Intermittent issues with Macs and ESET Endpoint

[cortinca 0]

We have around 300 Macbook Pros that we've installed Eset Endpoint antivirus.  Randomly I'm getting complaints from techs that our users are experiencing random lockups and slowness.  When they look in Activity monitor its always Eset pegging out the processor or the disk.  We have around 500 PCs in the same environment with zero issues.  It's a mixed bag of Mac OS versions that have the issue.... from 10.12 to 10.14 with no real pattern.  On those with 10.14 I have pushed a PPPC profile and granted Eset full disk access.  It works flawlessly on my Mac with 10.14.  I'm kind of at a loss as to where to start.  The people complaining aren't getting infected or anything like that, it happens when they are just doing basic teacher work.  (I work in a K-12).

We do have ESET security management center in a VM and all the macs are running current version of both the agent and the antivirus.

Any ideas on where to start?

[Marcos 5,070]

The question is how often the issues occur. If it doesn't take too long to reproduce, I'd start with temporarily pausing real-time protection. During reproduction, generate logs as per https://support.eset.com/kb3404. When done, raise a support ticket for customer care so that the case is tracked properly and provide the logs.

[cortinca 0]

It can sometimes go days without having any issues, but at least I'll have this tool in my toolbox now.

Thanks for your response!

[karlmikaeloskar 6]

I have a suppor ticket for a similar issue. What I found so far (and other on the MacAdmins slack)  is that it locks up while ESET is updating definitions/modules/something. The computer becomes unresponsive for 10-20 seconds.

I have not been able to reproduce but it does happen once a week or so. Generally when my laptop has been in sleep mode for a few days and then I open it up with only  wireless connection available.

[Marcos 5,070]

Does excluding these folders from scanning (EAV -> Preferences -> General -> Exclusions) make a difference?

/private/etc/
/Library/Application Support/ESET/esets/modules/

[Lockbits 10]

On 4/8/2019 at 7:48 AM, Marcos said:

Does excluding these folders from scanning (EAV -> Preferences -> General -> Exclusions) make a difference?

/private/etc/
/Library/Application Support/ESET/esets/modules/

Hi Marcos,

I'm affected by this issue too with my MBP 2018. I'm using EES 6.7.654.0.

I had excluded the paths you mentioned here and I'll let you know if this resolve the issue. This problem is very inconsistent, MBP and ESET can work without issues until one specific module update freeze the system until update process is completed. Most module updates don't cause this behavior.

Thanks.

[karlmikaeloskar 6]

On 4/8/2019 at 1:48 PM, Marcos said:

Does excluding these folders from scanning (EAV -> Preferences -> General -> Exclusions) make a difference?

/private/etc/
/Library/Application Support/ESET/esets/modules/

Hi Marcos!

Thanks for the advice. I made the exclusions yesterday and just now got the stalling issue. (Collecting logs and sending to support now)

The stalling was "better" this time. It stalled 3 times for a shorter time instead of once for a longer time. This is just one data point so we don't know if it is relevant information or not.

[karlmikaeloskar 6]

On 4/10/2019 at 3:46 PM, Lockbits said:

Hi Marcos,

I'm affected by this issue too with my MBP 2018. I'm using EES 6.7.654.0.

I had excluded the paths you mentioned here and I'll let you know if this resolve the issue. This problem is very inconsistent, MBP and ESET can work without issues until one specific module update freeze the system until update process is completed. Most module updates don't cause this behavior.

Thanks.

Hi! Do you use Palo Alto GlobalProtect? Support has suggested it might be a compatibility issue between the two.

[Lockbits 10]

19 minutes ago, karlmikaeloskar said:

Hi! Do you use Palo Alto GlobalProtect? Support has suggested it might be a compatibility issue between the two.

Hi,

No, I don't use Palo Alto GlobalProtect.

[karlmikaeloskar 6]

On 4/11/2019 at 2:11 PM, karlmikaeloskar said:

Hi Marcos!

Thanks for the advice. I made the exclusions yesterday and just now got the stalling issue. (Collecting logs and sending to support now)

The stalling was "better" this time. It stalled 3 times for a shorter time instead of once for a longer time. This is just one data point so we don't know if it is relevant information or not.

Hi! I made the exclusions the wrong way the first time (forgot the *.*) and now it has been working without issues for several weeks.

[B. Johnson 0]

Marcos, can you expound on the need to exclude everything in /private/etc ? Can you be more specific about what should be excluded in that directory? Thanks.

[karlmikaeloskar 6]

Just want everyone to know that my intermittent issues are back after installing 6.7.876 and macOS version 10.14.5.

[Lockbits 10]

On 5/22/2019 at 6:57 AM, karlmikaeloskar said:

Just want everyone to know that my intermittent issues are back after installing 6.7.876 and macOS version 10.14.5.

I can confirm this too even with latest version and paths indicated by Marcos excluded.

I’m also starting to experience a internet connection problems that are related with ESET. If I disable protocol filtering (not the firewall) the problem is resolved but if I enable it again internet connection problems happens again.

if I restart OS the problem is fixed even with protocol scanning enabled again. It happened two times and I’m not sure how can I reproduce this behavior.  @Marcoswhen this happens again, what are the procedure in order to get logs and report it back to ESET?