You might encounter the following symptoms when certain filter drivers are loaded into a system that is running Microsoft SQL Server components:
High CPU usage for the SQL Server process, especially privileged processor time
Very slow response from SQL Server even when the concurrent amount of load/activity is not unusually heavy
Reports of various hang-related error messages and conditions (SQL Server scheduler messages such as 17883, application time-out messages, and severe blocking in SQL Server)
Filter drivers can be installed on a system as part of the Setup program of an application to provide a certain kind of functionality. Examples include antivirus protection, online backups, encryption services, and data compression or defragmentation facilities. These filter drivers insert themselves into the Windows driver stack to enhance or alter the behavior of requests that pass through the driver stack and that are intended for a device.
Under some conditions, these requests may either take a long time to complete or consume excessive resources. When this occurs, various problems occur that are discussed in the "Symptoms" section. Also, there might be some form of incompatibility between the different filter drivers that are present in the same driver stack and that could also lead to some of the problems that are discussed in the "Symptoms" section.
The general approach to resolve these situations is as follows.
Note See the "More Information" section for more information about each of the following steps:
Identify the filter driver that is causing the problem.
Perform the following actions for that filter driver in question:
Configure the filter driver or its associated software in such a way that it does not interfere with the SQL Server workload or operations.
Disable the filter driver from loading into the system.
Contact the vendor of the filter driver or application software, check for updates, and apply them.
In rare situations, you may have to remove the filter driver and the associated software to make sure that the system and SQL Server can function without the issues that are discussed in the "Symptoms" section. Warning This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
In some instances, you may have to perform all these actions. Refer to the "More information" section for instructions that are specific to certain filter drivers.
Microsoft Customer Support and Services team (CSS) had identified the following filter drivers that can cause the symptoms that are mentioned in this article. This list will be updated when new issues are found. This list is provided to help with the identification process that was described in the "Resolution" section. Finding the problematic filter driver typically involves collecting an iterative set of diagnostic and tracing data when the problem occurs.
The following filter drivers that can cause performance and stability issues for SQL Server:
MFEBOPK.SYS This filter driver is used for the Buffer Overflow Protection feature in McAfee VirusScan Enterprise. If you have this feature enabled, you will notice that sqlservr.exe is among the list of processes protected by Buffer Overflow Protection. If you have this filter driver on a system that is running SQL Server, you must perform the actions that are specified in the "Resolution" section. You can also refer to the following links for more information:
NLEMSQL64.SYS and NLEMSQL.SYS This filter driver is installed by the NetLib Encryptionizer software. When this filter driver is installed on a computer that is running SQL Server, and you perform backup to a network share, you might encounter failures that return " Operating system error 1 : Incorrect function." To resolve this problem, contact the software vendor to obtain updates to the filter driver.
MFETDIK.SYS This filter driver is used for the McAfee Anti-Virus Mini-Firewall feature in the products McAfee VirusScan Enterprise and McAfee McShield. If you have this feature enabled, you will notice that sqlservr.exe is among the list of processes monitored by the Anti-Virus feature. If you have this filter driver on a system that is running SQL Server, you must perform the actions that are specified in the "Resolution" section. You could also consider adding SQL Server processes to the low risk process list in the Anti-Virus configuration.
For more general information about filter drivers, please refer to the following links:
The following table provides more information about the products or tools that automatically check for this condition on your instance of SQL Server and on the versions of the SQL Server product against which the rule is evaluated.
Product versions against which the rule is evaluated
System Center Advisor
System filter driver detected that can cause performance and database consistency problems for SQL Server
System Center Advisor checks for the presence of the filter driver "MFEBOPK.SYS" in this system and generates the alert. Follow the instructions from this article to resolve the issues that are related to this filter driver.
SQL Server 2008
SQL Server 2008 R2
SQL Server 2012
System Center Advisor
System filter driver detected that can cause problems for backups in SQL Server
System Center Advisor checks for the presence of the filter driver "nlemsql.sys" or "nlemsql64.sys" in this system. If this filter driver is present, and SQL Server backups are saved to a network share, advisor generates the alert. Follow the instructions from this article to resolve the issues that are related to this filter driver.
SQL Server 2008
SQL Server 2008 R2
SQL Server 2012
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
The information and the solution in this document represents the current view of Microsoft Corporation on these issues as of the date of publication. This solution is available through Microsoft or through a third-party provider. Microsoft does not specifically recommend any third-party provider or third-party solution that this article might describe. There might also be other third-party providers or third-party solutions that this article does not describe. Because Microsoft must respond to changing market conditions, this information should not be interpreted to be a commitment by Microsoft. Microsoft cannot guarantee or endorse the accuracy of any information or of any solution that is presented by Microsoft or by any mentioned third-party provider.
Microsoft makes no warranties and excludes all representations, warranties, and conditions whether express, implied, or statutory. These include but are not limited to representations, warranties, or conditions of title, non-infringement, satisfactory condition, merchantability, and fitness for a particular purpose, with regard to any service, solution, product, or any other materials or information. In no event will Microsoft be liable for any third-party solution that this article mentions.