Jump to content
cortinca

Intermittent issues with Macs and ESET Endpoint

Recommended Posts

We have around 300 Macbook Pros that we've installed Eset Endpoint antivirus.  Randomly I'm getting complaints from techs that our users are experiencing random lockups and slowness.  When they look in Activity monitor its always Eset pegging out the processor or the disk.  We have around 500 PCs in the same environment with zero issues.  It's a mixed bag of Mac OS versions that have the issue.... from 10.12 to 10.14 with no real pattern.  On those with 10.14 I have pushed a PPPC profile and granted Eset full disk access.  It works flawlessly on my Mac with 10.14.  I'm kind of at a loss as to where to start.  The people complaining aren't getting infected or anything like that, it happens when they are just doing basic teacher work.  (I work in a K-12).

We do have ESET security management center in a VM and all the macs are running current version of both the agent and the antivirus.

Any ideas on where to start?

Share this post


Link to post
Share on other sites

The question is how often the issues occur. If it doesn't take too long to reproduce, I'd start with temporarily pausing real-time protection. During reproduction, generate logs as per https://support.eset.com/kb3404. When done, raise a support ticket for customer care so that the case is tracked properly and provide the logs.

Share this post


Link to post
Share on other sites

It can sometimes go days without having any issues, but at least I'll have this tool in my toolbox now.

Thanks for your response!

Share this post


Link to post
Share on other sites

I have a suppor ticket for a similar issue. What I found so far (and other on the MacAdmins slack)  is that it locks up while ESET is updating definitions/modules/something. The computer becomes unresponsive for 10-20 seconds.

I have not been able to reproduce but it does happen once a week or so. Generally when my laptop has been in sleep mode for a few days and then I open it up with only  wireless connection available.

Share this post


Link to post
Share on other sites

Does excluding these folders from scanning (EAV -> Preferences -> General -> Exclusions) make a difference?

/private/etc/
/Library/Application Support/ESET/esets/modules/

Share this post


Link to post
Share on other sites
On 4/8/2019 at 7:48 AM, Marcos said:

Does excluding these folders from scanning (EAV -> Preferences -> General -> Exclusions) make a difference?

/private/etc/
/Library/Application Support/ESET/esets/modules/

Hi Marcos,

I'm affected by this issue too with my MBP 2018. I'm using EES 6.7.654.0.

I had excluded the paths you mentioned here and I'll let you know if this resolve the issue. This problem is very inconsistent, MBP and ESET can work without issues until one specific module update freeze the system until update process is completed. Most module updates don't cause this behavior.

Thanks.

Share this post


Link to post
Share on other sites
On 4/8/2019 at 1:48 PM, Marcos said:

Does excluding these folders from scanning (EAV -> Preferences -> General -> Exclusions) make a difference?

/private/etc/
/Library/Application Support/ESET/esets/modules/

Hi Marcos!

Thanks for the advice. I made the exclusions yesterday and just now got the stalling issue. (Collecting logs and sending to support now)

The stalling was "better" this time. It stalled 3 times for a shorter time instead of once for a longer time. This is just one data point so we don't know if it is relevant information or not.

Share this post


Link to post
Share on other sites
On 4/10/2019 at 3:46 PM, Lockbits said:

Hi Marcos,

I'm affected by this issue too with my MBP 2018. I'm using EES 6.7.654.0.

I had excluded the paths you mentioned here and I'll let you know if this resolve the issue. This problem is very inconsistent, MBP and ESET can work without issues until one specific module update freeze the system until update process is completed. Most module updates don't cause this behavior.

Thanks.

Hi! Do you use Palo Alto GlobalProtect? Support has suggested it might be a compatibility issue between the two.

Share this post


Link to post
Share on other sites
19 minutes ago, karlmikaeloskar said:

Hi! Do you use Palo Alto GlobalProtect? Support has suggested it might be a compatibility issue between the two.

Hi,

No, I don't use Palo Alto GlobalProtect.

Share this post


Link to post
Share on other sites
On 4/11/2019 at 2:11 PM, karlmikaeloskar said:

Hi Marcos!

Thanks for the advice. I made the exclusions yesterday and just now got the stalling issue. (Collecting logs and sending to support now)

The stalling was "better" this time. It stalled 3 times for a shorter time instead of once for a longer time. This is just one data point so we don't know if it is relevant information or not.

Hi! I made the exclusions the wrong way the first time (forgot the *.*) and now it has been working without issues for several weeks.

Share this post


Link to post
Share on other sites

Marcos, can you expound on the need to exclude everything in /private/etc ? Can you be more specific about what should be excluded in that directory? Thanks.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...