Forum Discussion

MarcVDH's avatar
MarcVDH
Iron Contributor
Oct 14, 2024

SenseNdr.exe is slowly eating the memory

Hello, For a few days now, we have some Windows Server 2019 physical machines where almot all the memory is commited to sensendr.exe. If you terminate sensendr.exe, the process comes back after...
Jack1314's avatar
Jack1314
Copper Contributor
Nov 01, 2024
Thanks for the update! We’re experiencing the same issue, so it’s reassuring to hear Microsoft is implementing a fix. If you don’t mind, please let us know if it resolves the issue on your end. Fingers crossed
MarcVDH's avatar
MarcVDH
Iron Contributor
Nov 04, 2024
I contacted Microsoft again to check if the fix is really implemented because we had multiple servers experiencing the problem again this week-end. On my side, it is not solved yet.
  • mjhelmb's avatar
    mjhelmb
    Brass Contributor
    Nov 04, 2024
    I received multiple alerts over the weekend for this. Latest was 5 minutes ago.

    Security intelligence
    Version 1.421.79.0
    Nov 3, 2024 2:46:44 PM

    Engine
    Version 1.1.24090.11
    Nov 3, 2024 2:46:44 PM

    Platform
    Version 4.18.24090.11
    Oct 31, 2024 12:13:55 AM
    • MarcVDH's avatar
      MarcVDH
      Iron Contributor
      Nov 04, 2024

      @ Everyone

      I just got a mail from Microsoft that the solution/fix deployed last week was to solve a problem with a non-paged pool memory leak and not with the commited memory !!

      In my case, the problem is not with the non-paged pool but with the commited memory.

      Can you all tell me with what type of memory you experience a problem ?

      I ask that because apparently I am the only customer case with the problem being with the commited memory !! 

       

      It's a big disappointment because I made it clear since the beginning of the case with MS that it was a problem with the commited memory.

      • mackc92's avatar
        mackc92
        Brass Contributor
        Nov 04, 2024

        MarcVDH We are also experiencing the issue with high committed memory, and I am experiencing the same problem with my Microsoft ticket. They are currently telling me to "update to KB5044281 and monitor to see if the issue persists" - we updated our servers prior to opening our Microsoft case, and this was indicated in an email to my support engineer early on. I am trying to escalate my case.

         

        If it helps you get any traction, my case number is 2410180010009861.

  • Jack1314's avatar
    Jack1314
    Copper Contributor
    Nov 04, 2024

    MarcVDH 
    What is the version of your  Security Intelligence Update for Microsoft Defender Antivirus.
    I saw two versions while doing environment maintenance today:
    KB2267602 (Version 1.421.79.0) - Current Channel (Broad)
    KB2267602 (Version 1.421.82.0) - Current Channel (Broad)

    • fheff's avatar
      fheff
      Copper Contributor
      Nov 04, 2024

      Issue still present today unfortunately.
      You can look at the memory graphs of your monitoring system or look for Event ID 2004 in the Windows Event log.

      Windows successfully diagnosed a low virtual memory condition.
      The following programs consumed the most virtual memory:
      SenseNdr.exe (6400) consumed 99208146944 bytes (92.4 GB),
      CVODS.exe (15108) consumed 1249665024 bytes (1.16 GB),
      and MsSense.exe (3592) consumed 957243392 bytes (0.89 GB).


      In the screenshot it just crashed the server, at least it rebooted itself...

  • Jack1314's avatar
    Jack1314
    Copper Contributor
    Nov 04, 2024

    MarcVDH Thanks for the update! I plan to do server maintenance today to check if the issue is resolved. I will keep you posted as well. Thanks again!

Resources