Jump to content

Access files in 2003/2003R2 very slow


Recommended Posts

EFSW cause clients to gain access to files very slow. If I disable 'real-time protection', the files can be opened quickly.

 

For example: I've a simple excel file, just 10k bytes. If real-time protection was disabled, it just needs about 1.5 seconds to open it. But if real-time protection was enabled, it needs more than 12 seconds to open.

 

I've tested EFSW in separate Windows Servers. It seems the issue happened in Windows 2003 SP2 x86 / 2003 R2 SP2 x64 only. In Windows 2008 SP2 x64 are okay.

 

I used ESET File Security version is 6.2.12007.0.

 

Second, EFSW cause Process Monitor crash every time in Windows 2003 / 2003 R2. (Windows 2008 no problem). Process Monitor crash very soon after being run. If removes EFSW in the same machine. Process Monitor run well.

Link to comment
Share on other sites

  • Administrators

Please configure the system to generate complete memory dumps and also enable manual crash feature as per the instructions at hxxp://support.eset.sk/kb380/. When the issue (deadlock) occurs, trigger a manual crash so that a dump is created. After a system restart, compress the dump and upload it to a safe location. Pm me the download link along with the output from ESET Log Collector (hxxp://support.eset.com/kb3466/).

Link to comment
Share on other sites

Please configure the system to generate complete memory dumps and also enable manual crash feature as per the instructions at hxxp://support.eset.sk/kb380/. When the issue (deadlock) occurs, trigger a manual crash so that a dump is created. After a system restart, compress the dump and upload it to a safe location. Pm me the download link along with the output from ESET Log Collector (hxxp://support.eset.com/kb3466/).

 

PM sent.

Link to comment
Share on other sites

  • 1 month later...
  • 2 weeks later...

Same problem here. We had ESET Business 4 installed on W2K3 server, but paying license for File Server edition. We moved to the File serve edition V6 and suddenly file access speed became slower. Disabling the antivirus solves the problem, but this obviously cannot be the final solution.

Link to comment
Share on other sites

  • 2 weeks later...
  • Administrators

The issue has not been pinpointed yet and we were not able to reproduce it either. The thing is that for some reason upon opening a file the real-time protection driver gets a different result than seen in a Process monitor log which is why it continues to scan the file but is unable to read data. We'd need to get a complete memory from the moment when the 10-second deadlock occurs for further analysis.

Link to comment
Share on other sites

The issue has not been pinpointed yet and we were not able to reproduce it either. The thing is that for some reason upon opening a file the real-time protection driver gets a different result than seen in a Process monitor log which is why it continues to scan the file but is unable to read data. We'd need to get a complete memory from the moment when the 10-second deadlock occurs for further analysis.

 

I get a very old version of procmon, it could run in Windows 2003 with EFSW be installed. So I get logs and memory dump for you, please check PM. 

Link to comment
Share on other sites

It is interessting that eset took one year now trying to solve this but right now there is no solution to fix this.

 

We have also this problems on two servers (one server is form our client) with ESET Mail Security and ESET File Security. So I've tested different settings and found a possible solution:

 

- I've enabled "Advanced Heuristic/DNA/Smart-Signatures" in Real-Time File Protection module, which is disabled by default

 

This solves the problem with very slow opening MS Office documents on client PCs (with ESET Endpoint Antivirus 6 installed).

 

Hope this helpes others and to find solution for ESET.

Edited by deflex-it
Link to comment
Share on other sites

  • Administrators

The issue was first reported in November 2015 so not a year ago. We are now analyzing the dump provided by Sdnian and will update you all soon. So far the issue seems to be caused by OS itself which provides the real-time protection with invalid / incorrect data which causes it to scan files when they shouldn't be scanned. Even if it's confirmed that the culprit is the OS itself, we'll try to find a workaround to prevent the issue from manifesting.

 

As for advanced heuristics, we don't recommend enabling it on file access. Firstly, it doesn't do anything with Office files as it's intended for emulation of PE files and secondly, enabling it has drawback on system performance. You can try enabling it for a while just out of curiosity. If it helped, then most likely something else affected the timing, however, from the logs we've seen it didn't look like a timing issue.

