Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

SEP 11.0.5 Installed on Server Causing Poor Network Performance

Updated: 18 Jun 2010 | 11 comments
NewAVMan's picture
0 0 Votes
Login to vote

Hello,

I have an issue where SEP client 11.0.5 64-bit AV/Anti Spyware only is installed on a Windows 2008 Ent. VMWare guest server.  This server is used for file sharing only.  I have a Citrix user mapped to a share on this server and is running a payroll processing program.  When they process reports it is extremely slow.  If i disable AV on the server, it starts processing at full speed.  

So, i created a  "User-defined exception" excluding this folder and have the box checked for "include subfolders".  However, the slowdown still exists.  The Citrix server does not have AV installed on it. 

Any guidance with this problem would be helpful.

Thanks!

Comments

NewAVMan's picture
17
Nov
2009
0 Votes 0
Login to vote

Thank you for your reply

Thank you for your reply Vikram.  I had seen that doc before.  However,  it doesn't help.  I have a server group with the communication settings in pull mode with 30 minute intervals.  The Network Settings were already unchecked and none of the other items stand true for my environment.  

It just seems strange that the SEP client on the server still seems to be scanning everything coming over the network to that share that is excluded. 

Does the SEP client process every byte coming over the wire with only Antivirus/AntiSpyware installed?  Even if the folder it is accessing is excluded?

Thank you for your continued help.

AravindKM's picture
17
Nov
2009
0 Votes 0
Login to vote

In registry confirm that

In registry confirm that mapped drive is excluded .Below doc can help you in this
How to Verify if an Endpoint Client has Automatically
Excluded an Application or Directory 

Please don't forget to mark your thread solved with whatever answer helped you : ) Thanks & Regards Aravind

NewAVMan's picture
17
Nov
2009
0 Votes 0
Login to vote

The registry entry is there

The registry entry is there confirming the exclusion.  I made some additional changes to the Policy including disabling the Intrusion Prevention policy.  We will be testing this changes today.  i will post the results then.

Thanks AriavindKM.

Vikram Kumar-SAV to SEP's picture
17
Nov
2009
0 Votes 0
Login to vote

 Whenever a file accesed or

 Whenever a file accesed or modified it is scanned.However if it is in exclusion the file should be skipped.

NewAVMan's picture
17
Nov
2009
0 Votes 0
Login to vote

Exactly what I was expecting,

Exactly what I was expecting, but that doesn't seem to be the case.  Disabling Intrusion Prevention did not solve the problem.  I am currently running the Symantec Endpoint Protection Support tool while the client is running the report.  Hopefully something will pop up.

NewAVMan's picture
17
Nov
2009
0 Votes 0
Login to vote

Nothing came up with the

Nothing came up with the support tool except a few files (not in that share) that had questionable content. 

Any other thoughts on this issue?

Stix's picture
23
Nov
2009
0 Votes 0
Login to vote

 Hi See this article and note

 Hi

See this article and note the comments.

http://windowsitpro.com/articles/articleid/100210/...

Installing 11.0.4 MR4 MP2 seemed to resolve the issues for them.  We deployed a new 2008 file server with SEP 11.0.5 installed and network performance was horrible even with all the extra "options" turned off.

We are going to try and install 11.0.4 MR4 MP2 and see if that resolves the issues.

Will keep you posted.

Stix's picture
01
Dec
2009
0 Votes 0
Login to vote

Bump. I'm doubtful as to

Bump.

I'm doubtful as to whether installing an older version will actually fix the issue.

Does anyone have any other thoughts?

Joannie's picture
17
Dec
2009
0 Votes 0
Login to vote

Turn off auto-protect completely

You can always turn off auto-protect on your Windows 2008 file server. That's what we had to do and now there are no more complaints from users about slow response time and the system has quit hanging. We've upgraded to 11.0.5, but I haven't turned auto-protect back on for fear of it not acutally being resolved (this was one of those issues that was supposed to get resolved in one release after another, but never did). We took this action based on recommendation of a Symantec employee in this thread: https://www-secure.symantec.com/connect/forums/mr3-locks-server-2008-file-shares 

There is also another problem involving Symantec and Win 2008 servers (not just file servers) that is covered on the tale end of that thread. You have to disable "Large Send Offload" in the NIC properties, and this also resolves Remote Desktop issues into the server when Symantec is installed.

Stix's picture
17
Dec
2009
0 Votes 0
Login to vote

 We actually resolved our

 We actually resolved our issue.  I installed version 11.0.4202 MR4 MP2 and it works fine even with auto-protect on.

And yep, we've already disabled the LSO on the NIC.

Cheers