.138

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.180

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.204

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.20.191

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.41.249

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.31.215

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.30.77

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.43.136

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.41

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.45.202

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.64

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.30.114

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.40.111

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.31.161

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.82

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.30.57

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.42.205

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.23.6

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=DownloadDiscovery, from 10.1.28.204

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.67

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.9

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.4

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.71

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.170

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.1

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.34

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.30.191

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.209

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=DownloadDiscovery, from 10.1.21.131

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.122

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.48

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.100

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.66

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.17

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.23

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.66

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.56

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.4

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.141

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.255

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.46.170

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.23.8

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.15

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.168

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.173

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.23

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.37.20

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.79

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.26

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.19

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.30.51

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.77

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.184

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.157

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.97

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.144

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.63

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.36

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.144

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.25

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.165

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.32.4

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.68

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.20.168

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.214

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.30.122

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.101

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.226

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.206

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.217

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.20.186

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=DownloadDiscovery, from 10.1.22.19

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.40.211

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.25

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.212

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.28.74

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.152

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.29.165

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.27.100

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.22.106

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.118

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.31

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.30.98

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.20.183

            Wed, 16 May 2012 12:00:51 1964 1208 SAD Received file discovery reply for vulscan.exe, curSize=128816, state=Inactive, from 10.1.21.39

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.183

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.30.46

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.42.10

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.30.167

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.46.254

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.248

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.7

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.210

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.15

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.20.223

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.205

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.111

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.241

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.140

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.0

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.94

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.110

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.13

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.40.69

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.88

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.20.235

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.199

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.73

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.30.210

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.192

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.22.30

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.30.183

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.162

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.255

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.36.151

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.11

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.1

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.121

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.30.62

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.71

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.20.255

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.102

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.217

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.71

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.23

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.221

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.97

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.157

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.83

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.30.61

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.81

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.157

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.41

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=DownloadDiscovery, from 10.1.22.13

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.206

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.96

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.45.141

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.22.23

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.226

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.25

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.225

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.63

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.83

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.43.136

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.212

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.47.245

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.163

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.20.186

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.28.168

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.77

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.204

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.22.180

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.67

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.68

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.48.134

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.101

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.30.25

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.66

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.151

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.30.122

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.57

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.233

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.125

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.165

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.30.185

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.31

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.184

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=DownloadDiscovery, from 10.1.30.110

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.185

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.208

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.27.42

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.20.183

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.21.39

            Wed, 16 May 2012 12:00:54 1964 1208 SAD Received file discovery reply for ENUvulscan.dll, curSize=240128, state=Inactive, from 10.1.29.191

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.96

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.162

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.88

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.22.30

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.79

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.30.161

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.33

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.163

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.218

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.231

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.212

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.206

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.94

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.40

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.235

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.110

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.217

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.121

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.199

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.73

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.129

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.23

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.64

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.30.34

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.56

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.40.126

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.253

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.207

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.22.32

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.222

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.40.69

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.4

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.111

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.54

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.11

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.30.165

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.201

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.221

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.185

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.213

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.36.151

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.163

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.26

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.97

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.168

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.38.95

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.83

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.175

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.29

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.0.181

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.42.14

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.45.202

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.30.62

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.40.83

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.170

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.22.211

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.157

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.102

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.204

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.41.249

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.212

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.84

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.47.99

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.82

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.48.146

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.132

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.129

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.14

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.210

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.19

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.103

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.214

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.86

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.146

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.30.39

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=DownloadDiscovery, from 10.1.28.204

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.230

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.122

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.113

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.206

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.103

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=DownloadDiscovery, from 10.1.21.131

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.48.134

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.217

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.36

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.22.25

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.21

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.66

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.85

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.144

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.45.141

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.75

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.191

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.83

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.43.136

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.77

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.219

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.68

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.41.178

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.30.5

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.214

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.32.4

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.60

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.23.13

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.168

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.23

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.34.216

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.9

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.202

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.47.245

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.177

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.255

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.30.122

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.22.23

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.101

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.173

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.30.183

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.40.211

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.125

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.151

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.185

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.28.74

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.30.69

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.18

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.21.201

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.139

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.29.165

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.100

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=DownloadDiscovery, from 10.1.30.110

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.229

            Wed, 16 May 2012 12:00:56 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.27.108

            Wed, 16 May 2012 12:00:57 1964 1208 SAD Received file discovery reply for ldavhlpr.dll, curSize=686592, state=Inactive, from 10.1.20.183

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.22.48

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.30.47

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.22.94

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=DownloadingPeer, from 10.1.48.206

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.32.145

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.22.119

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.29.199

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.27.46

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.28.21

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.28.212

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.21.171

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.22.62

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.21.204

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.22.95

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.27.121

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.28.82

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.29.114

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.30.84

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.28.113

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.21.21

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.21.166

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.30.25

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.32.4

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.30.122

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.21.101

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.29.101

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.21.2

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.29.26

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.45.141

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.28.157

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.45.123

            Wed, 16 May 2012 12:00:58 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=0, state=DownloadDiscovery, from 10.1.27.136

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for LANDeskScan.dll, curSize=253952, state=Inactive, from 10.1.22.234

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.22.43

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.27.171

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.27.206

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.21.61

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.20.152

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.37.96

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.28.77

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.27.214

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.20.185

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.21.84

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.21.11

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.27.73

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.29.194

            Wed, 16 May 2012 12:00:59 1964 1208 SAD Received file discovery reply for vulscan.dll, curSize=2151936, state=Inactive, from 10.1.28.132

            • 3. Re: TMCSVC.EXE Killing Our VMs
              Apprentice

              Zman wrote:

               

              So were the clients also updated or just the core. I stalked tmcsvc.exe during a normal vulscan 0% utilization. I then smoked all my vulscan client configuration files, and then ran vulscan again - 0% utilization.  Vulscan did consume about 25%.  Any hips/Viruscan etc... on the vmware clients?

              To answer your question, the server agent we use has nothing checked on the agent configuration page.  We just use it for inventory data.  They do run a vulscan on Saturday and Sunday mornings.  Our standard clients run a scan at 9am every day.  (Randomized up to 3 hours)

              • 4. Re: TMCSVC.EXE Killing Our VMs
                zman Master

                Looks weird, what version/sp are the clients experiencing the issue. I can't remember TMC being used for vulscan updates, but lately I can't remember a lot of things.

                • 5. Re: TMCSVC.EXE Killing Our VMs
                  Apprentice

                  The VMs on our ESX servers are the ones that have been hit the hardest.  Yesterday morning they were all pegged at 100% cpu usage.  Apparently the ESX cluster has been about 20-30% higher CPU usage than typical for the last two days because of this issue.  All of the VMs should be running 9.0 SP2.  TMC seems like a horrible idea for vulscan updates.  The dumb thing is that if there was a way to update vulscan for every computer on our subnet at once, it would take signigicantly less resources than this trickle crap.  I'm on a lot of people's !@#$* list right now, so I have been stepping on eggshells with anything I do LANDesk related.  I need to push out more SP3 agents, but I am so worried about breaking anything...

                  • 6. Re: TMCSVC.EXE Killing Our VMs
                    zman Master

                    So you can do a couple of things to prevent the auto update. You can run vulscan with /noupdate switch, or push out the new client.  That amount of files that is being updated should not cause an issue, so I would guess there is a issue with the SP2 version of TMCSVC.EXE.  If you push out the new client you can do it in a controlled fashion, taking care to not over burden your VM clusters. We have an enormous VMware architecture and have never seen this issue.

                     

                    If it were me I would start pushing the new client to a test group and evaluate and then start upgrading your VM clusters first.