uberAgent for macOS exhibits excessive memory consumption

book

Article ID: CTX695464

calendar_today

Updated On:

Description

uberAgent for macOS exhibits excessive memory consumption, potentially reaching several gigabytes, which causes noticeable system performance degradation. 
This high memory utilization can be verified through Apple's Activity Monitor application.

Depending on the system's hardware specifications, elevated CPU utilization exceeding 15% may also be observed.

Affected versions:

  • uberAgent 7.1.0
  • uberAgent 7.1.1
  • uberAgent 7.1.2
  • uberAgent 7.2.0
  • uberAgent 7.2.1
  • uberAgent 7.3.0
  • uberAgent 7.3.1
  • uberAgent 7.4.0
  • uberAgent 7.4.1

Cause

When ESA is enabled, filesystem activity monitoring is activated by default. 
On systems experiencing very high disk I/O activity, this configuration generates a significant volume of filesystem events that uberAgent must process. 
A performance bottleneck in the file header verification process causes memory usage to increase rapidly as filesystem event messages accumulate faster than they can be processed.
Disabling filesystem activity monitoring and restarting uberAgent prevents this condition from recurring.

Resolution

To mitigate uberAgent's excessive memory consumption, disable the filesystem activity monitoring functionality in the configuration file and restart the service. This operation requires administrative privileges on the affected system.

Step 1: Disable filesystem activity monitoring

  • Navigate to the configuration file located at /Library/Application Support/uberAgent/uberAgent.conf
  • Locate the [FilesystemMonitoring] section near the bottom of the file
  • Add the parameter "Enabled=False" directly beneath this section header
  • The modified section should appear as follows:

  [FilesystemMonitoring]
  Enabled=False

 

Step 2: Restart uberAgent

Option A: Terminate the "uberAgent" process via Activity Monitor. The service will automatically restart.

Option B: Execute the following command in Terminal:

sudo launchctl kickstart -k system/com.vastlimits.uberAgent

This command will terminate the current uberAgent instance and initiate an immediate restart.

Issue/Introduction

uberAgent for macOS exhibits excessive memory consumption/

Additional Information

ESA: https://docs.citrix.com/en-us/uberagent/current-release/esa-features-configuration/enabling-esa

Filesystem Activity Monitoring: https://docs.citrix.com/en-us/uberagent/current-release/esa-features-configuration/threat-detection-engine/file-system-activity-monitoring