EES6 Poor Performace compaired to version 5

[The PIT 1]

Installed the latest version and compared to version 5 a clear slow down with getting to the desktop. Applications pausing with the not responding message. You could type in Excel and nothing would happen for several seconds. The settings I used in the new version were same as version five.

Returning to version 5 restored the performace. This is on pc running a 5960x with 16 gig of ram windows 8.1 and ssd hard drives.

I didn't notice such a marked slow down on another pc however I don't use that for everyday work it just runs 24 hours recording weather data.

[Marcos 5,070]

Unfortunately, without narrowing it down to a particular module it's impossible to advise any further. Did you experience these issues even with default settings?

[The PIT 1]

The only change from default settings was disabling network scanning. Pointless scanning a network share on another computer that has eset installed anyway.

Just installe dit on another laptop I have and doesn't seem to have an issue there.

The main differances are the spyder pro on startup and evoluent mouse between the two.

[Marcos 5,070]

The only change from default settings was disabling network scanning. Pointless scanning a network share on another computer that has eset installed anyway.

Just installe dit on another laptop I have and doesn't seem to have an issue there.

The main differances are the spyder pro on startup and evoluent mouse between the two.

 

Try disabling each of the protection modules, one at a time, to narrow it down (ie. start with disabling real-time protection, then continue with HIPS, Advanced memory scanner, Exploit blocker, web protection, protocol filtering in the advanced setup, etc.).

[The PIT 1]

Just re-installed it just for the sake of it and the issue seems to have gone.

The only other matter if I install version six directly I can't use my license file as it doesn't reconise the extension.

[LocknetSSmith 6]

You have to use the activation key that came with your license information... I believe it shows up as the "License Key."  If you don't have one, and still just have your EAV username and password, you can convert it to a v6 key on Eset's website. 

[Marcos 5,070]

If you cannot find your license key, you can obtain it by converting your username and password at https://ela.eset.com/LicenseOwner/Converter.

[The PIT 1]

I've got the key but the extension isn't understood by version 6. On version 5 I simply browse for the file and it excepts it version six can't see the file. So what I have to do is upgraqde version five to six and it takes the license from the previous version.

Anyway I spoke too soon the pauses with six are back again so I will remove it again and go back to version five later this week.

[The PIT 1]

Back to version 5 and slow downs have gone again. I'll wait a few months and try again.

[smarra 3]

I noticed this too. in my case it was an issue with the new eset agent causing high cpu with the wmi service.

 

To test this, I simply stopped the agent service.  Once I did that, everything returned to normal.  

started agent service, everything went slow.

 

I tried to update the agent, but that had no effect.  I sent the logs to eset as requested, but eventually decided to revert back to v5.  

[Marcos 5,070]

I noticed this too. in my case it was an issue with the new eset agent causing high cpu with the wmi service.

 

This is most likely due to performance counters that the agent uses. This issue should be addressed in the next service build.

[bbahes 29]

 

I noticed this too. in my case it was an issue with the new eset agent causing high cpu with the wmi service.

 

This is most likely due to performance counters that the agent uses. This issue should be addressed in the next service build.

 

 

Can you be more specific on next release date? At the moment we are on hold for v6 upgrade, mostly because of features missing, bugs and lack of documentation.

[Marcos 5,070]

 

 

I noticed this too. in my case it was an issue with the new eset agent causing high cpu with the wmi service.

 

This is most likely due to performance counters that the agent uses. This issue should be addressed in the next service build.

 

 

Can you be more specific on next release date? At the moment we are on hold for v6 upgrade, mostly because of features missing, bugs and lack of documentation.

 

 

There's no exact date set for the release, however, my personal estimation is that it won't take longer than a month. As for missing features, could you be please more specific? Of course, the current ERA v6 is not a finished project and we will continue to improve it and bring new features and enhancements over time. Regarding the documentation, it's been improved since the official release and we are continually improving it based on the queries from users. Also I'd like to bring the following topic into your attention which is regularly updated with new KB content concerning ERA6: https://forum.eset.com/topic/4469-latest-knowledgebase-articles-videos-for-era-6/.

[bbahes 29]

 

 

 

I noticed this too. in my case it was an issue with the new eset agent causing high cpu with the wmi service.

 

This is most likely due to performance counters that the agent uses. This issue should be addressed in the next service build.

 

 

Can you be more specific on next release date? At the moment we are on hold for v6 upgrade, mostly because of features missing, bugs and lack of documentation.

