Endpoint Protection

 View Only
Expand all | Collapse all

SEPM 12.1.3 and Backup Exec 2010 R3

  • 1.  SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 10:03 AM

    I recently went through an upgrade to our SEPM software from 12.1.2 to 12.1.3.

    Using Backup Exec 2010 R3, One noteable issue has cropped up with 1 server.

    All outgoing file copies, and backups are going at a very slow pace.  backups are going at 90-100MB/minute, and copies out of the server are going at 1/10th the speed. 

    No other servers are experiencing this issue.  They are all using the same SEPM policies.

    to verify the SEPM client is the issue, I have turned off SEP on the server having the issue, and backups/network performance returns to normal.

    The server is the only server using Nic TEAMING, All four network ports are teamed into 1 port via bacs, I can't break the team at this time to test anything if this is the potential issue.

    I think it is Network threat protection, but as I am new to configuring SEPM, am just starting to look at the configurations, and trying to come up with a solution to this issue. 

    I found an issue fixed in 12.1.3 that seems close to what I am experiencing Now, but this relates to windows xp unfortunately.

    "Network performance slows on Windows XP with Symantec Endpoint Protection 12.1.2 MP1 installed

    Fix ID: 3180923

    Symptom: Computers experience network performance problems when the Network Threat Protection (NTP) firewall component of the Symantec Endpoint Protection 12.1.2 MP1 client is installed and enabled. Symptoms include:

    • Copying files from a network location over Windows File Sharing takes significantly more time.
    • Programs that are started from a network share take significantly longer to load.
    • Ping responses take longer to return.

    Solution: Modified the firewall to call the correct notification routine for Windows XP."

     

    I also found this Backup Exec Backup and Restore job rates are slower than expected with Symantec Endpoint Protection 12.1 installed"  http://www.symantec.com/business/support/index?page=content&id=TECH168940 which denotes slow backup speeds in 12.1 SEPM with a rundown on firewall additions, and antivirus scan change.  Which I added in, and doesn't seem to have an effect.

     



  • 2.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 10:06 AM

    Have you seen this KBA:

    http://www.symantec.com/docs/TECH105418

    What components do you have installed? You mentioned NTP, have you disabled only the firewall to see what the result is?

    If those steps don't work, I would suggest engaging Symantec support.



  • 3.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 10:24 AM

    I found 1 setting I missed in the initial advanced scanning and monitoring setting change, namely 'scan when a file is modified'.  As soon as I get access back to the server I will retest the settings, and disabling the firewall entirely.

    The thing that throws me a bit is every server we have on this network are under the same sepm policies and exhibit none of these symptoms. 



  • 4.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 10:27 AM

    So it's just one server affected. Is there anything different about it compared to the others?

    Let's see what happens after disabling the firewall. While SEP (and all of its components) are supported on server, you may want to to start with only the AV component installed. Good KBA here for reference:

    Best Practices for Installing Symantec Endpoint Protection (SEP) on Windows Servers

    Article:TECH92440  |  Created: 2009-01-18  |  Updated: 2013-06-18  |  Article URL http://www.symantec.com/docs/TECH92440

     

    But, let's see what happens with firewall disabled first. It could be unreleated.



  • 5.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 10:43 AM

    I have changed the setting scan when file is modified, and that does not affect performance upwards.

    Turned off NTP only and the backup performance normalizes.

    Somehow the firewall rule to allow backup exec and all of its services isn't working?

     



  • 6.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 10:50 AM

    Can you check the Traffic log to determine what is being blocked that may be related to BE?

    The other thing as I mentioned was to only install AV. Yes, this minimises security for the box but if it causing this problem, it may be something you want to consider. Since you're on the latest SEP version, a call to support may be needed for further investigation as to the root cause. It does appear to be related to the firewall though.

    The rule I think you're refering to is "Allow Veritas Protocol"? Rule 26 in the default policy.



  • 7.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 12:42 PM

    I just went through the firewall policy on a granular level turning off items in all categories, rules, built in rules, protection and stealth etc, turning everything off within the firewall and keeping firewall active, results in the same slow throughput.



