sdnian 6 Posted November 17, 2015 Share Posted November 17, 2015 EFSW cause clients to gain access to files very slow. If I disable 'real-time protection', the files can be opened quickly. For example: I've a simple excel file, just 10k bytes. If real-time protection was disabled, it just needs about 1.5 seconds to open it. But if real-time protection was enabled, it needs more than 12 seconds to open. I've tested EFSW in separate Windows Servers. It seems the issue happened in Windows 2003 SP2 x86 / 2003 R2 SP2 x64 only. In Windows 2008 SP2 x64 are okay. I used ESET File Security version is 6.2.12007.0. Second, EFSW cause Process Monitor crash every time in Windows 2003 / 2003 R2. (Windows 2008 no problem). Process Monitor crash very soon after being run. If removes EFSW in the same machine. Process Monitor run well. Link to comment Share on other sites More sharing options...
rbeaber 0 Posted November 17, 2015 Share Posted November 17, 2015 We also experienced this issue on Windows Storage Server 2008 R2 (x64). Reverting to ESet FS vers 4.5 solved the issue for us. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted November 20, 2015 Administrators Share Posted November 20, 2015 Please configure the system to generate complete memory dumps and also enable manual crash feature as per the instructions at hxxp://support.eset.sk/kb380/. When the issue (deadlock) occurs, trigger a manual crash so that a dump is created. After a system restart, compress the dump and upload it to a safe location. Pm me the download link along with the output from ESET Log Collector (hxxp://support.eset.com/kb3466/). Link to comment Share on other sites More sharing options...
sdnian 6 Posted November 21, 2015 Author Share Posted November 21, 2015 Please configure the system to generate complete memory dumps and also enable manual crash feature as per the instructions at hxxp://support.eset.sk/kb380/. When the issue (deadlock) occurs, trigger a manual crash so that a dump is created. After a system restart, compress the dump and upload it to a safe location. Pm me the download link along with the output from ESET Log Collector (hxxp://support.eset.com/kb3466/). PM sent. Link to comment Share on other sites More sharing options...
sdnian 6 Posted January 6, 2016 Author Share Posted January 6, 2016 It's been so long this problem still no fix. Link to comment Share on other sites More sharing options...
StefanoBettega 0 Posted January 14, 2016 Share Posted January 14, 2016 Same problem here. We had ESET Business 4 installed on W2K3 server, but paying license for File Server edition. We moved to the File serve edition V6 and suddenly file access speed became slower. Disabling the antivirus solves the problem, but this obviously cannot be the final solution. Link to comment Share on other sites More sharing options...
sdnian 6 Posted January 25, 2016 Author Share Posted January 25, 2016 EFSW 6.3.12004 have the same problem. Does any ESET staff take care it? Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted January 29, 2016 Administrators Share Posted January 29, 2016 The issue has not been pinpointed yet and we were not able to reproduce it either. The thing is that for some reason upon opening a file the real-time protection driver gets a different result than seen in a Process monitor log which is why it continues to scan the file but is unable to read data. We'd need to get a complete memory from the moment when the 10-second deadlock occurs for further analysis. Link to comment Share on other sites More sharing options...
sdnian 6 Posted January 29, 2016 Author Share Posted January 29, 2016 The issue has not been pinpointed yet and we were not able to reproduce it either. The thing is that for some reason upon opening a file the real-time protection driver gets a different result than seen in a Process monitor log which is why it continues to scan the file but is unable to read data. We'd need to get a complete memory from the moment when the 10-second deadlock occurs for further analysis. I get a very old version of procmon, it could run in Windows 2003 with EFSW be installed. So I get logs and memory dump for you, please check PM. Link to comment Share on other sites More sharing options...
deflex-it 0 Posted February 2, 2016 Share Posted February 2, 2016 (edited) It is interessting that eset took one year now trying to solve this but right now there is no solution to fix this. We have also this problems on two servers (one server is form our client) with ESET Mail Security and ESET File Security. So I've tested different settings and found a possible solution: - I've enabled "Advanced Heuristic/DNA/Smart-Signatures" in Real-Time File Protection module, which is disabled by default This solves the problem with very slow opening MS Office documents on client PCs (with ESET Endpoint Antivirus 6 installed). Hope this helpes others and to find solution for ESET. Edited February 3, 2016 by deflex-it Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted February 2, 2016 Administrators Share Posted February 2, 2016 The issue was first reported in November 2015 so not a year ago. We are now analyzing the dump provided by Sdnian and will update you all soon. So far the issue seems to be caused by OS itself which provides the real-time protection with invalid / incorrect data which causes it to scan files when they shouldn't be scanned. Even if it's confirmed that the culprit is the OS itself, we'll try to find a workaround to prevent the issue from manifesting. As for advanced heuristics, we don't recommend enabling it on file access. Firstly, it doesn't do anything with Office files as it's intended for emulation of PE files and secondly, enabling it has drawback on system performance. You can try enabling it for a while just out of curiosity. If it helped, then most likely something else affected the timing, however, from the logs we've seen it didn't look like a timing issue. Link to comment Share on other sites More sharing options...
