Jump to content

Slow IMAP with Antivirus

rgoldman

By rgoldman
in ESET Endpoint Products

 Share

Recommended Posts

rgoldman

rgoldman 2

Posted
Posted

Hello

After a few weeks of narrowing it down, reinstalling etc. I've determined that IMAP is terribly slow in Outlook 365/2019 with ESET Endpoint AV installed. Even with everything email related disabled in the policy etc. If I reinstall it, it does fine a day or two, then its back to dragging. Any suggestions on how to fix this?

Thanks

Link to comment
Share on other sites
  • 2 weeks later...
rgoldman

rgoldman 2

Posted
  • Author
Posted

@Peter Randziak

Thanks, I will try this for a few days and report back.

I contacted support a few days ago about this and basically couldn't duplicate the issue while we we're on the phone. But I can confirm on my Laptop/Desktop it's still an issue. But I will try this and report.

Thanks

Link to comment
Share on other sites
rgoldman

rgoldman 2

Posted
  • Author
Posted

@LesRMed thanks

Yes I keep thinking that. It worked fine for a couple years and all of a sudden my laptop started doing it. A month or so later the desktop. And I’ve had a couple customers with minor issues.

 

i can uninstall AV and Outlook runs fine, reinstall and then it may be good for a few days and right back to slow.

 

im getting real anxious now. Maybe I’ll reload a machine and go from there, but I do have a newer desktop it’s on rn. So idk. Probably something I’m overlooking or goofed up in my policy.

Link to comment
Share on other sites
  • 2 weeks later...
rgoldman

rgoldman 2

Posted
  • Author
Posted

@Peter Randziak

I'm not sure what else to do, aside from loading a machine fresh which I haven't had time to troubleshoot much further yet. I did add exclusions for the Office Directory and PST/OST files (all email security functions were previously disabled in the policy).

However I'm still convinced it's ESET somehow, I mean it only occurs when ESET is installed. I had to uninstall it to get my email, that's very inconvenient.

I'm determined to find out exactly whats going on just haven't had much time to work on it. I thought it might be an Outlook Addon I was using but I uninstalled it for about a week and it made no difference.

Side note: I'm using Linux Mail Security 4x on the IMAP server.

I'll post back any findings.

Thanks

Link to comment
Share on other sites
  • ESET Moderators
Peter Randziak

Peter Randziak 1,130

Posted
  • ESET Moderators
Posted

Hello @rgoldman,

when it comes to exclusions for the Office Directory and PST/OST files my personal guess is that it won't help much.

In case it is ESET related I would say that it is either caused by the Outlook plugin or the IMAP(S) scanning.

Can you try how it behaves 

1. with the Outlook plugin disabled

2. with the IMAP(S) scanning disabled

If the issue persists, based on that we will know where to focus the further troubleshooting...

Peter

Link to comment
Share on other sites
rgoldman

rgoldman 2

Posted
  • Author
Posted

Hey @Peter Randziak

Thanks

Yes already tried that as I said before. Tech support and I disabled everything email related in the policy. They couldn't confirm the issue, but if I use it for more than a day or so it's really bad.

I don't think it's my machines. Desktop is Intel i9 CPU with SSD, Laptop is Intel i7 with SSD (my phone doesn't have this issue). The server is sitting right next to me, it's running Xeon with SSDs under light load.

But I can tell you if I uninstall ESET AV Outlook w/ IMAP is very responsive, where as it was taking 5-10 minutes (or more sometimes) to send a message or update a folder. Mailbox size is only about 2.5GB.

Link to comment
Share on other sites
  • 3 weeks later...
  • ESET Moderators
Peter Randziak

Peter Randziak 1,130

Posted
  • ESET Moderators
Posted

Hello guys,

in case you are willing to trouble-shoot it with us, just let me know I will do my best to assist and help.

On 10/6/2020 at 4:03 PM, rgoldman said:

Just had to uninstall ESET AV because Outlook wouldn't open on a customers machine, they're using Comcast IMAP.

Sorry to hear that, the issue as you describe it sounds really strange to me. Sadly when we are not able to determine even which feature is causing the issue, it's nearly impossible to trouble-shoot it..

If you are willing to try it again, I guess the only way is a longer experiment with the combination of those 2 features enabled / disabled and observing how it behaves.

In case it is caused by the Outllok plugin we would need a log from it, in case by a Protocol filtering a log as described below...

 

On 10/7/2020 at 11:55 AM, Gascogne said:

For my part, I can only retrieve mail by Thunderbird if the IMAP protection operated by NOD 32 v13.2.18.0 is disabled

In this case we would need the Protocol filtering advanced log https://help.eset.com/ees/7/en-US/solving_problems_advanced_pcap_logging.html

The logging needs to be enabled before the attempt to retrieve the mails, keep in enabled after you receive an error or  for few tens of seconds.

Once you have them, collect the set of logs with ESET Log Collector, upload the output to a safe location and send me a private message with the download details and reference to this tread.

Peter

Link to comment
Share on other sites
rgoldman

rgoldman 2

Posted
  • Author
Posted

Had to uninstall yesterday to get my email to come through Outlook. As I said everything e-mail related in the policy is disabled. Someone said it shouldn’t matter but I also added exclusions for OST/PST files and the Outlook directory. It seems it takes a day or two for it to slow down but when it does it’s unusable. 

Link to comment
Share on other sites
  • ESET Moderators
Peter Randziak

Peter Randziak 1,130

Posted
  • ESET Moderators
Posted

Hello @rgoldman,

On 10/30/2020 at 12:33 AM, rgoldman said:

It seems it takes a day or two for it to slow down but when it does it’s unusable. 

hmm strange, maybe some resource exhaustion / leak? 😞 

Once you experience the issue, can you provide me with:

A. dump from the ESET service:  ESET's Advanced settings -> Tools -> Diagnostics -> Diagnostics -> Create diagnostic dump

B. the Protocol filtering advanced log

1. Close the e-mail client 

2. ESET's Advanced settings -> Tools -> Diagnostics -> Enable Protocol filtering advanced logging ; confirm by OK

3. Start the e-mail client and wait for the error 

4. Disable the logging from the step #2 

5. collect the logs by ESET Log Collector 

 

Once you have the logs collected, upload them to a safe location and send me a private message with the download details and a reference to this forum topic.

 

Thank you, hopefully we will be able to resolve this together.

Peter

Link to comment
Share on other sites
  • 3 weeks later...
  • 2 weeks later...
  • ESET Moderators
Peter Randziak

Peter Randziak 1,130

Posted
  • ESET Moderators
Posted

Hello @rgoldman,

On 11/23/2020 at 2:06 AM, rgoldman said:

It's something to do with the SSL/TLS I think, I disabled protocol filtering and it's been working fine for over 2 weeks.

Thank you for the update and your effort to find that out.

I'm checking with the dev team what logs might be helpful to reveal the issue, we will keep you posted.

Peter

P_EESW-6420

Link to comment
Share on other sites
  • 3 months later...
  • ESET Moderators
Peter Randziak

Peter Randziak 1,130

Posted
  • ESET Moderators
Posted

Hello @rgoldman,

I apologize for the delay, I had a longer vacation and was not able to reply in a timely manner. 😞

If the issue persist please provide us with capture of the traffic when the issue persists in a pcapng format, please start the logging before you starting the Outlook.

Once you have it, please pack it, upload to a safe location and send me a private message with the download details, I will have it checked by the dev team.

 

Regards, Peter

Link to comment
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...