Endpoint Protection

Hello.

We have a situation where it looks like SEP is ignoring our exclusion filters.

After migrating to a new environment we found that a stress test program we use for testing our software would run slowly. In the old environment the test would finish after several hours. In the new environment, we let the test run for a couple days and it was not able to finish.

This is odd because the new environment has much better hardware. We expected the test to finish more quickly. Using the free profiler from AMD we found that a bunch of time was being spent in these modules from SEP:
BHDDrvx64.sys
UMEngx86.dll

This was also odd because we have an exclusion for the directory where the tester executable, 'testee', and the logs that they generate reside.

We found that uninstalling SEP gave us the performance we expected ( i.e. better than in the old environment ). We also found that if we turned off logging in our executables the performance was more like we expected.

So it seems that our performance problem comes down to SEP not using our exclusion filter. D:\builds\*

Below our descriptions of our old and new environments

 - Old environment:

OS: Windows 2003

SEP: 12.1.4013.4013 (32-bit)

 - New environment

OS: Windows 2012 R2

SEP: 12.1.4013.4013 (64 bit)

Looking for any ideas or suggestions.

Thanks.

Jason

Did you verify the exclusions were in place on the client itself?

Also, wildcards are not supported. Just use D:\ and select the option for subfolders as well.

Hello and thank you for replying.

I am actually configuring this exception rule on the client side. Under User-defined exceptions, the * comes from my having selected the "Include Subfolders" checkbox.

For example, if I just create the rule on the folder "D:\builds\", the Exception Item shows up as "D:\builds". If I select the "Include Subfolders" checkbox, it displays "D:\builds\*"

I just finished another test using the suggestion of going to D:\ with the "include subfolders" checkbox and it didn't work.

I attached a screenshot so you can see what I what I am referring to.

Any other suggestions that you would like for me to try?

Jason

Did you also set the same exceptions for SONAR?

The two file names you mentioned above are for SONAR.

You could also temporarily disable SONAR and re-test.