 

 

There's no exact date set for the release, however, my personal estimation is that it won't take longer than a month. As for missing features, could you be please more specific? Of course, the current ERA v6 is not a finished project and we will continue to improve it and bring new features and enhancements over time. Regarding the documentation, it's been improved since the official release and we are continually improving it based on the queries from users. Also I'd like to bring the following topic into your attention which is regularly updated with new KB content concerning ERA6: https://forum.eset.com/topic/4469-latest-knowledgebase-articles-videos-for-era-6/.

 

 

As critical missing feature I would say you are missing central update server(something like Update Mirror used to be). No Proxy will make me stay on ESET.

But if you plan to stick with Proxy, my guess is that it would be better accepted if you provide control from admin console, rather than make me edit files manually.

 

Second missing feature is option to deploy single activated package to clients (agent+endpoint product) via file share. My situation is not pleasant since I have near 100 windows workstations without domain and no simple solution to deploy.

 

Third missing feature is to make push installation process require just agent to deploy. The agent has to be there to setup workstation in every possible way to communicate to ERA.

 

Fourth. I don't know why people feel that web interface is way to go for security products, but you should reconsider making mmc console for people who look at antivirus console more that few minutes, and I have not found option to reduce logout timeout on your web console. Web interface is not responsive as classic console. Did it refresh page? Is http service up? If server receives many http requests I don't wan't to be locked out.

 

For these reasons I can't reconsider ESET as my Antivirus solution next year. Sadly other solutins cost more and take performance from my workstations as I'm in process of testing them.

 

Kind regards.

Edited April 3, 2015 by bbahes

[Marcos 5,070]

As critical missing feature I would say you are missing central update server(something like Update Mirror used to be). No Proxy will make me stay on ESET.

But if you plan to stick with Proxy, my guess is that it would be better accepted if you provide control from admin console, rather than make me edit files manually.

It is still possible to create a mirror using Endpoint v6 and control it via ERA. However, it will download more data than the proxy server would as every single update file would have to be downloaded even if 90% of files were not needed by clients. Also the http server integrated in ESET's products has never been capable of serving a larger number of clients at a time so for larger networks using a 3rd party http server was recommended in such cases.

Apache HTTP proxy doesn't require any manual configuration so it's not clear why would you have to edit certain files manually.

 

Second missing feature is option to deploy single activated package to clients (agent+endpoint product) via file share. My situation is not pleasant since I have near 100 windows workstations without domain and no simple solution to deploy.

There are many ways how to install the agent on clients. It should be possible to send Live Installer via email and ask users to run it or simply run it from a network share. The agent will connect to ERAS, receive groups, policies and tasks so with the appropriate install and activation tasks for dynamic groups (ie. groups with no ESET product installed or with non-activated clients) the install and activation tasks can be accomplished automatically with the installation of Endpoint on those machines.

 

Third missing feature is to make push installation process require just agent to deploy. The agent has to be there to setup workstation in every possible way to communicate to ERA.

It's not clear what you mean as it's only the agent that you deploy on clients. Installation and activation of Endpoint can be accomplished automatically using task for dynamic groups.

 

Fourth. I don't know why people feel that web interface is way to go for security products, but you should reconsider making mmc console for people who look at antivirus console more that few minutes, and I have not found option to reduce logout timeout on your web console. Web interface is not responsive as classic console. Did it refresh page? Is http service up? If server receives many http requests I don't wan't to be locked out.

If you create a new user, you can specify the timeout for automatic logout.

[bbahes 29]

 

As critical missing feature I would say you are missing central update server(something like Update Mirror used to be). No Proxy will make me stay on ESET.

But if you plan to stick with Proxy, my guess is that it would be better accepted if you provide control from admin console, rather than make me edit files manually.

It is still possible to create a mirror using Endpoint v6 and control it via ERA. However, it will download more data than the proxy server would as every single update file would have to be downloaded even if 90% of files were not needed by clients. Also the http server integrated in ESET's products has never been capable of serving a larger number of clients at a time so for larger networks using a 3rd party http server was recommended in such cases.

Apache HTTP proxy doesn't require any manual configuration so it's not clear why would you have to edit certain files manually.

 

This is workaround. Why would I want to use workstation to serve Antivirus database to entire network? And still without control over what gets on that v6 Endpoint and what and when gets distributed to clients.

