ESET Endpoint Antivirus for Linux version 8.0.3.0 consumes /dev/shm

[bougar 0]

Hello,

I have installed ESET Endpoint Antivirus for Linux version 8.0.3.0 and It seems to consume /dev/shm which makes any chrome/chromium based app malfunction when it tries to write to /dev/shm. Unfortunately restarting eea does not solve this only a reboot. When eea service is enabled it seems to consume shared memory until this is full, causing chrome apps malfunctions as they are using this type of memory.

This problem does not happens with the 7.1.9.0 version.

SO Information:

5.10.0-6-amd64 #1 SMP Debian 5.10.28-1 (2021-04-09) x86_64 GNU/Linux

Thanks by your time.

[JvE 0]

This happens for me too, on kernel 5.11

/dev/shm memory that is consumed is never released.

No problem when I switch to kernel 5.8

 

ok: /usr/lib/modules/5.8.0-7642-generic/eset/eea/eset_rtp.ko

bad: /usr/lib/modules/5.11.0-7614-generic/eset/eea/eset_rtp.ko

bad: /usr/lib/modules/5.11.0-7612-generic/eset/eea/eset_rtp.ko

[cwong 0]

Has anybody found a workaround for this besides downgrading ESET or the kernel?

[Nightowl 206]

2 hours ago, cwong said:

Has anybody found a workaround for this besides downgrading ESET or the kernel?

Version 8.1.3.0

• Added: ESET Dynamic Threat Defense support
• Added: SecureBoot support
• Added: Process Exclusions
• Added: Ability to check for update in GUI
• Added: Ability to copy support-related information from GUI
• Improved: Warning when product is being activated with an overused license
• Fixed: Update doesn't work from a mirror created by ESET Mirror Tool
• Fixed: Device control could block the keyboard and mouse required to log into the system
• Other bug fixes and minor optimizations

New version was released but there is no mention of supporting new kernels , so I doubt your issues are fixed sadly.

[cwong 0]

2 hours ago, Nightowl said:

Version 8.1.3.0

• Added: ESET Dynamic Threat Defense support
• Added: SecureBoot support
• Added: Process Exclusions
• Added: Ability to check for update in GUI
• Added: Ability to copy support-related information from GUI
• Improved: Warning when product is being activated with an overused license
• Fixed: Update doesn't work from a mirror created by ESET Mirror Tool
• Fixed: Device control could block the keyboard and mouse required to log into the system
• Other bug fixes and minor optimizations

New version was released but there is no mention of supporting new kernels , so I doubt your issues are fixed sadly.

Well, I'll give it a try with the 5.13 kernel to see if that improves anything. My company is forcing me to upgrade from version 7, so I'll need to find some solution. 

[Nightowl 206]

7 minutes ago, cwong said:

Well, I'll give it a try with the 5.13 kernel to see if that improves anything. My company is forcing me to upgrade from version 7, so I'll need to find some solution. 

My kernel is 5.4 LTS , that's why I'm a bit different

[cwong 0]

10 minutes ago, Nightowl said:

My kernel is 5.4 LTS , that's why I'm a bit different

I got 8.0.3 working with 5.4 as well. It's just my display is wonky pre-5.6.

[cwong 0]

This seems to be working now. I've been using it for the last 1 1/2 hours, and /dev/shm is not filling up. 

I've tested on one laptop using ESET 8.1.3 on Manjaro with kernel 5.13. I also tested this on a freshly installed Fedora 34 running ESET 8.1.3 on the 5.12 kernel. Both seem to be going with no problems thus far.

I'll update if the problem returns.

[Nightowl 206]

15 hours ago, cwong said:

This seems to be working now. I've been using it for the last 1 1/2 hours, and /dev/shm is not filling up. 

I've tested on one laptop using ESET 8.1.3 on Manjaro with kernel 5.13. I also tested this on a freshly installed Fedora 34 running ESET 8.1.3 on the 5.12 kernel. Both seem to be going with no problems thus far.

I'll update if the problem returns.

Glad to hear it's working , it seems that they supported newer kernels somehow.

[avielc 56]

Going back to this topic. 
Seems like Ubuntu 20.04\18.04 gets stuck with 8.1.3 after a while (I'm thinking startup scan? ) 
the user experiences major freezes of the UI, everything you try to open (from Terminal to browser\apps) gets stuck for a certain period of time and then suddenly opens.

 

any ideas what it's related to? (certain scan I should limit perhaps?) 

Edited July 26, 2021 by avielc

[cwong 0]

10 hours ago, avielc said:

Going back to this topic. 
Seems like Ubuntu 20.04\18.04 gets stuck with 8.1.3 after a while (I'm thinking startup scan? ) 
the user experiences major freezes of the UI, everything you try to open (from Terminal to browser\apps) gets stuck for a certain period of time and then suddenly opens.

 

any ideas what it's related to? (certain scan I should limit perhaps?) 

I'm getting this problem as well with Manjaro. I haven't tested enough with Fedora. But to temporarily fix it for myself, I restart eea via systemd. Evenutally it'll get slow again, but I'll just restart it again and it'll be fine.

[avielc 56]

1 hour ago, cwong said:

I'm getting this problem as well with Manjaro. I haven't tested enough with Fedora. But to temporarily fix it for myself, I restart eea via systemd. Evenutally it'll get slow again, but I'll just restart it again and it'll be fine.

oh nice !I didn't know it was related. 
for the time being I downgraded the computers that had this slow down appear, back to 8.0.3.0
Hope it'll get fixed asap

[hnksnr 3]

In my Distribution the 8.1.3 works fine with Ubuntu 20.04 LTS when kernel version is 5.4 or 5.8 

with kernel 5.11 it's still produce /dev/shm filling, than  freezes and hangs.

hope it's get fixed.

[avielc 56]

46 minutes ago, hnksnr said:

In my Distribution the 8.1.3 works fine with Ubuntu 20.04 LTS when kernel version is 5.4 or 5.8 

with kernel 5.11 it's still produce /dev/shm filling, than  freezes and hangs.

hope it's get fixed.

Thanks for the info, so I understand the issue is with a kernel version - something I can't allow to have a lower version in my organization. 
Waiting for a fix for that. 

Thank you! 

[Ievgen Parkhomenko 0]

Our organization experiencing same issue, both versions 8.0.3 and 8.1.3 affected.
8.1.3 has bad performance and slow down machine during a day
8.0.3 with kernel >5.8 occurs filling /dev/shm storage then crashes of all running applications.
around 100 Ubuntu 20.04 machines affected. We need this fixed ASAP.

We have raised trouble ticket on support and got answer:

Thank you for your patience. We've been informed both bugs are known. The current workaround is to disable the RTFS functionality or disable and enable it everytime the issue occurs. We are fully aware that this isn't desirable.

I will inform you as soon as we know when a new build is available. For now it looks like the new release will take place in September.

[avielc 56]

RTFS = RealTime File Scanning?

Seriously?? 

[Matriciel 0]

I have also this problem with OpenSUSE Tumbleweed with recent kernel.

When i disable and enable eea service, the detection don't work and malware are not detected. I must retart my computer every time is very slow.

I'm waiting an upgrade very soon ... i hope ...

[cwong 0]

A new version of ESET Endpoint Antivirus (8.1.4.0) was just released earlier this week. I have not had a chance to test it yet (hasn't been updated in the AUR). I was wondering if anybody has been able to test it yet. There's only one note in the changelog: 

Fixed: Performance issues

Hopefully this will fix the problem.

[Ievgen Parkhomenko 0]

Hi, we deployed it to over 50 Ubuntu devices, so far so good.