  • 8.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 12:47 PM

    This could have more to do with the firewall driver than. If that is the case, support will need to troubleshoot and confirm. That may also require a code fix in a later version.

    However, if this is the only server affected on this SEP version than I'm a little suspect of that being the cause.

    Are they all running the same OS version?



  • 9.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 12:52 PM

    The fact that only this server is having the issue is what has puzzled me, they are all server 2008 R2, the only real difference in servers is the roles installed and the network configuration.

    We have a plan to break the team to see if this could be the issue as soon as we can bring down the server etc.

     



  • 10.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Aug 05, 2013 12:59 PM

    It could be some incompatibility with the NIC card/driver related to the teaming. Perhaps there is an undated driver available.

    A search of the knowledbase shows various issues with SEP and teaming enabled:

    Knowgeledge base search for SEP and teaming

    You may want to take a quick look thru.

    If you break the team and the issue still persists, I would involve support at some point.



  • 11.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Dec 17, 2013 04:14 PM
    I am having a very similar issue with extremely slow throughput between EPP 12.1.4 and Backup Exec 2012, fully patched. I first experienced the issue when I upgraded to EPP 12.1.3, and the only eventual work-around was to withdraw the Firewall Policy entirely. I have now upgraded everything to EPP 12.1.4, re-applied the Firewall policy, and backups went bad. They would run, just took about 4 to 5 times as long, per server. I had servers that would back up at 1,200 MBPS, slow to 75 or 100 MBPS. They would run (mostly), and eventually finish, just painfully slow. I have yet to find any issues in the logs indicating a problem. I have all Backup Exec processes excluded, and SEPM configured to not scan files being backed up and all of those sorts of things. When I withdraw the Firewall Policy, backups run full-speed. I don't understand how so many people are experiencing the same problem, between two Symantec products, and this is still not resolved. Any suggestions are most appreciated.


  • 12.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Dec 18, 2013 08:46 AM
    The Problem has become a slow snapshot issue, throughput on the actual backup part of the job appears to be normal, however it takes 2 hours per snapshot before that occurs.


  • 13.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Dec 18, 2013 08:51 AM

    Out of curiosity, have you checked to see if an update to the NIC drivers is available?



  • 14.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Dec 18, 2013 08:55 AM
    At the time, I updated all known drivers, patches, reinstalled symanted backup exec, uninstalled/reinstalled sep, etc. It does get quarterly updates from a patching/driver standpoint as standard policy. So far nothing has affected it to the positive, but honestly, I haven't touched this issue in months as I have been busy elsewhere.


  • 15.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Dec 18, 2013 08:59 AM
    In our situation, the snapshots are still happening quickly, it's just the data throughput between the server being backed up and the storage device that starts painfully slow, and then just gets slower the longer the backup job runs. Without the Firewall policy, I get backup rates exceeding 1 GBPM, with the Firewall policy enabled, I get less that 100 MBPM. I don't see anything being blocked by the Firewall, and if the Server can finish the backup in the 24 hour time window, it will still finish successfully. But most of my servers will exceed the time window and then be cancelled. With the Firewall Policy removed, I backed up 9 Servers in a little over 3 hours. With the Firewall Policy enable, I have a hard time getting one backed up in 24 hours.


  • 16.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Dec 18, 2013 09:04 AM

    Best option I can suggest is to enage support as they are much more equipped to troubleshoot this. I doubt disabling the firewall is an acceptable solution for either of you...

    They will likely have you run the SymHelp tool to collect advanced data:

    How to use the advanced debug logging options for the Symantec Endpoint Protection client in SymHelp

    http://www.symantec.com/docs/TECH207795

    How to use the Symantec Help Tool to collect data for Support

    http://www.symantec.com/docs/TECH203599

    ...and grab packet captures while reproducing the issue.



  • 17.  RE: SEPM 12.1.3 and Backup Exec 2010 R3

    Posted Dec 18, 2013 11:19 AM
    I went through all of this with 12.1.3, and the issue was never resolved. Now it's just the same with 12.1.4.