 

Second missing feature is option to deploy single activated package to clients (agent+endpoint product) via file share. My situation is not pleasant since I have near 100 windows workstations without domain and no simple solution to deploy.

There are many ways how to install the agent on clients. It should be possible to send Live Installer via email and ask users to run it or simply run it from a network share. The agent will connect to ERAS, receive groups, policies and tasks so with the appropriate install and activation tasks for dynamic groups (ie. groups with no ESET product installed or with non-activated clients) the install and activation tasks can be accomplished automatically with the installation of Endpoint on those machines.

 

I was able to make .bat file and install agent on test machine. However when I try to use task to deploy Endpoint Antivirus i get ambiguous message that task failed. After reading KB Solution ID: SOLN3605 I found out that even though client has agent installed it still has to be configured in specific way KB Solution ID: SOLN82.

 

But, maybe I was not that clear, what I meant was that I expect single bundle .exe or .msi file with agent and endpoint product of my choice (in my case Endpoint Antivirus) to be installed in single click with preconfigured connection to ERA.

 

Third missing feature is to make push installation process require just agent to deploy. The agent has to be there to setup workstation in every possible way to communicate to ERA.

It's not clear what you mean as it's only the agent that you deploy on clients. Installation and activation of Endpoint can be accomplished automatically using task for dynamic groups.

 

What I meant was that by pushing agent installation on client (either through ERA or .msi/.exe files or .bat in your case), agent has to do all it needs (KB Solution ID: SOLN82) automatically.

If I have to make additional configuration changes to client beside agent installation than it's waste of my and clients time.

 

Fourth. I don't know why people feel that web interface is way to go for security products, but you should reconsider making mmc console for people who look at antivirus console more that few minutes, and I have not found option to reduce logout timeout on your web console. Web interface is not responsive as classic console. Did it refresh page? Is http service up? If server receives many http requests I don't wan't to be locked out.

If you create a new user, you can specify the timeout for automatic logout.

 

But there is no way to change timeout on current user. I can't find it. Or it does not exist? If it does not exist would you agree it's feature that's expected in web application?

 

[Marcos 5,070]

This is workaround. Why would I want to use workstation to serve Antivirus database to entire network? And still without control over what gets on that v6 Endpoint and what and when gets distributed to clients.

You can use a server product (EFSW v6) right on the server to create a mirror. As for controlling mirror, since v3 there hasn't been an option to control it except enabling or disabling the mirror function.

 

I was able to make .bat file and install agent on test machine. However when I try to use task to deploy Endpoint Antivirus i get ambiguous message that task failed. After reading KB Solution ID: SOLN3605 I found out that even though client has agent installed it still has to be configured in specific way KB Solution ID: SOLN82.

With ERAv6, the instructions in SOLN82 are for an agent push install. Once agent has been installed, it will download an Endpoint installer from ESET's website. Endpoint install is not done as a push install from ERA so the requirements from the mentioned KB do not apply.

If it is failing for whatever reason, it would most likely fail even if installed locally using msi. In such case, the install logs will need to be analyzed to find out the cause of the install failure.

 

But there is no way to change timeout on current user. I can't find it. Or it does not exist? If it does not exist would you agree it's feature that's expected in web application?

The default Administrator account has the logout timeout pre-set. You can create another administrator account that you will use and that will have the timeout set to whatever value you like.

[bbahes 29]

 

This is workaround. Why would I want to use workstation to serve Antivirus database to entire network? And still without control over what gets on that v6 Endpoint and what and when gets distributed to clients.

You can use a server product (EFSW v6) right on the server to create a mirror. As for controlling mirror, since v3 there hasn't been an option to control it except enabling or disabling the mirror function.

 

I was able to make .bat file and install agent on test machine. However when I try to use task to deploy Endpoint Antivirus i get ambiguous message that task failed. After reading KB Solution ID: SOLN3605 I found out that even though client has agent installed it still has to be configured in specific way KB Solution ID: SOLN82.

With ERAv6, the instructions in SOLN82 are for an agent push install. Once agent has been installed, it will download an Endpoint installer from ESET's website. Endpoint install is not done as a push install from ERA so the requirements from the mentioned KB do not apply.

If it is failing for whatever reason, it would most likely fail even if installed locally using msi. In such case, the install logs will need to be analyzed to find out the cause of the install failure.

 

But there is no way to change timeout on current user. I can't find it. Or it does not exist? If it does not exist would you agree it's feature that's expected in web application?