deflex-it 0 Posted February 3, 2016 Share Posted February 3, 2016 (edited) https://forum.eset.com/topic/4281-files-opening-very-slowly-over-network-from-client-pcs-to-server-after-upgrading-to-v6/ This is the same issue I think, so technically it is not a whole year you're right but the problem is critical and not solved over a long time. What is your solution then? Use Version 4.5 of File Security? The servers on which we have this problem are both Windows Server 2008 x64. Edited February 3, 2016 by deflex-it Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted February 3, 2016 Administrators Share Posted February 3, 2016 https://forum.eset.com/topic/4281-files-opening-very-slowly-over-network-from-client-pcs-to-server-after-upgrading-to-v6/ This is the same issue I think, so technically it is not a whole year you're right but the problem is critical and not solved over a long time. What is your solution then? Use Version 4.5 of File Security? The servers on which we have this problem are both Windows Server 2008 x64. In the referenced topic, it was Windows 2003 that users reported to have issues with. If the issue occurs with EFSW 6.3, configure Windows to generate complete memory dumps (hxxp://support.eset.com/kb380/) and when the issue occurs, initiate a manual crash so that a memory dump is created. After a restart, compress the dump, upload it to a safe location and pm me the download link. Also supply us with a Process monitor log from a client and server, both from the same time when the issue manifests. Link to comment Share on other sites More sharing options...
deflex-it 0 Posted February 3, 2016 Share Posted February 3, 2016 Sorry but in the referenced topic it is about Win 2008 R2 (first post). Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted February 4, 2016 Administrators Share Posted February 4, 2016 Sorry but in the referenced topic it is about Win 2008 R2 (first post). But that was long before EFSW 6.2 addressing that issue was released. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted February 26, 2016 Administrators Share Posted February 26, 2016 We have a workaround for the bug in Windows Server 2003 FltMgr prepared. Those who experience the issue please drop me a pm and I will provide you with an updated eamonm.sys driver that doesn't utilize the problematic function to circumvent the bug. Link to comment Share on other sites More sharing options...
JeffJ 1 Posted May 11, 2016 Share Posted May 11, 2016 I am in need of the updated eamonm.sys driver. Please. Link to comment Share on other sites More sharing options...
ESET Moderators TomasP 317 Posted May 13, 2016 ESET Moderators Share Posted May 13, 2016 I am in need of the updated eamonm.sys driver. Please. Hello, I sent you a PM. Link to comment Share on other sites More sharing options...
sdnian 6 Posted May 18, 2016 Author Share Posted May 18, 2016 I am in need of the updated eamonm.sys driver. Please. Hello, I sent you a PM. When will release newest version of EFSW to fix this problem? Link to comment Share on other sites More sharing options...
kitter 0 Posted June 13, 2016 Share Posted June 13, 2016 We have a workaround for the bug in Windows Server 2003 FltMgr prepared. Those who experience the issue please drop me a pm and I will provide you with an updated eamonm.sys driver that doesn't utilize the problematic function to circumvent the bug. Hello, it seems to me, I am affected with this issue. After installation of new version of the Eset file server on my Win server 2003 32bit, performance of some shared file operations went down. With Realtime protection turned off, everything is OK. Can I please ask you if you can send me the updated eamonm.sys driver file or tell me some other informations for solving the issue? I am happy to send you any logs you mentioned if you want/need. Thanks Link to comment Share on other sites More sharing options...
Mischa 0 Posted April 29, 2017 Share Posted April 29, 2017 Hi! I have exactly the same issue. After upgrade from Version 4.5 to 6 clients open Office files very slow. My OS is Windows 2008 R2 x64 and Windows 7 Clients (Office 2010). ESET File Security Version 6.5.12007.0. What is your solution? Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted May 2, 2017 Administrators Share Posted May 2, 2017 On 29. 4. 2017 at 9:31 AM, Mischa said: Hi! I have exactly the same issue. After upgrade from Version 4.5 to 6 clients open Office files very slow. My OS is Windows 2008 R2 x64 and Windows 7 Clients (Office 2010). ESET File Security Version 6.5.12007.0. What is your solution? Do you have ESET Endpoint installed on clients? Does temporarily disabling real-time protection on the server (EFSW) or on a client (ESET Endpoint) make a difference? If so, it it enough just to disable scanning of network drives in the real-time protection setup? Anyways, I'd suggest moving this to a new topic as it concerns Windows Server 2008 R2 and not WS 2003 which is discussed in this topic. Link to comment Share on other sites More sharing options...
jursah 0 Posted November 21, 2017 Share Posted November 21, 2017 On 2. 2. 2016 at 7:38 PM, deflex-it said: - I've enabled "Advanced Heuristic/DNA/Smart-Signatures" in Real-Time File Protection module, which is disabled by default 21.11.2017, v6.5.12010.0 same problem and this solution worked. @macros not possible to disable real-time protetcion on File Security. The temporarily disable prompt comes up but does not apply. This is a server and I cannot just restart it to see what happens. Please fix bug. LP, Jure Link to comment Share on other sites More sharing options...
Recommended Posts