Slow IMAP with Antivirus

[rgoldman 2]

Hello

After a few weeks of narrowing it down, reinstalling etc. I've determined that IMAP is terribly slow in Outlook 365/2019 with ESET Endpoint AV installed. Even with everything email related disabled in the policy etc. If I reinstall it, it does fine a day or two, then its back to dragging. Any suggestions on how to fix this?

Thanks

[rgoldman 2]

One thing I haven't tried is excluding OST/PST files and the Outlook directory, will that for a while.

[rgoldman 2]

Hello,

Still pretty slow. If anyone has any suggestions please post here. Thanks

[Peter Randziak 1,181]

Hello @rgoldman,

can you try to switch to pre-release updates and check how it behaves?

We released there Internet Protection Module 1404 which should improve the download speed over the IMAP.

Peter

[rgoldman 2]

@Peter Randziak

Thanks, I will try this for a few days and report back.

I contacted support a few days ago about this and basically couldn't duplicate the issue while we we're on the phone. But I can confirm on my Laptop/Desktop it's still an issue. But I will try this and report.

Thanks

[rgoldman 2]

Hi @Peter Randziak

I don't think it has helped. I had to uninstall again. Just FYI I do have all the Email Options disabled in the Policy. Is there anything else I should look at it?

Thanks

[rgoldman 2]

Also, Outlook hangs sometimes and will not close (must use Task Manager). Not just mine, my client also, but they're using Exchange.

[LesRMed 26]

Just FYI, we're using a combination of IMAP and Exchange clients and have not seen any slowness issues.

[rgoldman 2]

@LesRMed thanks

Yes I keep thinking that. It worked fine for a couple years and all of a sudden my laptop started doing it. A month or so later the desktop. And I’ve had a couple customers with minor issues.

 

i can uninstall AV and Outlook runs fine, reinstall and then it may be good for a few days and right back to slow.

 

im getting real anxious now. Maybe I’ll reload a machine and go from there, but I do have a newer desktop it’s on rn. So idk. Probably something I’m overlooking or goofed up in my policy.

[Peter Randziak 1,181]

Hello @rgoldman,

have you been able to resolve the issue or do you need an assistance from our side?

If yes, just let me know I will let you know what logs to collect so we can investigate it.

Peter

[rgoldman 2]

@Peter Randziak

I'm not sure what else to do, aside from loading a machine fresh which I haven't had time to troubleshoot much further yet. I did add exclusions for the Office Directory and PST/OST files (all email security functions were previously disabled in the policy).

However I'm still convinced it's ESET somehow, I mean it only occurs when ESET is installed. I had to uninstall it to get my email, that's very inconvenient.

I'm determined to find out exactly whats going on just haven't had much time to work on it. I thought it might be an Outlook Addon I was using but I uninstalled it for about a week and it made no difference.

Side note: I'm using Linux Mail Security 4x on the IMAP server.

I'll post back any findings.

Thanks

[Peter Randziak 1,181]

Hello @rgoldman,

when it comes to exclusions for the Office Directory and PST/OST files my personal guess is that it won't help much.

In case it is ESET related I would say that it is either caused by the Outlook plugin or the IMAP(S) scanning.

Can you try how it behaves 

1. with the Outlook plugin disabled

2. with the IMAP(S) scanning disabled

If the issue persists, based on that we will know where to focus the further troubleshooting...

Peter

[rgoldman 2]

Hey @Peter Randziak

Thanks

Yes already tried that as I said before. Tech support and I disabled everything email related in the policy. They couldn't confirm the issue, but if I use it for more than a day or so it's really bad.

I don't think it's my machines. Desktop is Intel i9 CPU with SSD, Laptop is Intel i7 with SSD (my phone doesn't have this issue). The server is sitting right next to me, it's running Xeon with SSDs under light load.

But I can tell you if I uninstall ESET AV Outlook w/ IMAP is very responsive, where as it was taking 5-10 minutes (or more sometimes) to send a message or update a folder. Mailbox size is only about 2.5GB.