The default Administrator account has the logout timeout pre-set. You can create another administrator account that you will use and that will have the timeout set to whatever value you like.

 

 

May I ask that you make live public webcast where you install ERA v6 on Windows server and deploy Endpoint Antivirus with Agent to client in workgroup and point it to Proxy for update?

[bbahes 29]

This is workaround. Why would I want to use workstation to serve Antivirus database to entire network? And still without control over what gets on that v6 Endpoint and what and when gets distributed to clients.

You can use a server product (EFSW v6) right on the server to create a mirror. As for controlling mirror, since v3 there hasn't been an option to control it except enabling or disabling the mirror function.

 

This is still workaround. 

 

 

I was able to make .bat file and install agent on test machine. However when I try to use task to deploy Endpoint Antivirus i get ambiguous message that task failed. After reading KB Solution ID: SOLN3605 I found out that even though client has agent installed it still has to be configured in specific way KB Solution ID: SOLN82.

With ERAv6, the instructions in SOLN82 are for an agent push install. Once agent has been installed, it will download an Endpoint installer from ESET's website. Endpoint install is not done as a push install from ERA so the requirements from the mentioned KB do not apply.

If it is failing for whatever reason, it would most likely fail even if installed locally using msi. In such case, the install logs will need to be analyzed to find out the cause of the install failure.

 

This could be down to my lack of information on how and from where agent downloads installer for endpoint, since we have strict policy on how our workstations communicate to Internet.

 

But there is no way to change timeout on current user. I can't find it. Or it does not exist? If it does not exist would you agree it's feature that's expected in web application?

The default Administrator account has the logout timeout pre-set. You can create another administrator account that you will use and that will have the timeout set to whatever value you like.

 

Then it's not missing feature...it's a bug.

 

By now we have found alternative Antivirus solution, and we await to read release notes on your future releases.

At least ESET has great support!

[bbahes 29]

hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN3692

 

21 click to get SysInspector log.

[Marcos 5,070]

hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN3692

 

21 click to get SysInspector log.

 

I've tried it myself:

1, selected a client and then "New task" from the menu - 2 clicks.

2, selected SysInspector log request - 2 clicks

3, clicked Finish - 1 click.

[bbahes 29]

 

hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN3692

 

21 click to get SysInspector log.

 

I've tried it myself:

1, selected a client and then "New task" from the menu - 2 clicks.

2, selected SysInspector log request - 2 clicks

3, clicked Finish - 1 click.

 

 

Why then KB says different? Maybe we started to count clicks in different menus

[Mr. Natural 2]

I spent the entire day yesterday setting up a new v6 ERAC and by late afternoon finally got to where I could push a v6 client install to my pc. Immediately after pushing the agent the performance of my pc dropped considerably. I continued and pushed v6 to the pc anyway. Performance was terrible. Google Chrome was so unresponsive I couldn't use it. There's no way I could deploy this product on our networks. I also don't have time to be troubleshooting problems for Eset. Don't even bother asking me to try something as I've already completely removed all v6 software from my systems. I'm reading some of the complaints here and I see all these suggestions to disable certain functions to get things running normally. This is not a solution in my book. This product is not ready for prime time. I'm very disappointed especially since our organization just spent a hell of a lot of money for a 3 year renewal. You folks have a lot of work to do and we will be running v5 for quite a while.

[mprenter 0]

I agree.  We rolled out v6 on a large percentage of our machines and immediately noticed a huge performance drop from v5.  I've been on the forums and tweaking settings to try to improve things but rolling back to v5 seems to be the best option.  I can't afford to spend days and days tweaking settings and troubleshooting.  The bad thing is: our maintenance with ESET expires at the end of May (1 month) and my boss may force me to look at other options for an antivirus solution if ESET can't get their act together and release an update that fixes some of these issues.  EndPoint Antivirus 6.0 is quite a disappointment and a far cry from the AV solution I've trusted for the past 7 years.

 

Mark

[Marcos 5,070]

Unlike v5, v6 has advanced heuristics on file execution enabled by default for maximum protection. Could you try enabling this option in Endpoint v5 so that you compare apples with apples? ESET is probably the only vendor that reacts to new threats within less than within a few minutes if they make it even through the last protection layer called Advanced memory scanner. I'd strongly suggest troubleshooting issues with ESET rather than moving to products that offer less protection.