Link to comment
Share on other sites

https://forum.eset.com/topic/4281-files-opening-very-slowly-over-network-from-client-pcs-to-server-after-upgrading-to-v6/

 

This is the same issue I think, so technically it is not a whole year you're right but the problem is critical and not solved over a long time. What is your solution then? Use Version 4.5 of File Security?

 

The servers on which we have this problem are both Windows Server 2008 x64.

Edited by deflex-it
Link to comment
Share on other sites

  • Administrators

https://forum.eset.com/topic/4281-files-opening-very-slowly-over-network-from-client-pcs-to-server-after-upgrading-to-v6/

 

This is the same issue I think, so technically it is not a whole year you're right but the problem is critical and not solved over a long time. What is your solution then? Use Version 4.5 of File Security?

The servers on which we have this problem are both Windows Server 2008 x64.

 

In the referenced topic, it was Windows 2003 that users reported to have issues with. If the issue occurs with EFSW 6.3, configure Windows to generate complete memory dumps (hxxp://support.eset.com/kb380/) and when the issue occurs, initiate a manual crash so that a memory dump is created. After a restart, compress the dump, upload it to a safe location and pm me the download link. Also supply us with a Process monitor log from a client and server, both from the same time when the issue manifests.

Link to comment
Share on other sites

  • Administrators

Sorry but in the referenced topic it is about Win 2008 R2 (first post).

 

But that was long before EFSW 6.2 addressing that issue was released.

Link to comment
Share on other sites

  • 4 weeks later...
  • Administrators

We have a workaround for the bug in Windows Server 2003 FltMgr prepared. Those who experience the issue please drop me a pm and I will provide you with an updated eamonm.sys driver that doesn't utilize the problematic function to circumvent the bug.

Link to comment
Share on other sites

  • 2 months later...
  • ESET Moderators

I am in need of the updated eamonm.sys  driver. Please.

 

Hello, I sent you a PM.

Link to comment
Share on other sites

 

I am in need of the updated eamonm.sys  driver. Please.

 

Hello, I sent you a PM.

 

 

 

When will release newest version of EFSW to fix this problem?

Link to comment
Share on other sites

  • 4 weeks later...

We have a workaround for the bug in Windows Server 2003 FltMgr prepared. Those who experience the issue please drop me a pm and I will provide you with an updated eamonm.sys driver that doesn't utilize the problematic function to circumvent the bug.

 

Hello, it seems to me, I am affected with this issue. After installation of new version of the Eset file server on my Win server 2003 32bit, performance of some shared file operations went down. With Realtime protection turned off, everything is OK.

Can I please ask you if you can send me the updated eamonm.sys driver file or tell me some other informations for solving the issue? I am happy to send you any logs you mentioned if you want/need.

Thanks

Link to comment
Share on other sites

  • 10 months later...

Hi! I have exactly the same issue. After upgrade from Version 4.5 to 6 clients open Office files very slow. My OS is Windows 2008 R2 x64 and Windows 7 Clients (Office 2010). ESET File Security Version 6.5.12007.0. 

What is your solution?

 

Link to comment
Share on other sites

  • Administrators
On 29. 4. 2017 at 9:31 AM, Mischa said:

Hi! I have exactly the same issue. After upgrade from Version 4.5 to 6 clients open Office files very slow. My OS is Windows 2008 R2 x64 and Windows 7 Clients (Office 2010). ESET File Security Version 6.5.12007.0. What is your solution?

Do you have ESET Endpoint installed on clients? Does temporarily disabling real-time protection on the server (EFSW) or on a client (ESET Endpoint) make a difference? If so, it it enough just to disable scanning of network drives in the real-time protection setup? Anyways, I'd suggest moving this to a new topic as it concerns Windows Server 2008 R2 and not WS 2003 which is discussed in this topic.

Link to comment
Share on other sites

  • 6 months later...
On 2. 2. 2016 at 7:38 PM, deflex-it said:

- I've enabled "Advanced Heuristic/DNA/Smart-Signatures" in Real-Time File Protection module, which is disabled by default

21.11.2017, v6.5.12010.0 same problem and this solution worked.

@macros not possible to disable real-time protetcion on File Security. The temporarily disable prompt comes up but does not apply. This is a server and I cannot just restart it to see what happens.

Please fix bug.

LP,
Jure

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...