SEP 11.0.5 Installed on Server Causing Poor Network Performance
Updated: 18 Jun 2010 | 11 comments
Hello,
I have an issue where SEP client 11.0.5 64-bit AV/Anti Spyware only is installed on a Windows 2008 Ent. VMWare guest server. This server is used for file sharing only. I have a Citrix user mapped to a share on this server and is running a payroll processing program. When they process reports it is extremely slow. If i disable AV on the server, it starts processing at full speed.
So, i created a "User-defined exception" excluding this folder and have the box checked for "include subfolders". However, the slowdown still exists. The Citrix server does not have AV installed on it.
Any guidance with this problem would be helpful.
Thanks!
discussion Filed Under:
Comments
http://service1.symantec.com
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007102311173048
VMWARE-- SEP 12.1 vs McAfee vs Trend Micro
Thank you for your reply
Thank you for your reply Vikram. I had seen that doc before. However, it doesn't help. I have a server group with the communication settings in pull mode with 30 minute intervals. The Network Settings were already unchecked and none of the other items stand true for my environment.
It just seems strange that the SEP client on the server still seems to be scanning everything coming over the network to that share that is excluded.
Does the SEP client process every byte coming over the wire with only Antivirus/AntiSpyware installed? Even if the folder it is accessing is excluded?
Thank you for your continued help.
In registry confirm that
In registry confirm that mapped drive is excluded .Below doc can help you in this
How to Verify if an Endpoint Client has Automatically
Excluded an Application or Directory
Please don't forget to mark your thread solved with whatever answer helped you : ) Thanks & Regards Aravind
The registry entry is there
The registry entry is there confirming the exclusion. I made some additional changes to the Policy including disabling the Intrusion Prevention policy. We will be testing this changes today. i will post the results then.
Thanks AriavindKM.
Whenever a file accesed or
Whenever a file accesed or modified it is scanned.However if it is in exclusion the file should be skipped.
VMWARE-- SEP 12.1 vs McAfee vs Trend Micro
Exactly what I was expecting,
Exactly what I was expecting, but that doesn't seem to be the case. Disabling Intrusion Prevention did not solve the problem. I am currently running the Symantec Endpoint Protection Support tool while the client is running the report. Hopefully something will pop up.
Nothing came up with the
Nothing came up with the support tool except a few files (not in that share) that had questionable content.
Any other thoughts on this issue?
Hi See this article and note
Hi
See this article and note the comments.
http://windowsitpro.com/articles/articleid/100210/...
Installing 11.0.4 MR4 MP2 seemed to resolve the issues for them. We deployed a new 2008 file server with SEP 11.0.5 installed and network performance was horrible even with all the extra "options" turned off.
We are going to try and install 11.0.4 MR4 MP2 and see if that resolves the issues.
Will keep you posted.
Bump. I'm doubtful as to
Bump.
I'm doubtful as to whether installing an older version will actually fix the issue.
Does anyone have any other thoughts?
Turn off auto-protect completely
You can always turn off auto-protect on your Windows 2008 file server. That's what we had to do and now there are no more complaints from users about slow response time and the system has quit hanging. We've upgraded to 11.0.5, but I haven't turned auto-protect back on for fear of it not acutally being resolved (this was one of those issues that was supposed to get resolved in one release after another, but never did). We took this action based on recommendation of a Symantec employee in this thread: https://www-secure.symantec.com/connect/forums/mr3-locks-server-2008-file-shares
There is also another problem involving Symantec and Win 2008 servers (not just file servers) that is covered on the tale end of that thread. You have to disable "Large Send Offload" in the NIC properties, and this also resolves Remote Desktop issues into the server when Symantec is installed.
We actually resolved our
We actually resolved our issue. I installed version 11.0.4202 MR4 MP2 and it works fine even with auto-protect on.
And yep, we've already disabled the LSO on the NIC.
Cheers
Would you like to reply?
Login or Register to post your comment.