[rgoldman 2]

@Peter Randziak

Just had to uninstall ESET AV because Outlook wouldn't open on a customers machine, they're using Comcast IMAP.

[Gascogne 1]

Hello

For my part, I can only retrieve mail by Thunderbird if the IMAP protection operated by NOD 32 v13.2.18.0 is disabled

Regards

[Peter Randziak 1,181]

Hello guys,

in case you are willing to trouble-shoot it with us, just let me know I will do my best to assist and help.

On 10/6/2020 at 4:03 PM, rgoldman said:

Just had to uninstall ESET AV because Outlook wouldn't open on a customers machine, they're using Comcast IMAP.

Sorry to hear that, the issue as you describe it sounds really strange to me. Sadly when we are not able to determine even which feature is causing the issue, it's nearly impossible to trouble-shoot it..

If you are willing to try it again, I guess the only way is a longer experiment with the combination of those 2 features enabled / disabled and observing how it behaves.

In case it is caused by the Outllok plugin we would need a log from it, in case by a Protocol filtering a log as described below...

 

On 10/7/2020 at 11:55 AM, Gascogne said:

For my part, I can only retrieve mail by Thunderbird if the IMAP protection operated by NOD 32 v13.2.18.0 is disabled

In this case we would need the Protocol filtering advanced log https://help.eset.com/ees/7/en-US/solving_problems_advanced_pcap_logging.html

The logging needs to be enabled before the attempt to retrieve the mails, keep in enabled after you receive an error or  for few tens of seconds.

Once you have them, collect the set of logs with ESET Log Collector, upload the output to a safe location and send me a private message with the download details and reference to this tread.

Peter

[rgoldman 2]

I will try this if problem continues. I’ve been using the latest version a few days and *I think* it’s good. Thanks.

[rgoldman 2]

Had to uninstall yesterday to get my email to come through Outlook. As I said everything e-mail related in the policy is disabled. Someone said it shouldn’t matter but I also added exclusions for OST/PST files and the Outlook directory. It seems it takes a day or two for it to slow down but when it does it’s unusable. 

[Peter Randziak 1,181]

Hello @rgoldman,

On 10/30/2020 at 12:33 AM, rgoldman said:

It seems it takes a day or two for it to slow down but when it does it’s unusable. 

hmm strange, maybe some resource exhaustion / leak? 😞 

Once you experience the issue, can you provide me with:

A. dump from the ESET service:  ESET's Advanced settings -> Tools -> Diagnostics -> Diagnostics -> Create diagnostic dump

B. the Protocol filtering advanced log

1. Close the e-mail client 

2. ESET's Advanced settings -> Tools -> Diagnostics -> Enable Protocol filtering advanced logging ; confirm by OK

3. Start the e-mail client and wait for the error 

4. Disable the logging from the step #2 

5. collect the logs by ESET Log Collector 

 

Once you have the logs collected, upload them to a safe location and send me a private message with the download details and a reference to this forum topic.

 

Thank you, hopefully we will be able to resolve this together.

Peter

[rgoldman 2]

It's something to do with the SSL/TLS I think, I disabled protocol filtering and it's been working fine for over 2 weeks.

[Peter Randziak 1,181]

Hello @rgoldman,

On 11/23/2020 at 2:06 AM, rgoldman said:

It's something to do with the SSL/TLS I think, I disabled protocol filtering and it's been working fine for over 2 weeks.

Thank you for the update and your effort to find that out.

I'm checking with the dev team what logs might be helpful to reveal the issue, we will keep you posted.

Peter

P_EESW-6420

[Peter Randziak 1,181]

Hello @rgoldman,

I apologize for the delay, I had a longer vacation and was not able to reply in a timely manner. 😞

If the issue persist please provide us with capture of the traffic when the issue persists in a pcapng format, please start the logging before you starting the Outlook.

Once you have it, please pack it, upload to a safe location and send me a private message with the download details, I will have it checked by the dev team.

 

Regards, Peter