Experiencing performance slowness by real time scan

Thank you for reaching out to the community forum. 

Can you confirm what is the role of this server? Is it a file server, etc? Also, on what specific application do they observe a performance issue? 

Also, can you perform Baic troubleshooting steps on the server to determine what specific component triggered this issue and let us know. for the result.

Maybe my semi-recent post here will help you:
RE: Sophos intercept X advanced - Discussions - Sophos Endpoint - Sophos Community

search the page for the text

As a general rule

hi Glenn, the server is used for Citrix. Users run applications on Citrix workspace from their client machine and the applications actually run on the server.
for example, when we run Adobe illustrator and used Sophos self help tool and generate csv summery by changing log level on the server, we can see scan is processed all the files under C:\Program Files\Adobe\Illustrator(ver)\. We can exclude the path from the scan, but the thing is many applications are slow now and it is not ideal for us to add exclusions for all the applications since previously there was no performance issue.

Is there any chance that Microsoft Defender got re-enabled (switched back into active mode) on these servers?

See support.sophos.com/.../KB-000042286 and learn.microsoft.com/.../microsoft-defender-antivirus-compatibility

hi Maxim, Defender is not running on the servers. I opened a ticket with the support. As I checked the summary log, it simply takes too long to get the scan done even the files are not that big.

Hi Masato, Did you end up getting a resolution on this?