Veeam B&R version 12.2.0.334 keeps failing unless I disable/override Real Time Scanning > Files.
We have put in place all relevant exception rules that I can find on the Sophos support portal but I find I'm still having issues caused by the RTS.
Managed Detection and Response FTS 2024.2.2.5.3-MR1
Server Core Agent FTS 2024.2.2.8.2-MR1
Server Intercept X FTS 2024.1.1.12.2-MR1
Lockdown 7.1.4.68 (Unlocked)
Hello Anthony Flynn ,
It looks like a product issue. Would you mind create a case on our support portal to get the help you need?
Once we know about the problem, we'll update the documentation accordingly.
Rémi
Hi Anthony,
I've moved your post over to the Discussions forum as it may be a better fit for your inquiry.
A similar inquiry was raised in an earlier thread here, could you let me know if any of the findings from this thread are relevant in your case?
Mostly it locks the program but if I leave it too long (this weekend for example, it was left Friday afternoon to Tuesday morning) it completely shuts down the PostgreSQL services that are running. Had to reboot this morning with all backups, replications and tape archives planned for the weekend missed.
The same error pattern as with us, always after the weekend. I already have a ticket open and have shared the SDU logs. Unfortunately, the problem cannot be reproduced in a short time.
I've finally been able to raise a ticket, was having terrible trouble with the portal
Did you set the exceptions correctly according to the veeam KB article?
KB1999: Antivirus Exclusions for Veeam Backup & Replication
Did you set the exceptions correctly according to the veeam KB1999 articel?
i am seeing the same issue on a new built server
after a day , i cannot launch veeam console on the box, if i turn off RTS i can instantly access.
now i know we have the list of exculusions, but i would point out i have the old server thats being replaced in operation
that machine has veeam with sql express, and it never had any exclusions and its running fine, i can still launch veeam console
this box the only differences , apart from being newer beefier ssd etc, is that i used postgres, the machine is not domain joined and i have implemented nearly every security recommendation on the veeam security analyser
i have tickets with veeam and sophos open ......
I have the same setup, but never experienced any disruption when Sophos got installed, with OR without exclusions. I'll be watching this thread, if you want to compare configuration with a working system, I'll see if I can accomodate.
I'm seeing mixed issues in this thread: PostgreSQL services stopping, Console not working, and backup 'running with errors'. ..interrelated (and to Sophos RTS) or individually standing incidents?
You are disabling the real-time scanner altogether for Veeam to work correctly. What would happen if you leave it on, but temporarily exclude the entire areas where Veeam, the repo, and the databases are located? Just as a troubleshooting step?
Also: neildon1 has a newly built server. If this server is not yet in production, a reinstallation with MSSQL could also be a step to ascertain if the problem lies in the combination PostgreSQL/Sophos?
If you want to compare notes with my working setup, ask away.
We never had any problems and never ruled out any paths. The problems only appeared with the last Veeam version. The RAM usage doesn't increase quickly either. Sometimes it takes a week, sometimes a day or two.
When you use SSPservice.exe with 400MB of RAM, you notice that it becomes sluggish. From 500MB onwards there are crashes in Veeam.
Sophos support is really trying hard to fix the problem. The uneven time it takes for the problem to occur just drags the whole thing out. I'm confident that Sophos will fix the problem.
Is your server an Intel or an AMD?
The basic hardware:
System Model: ProLiant DL360 Gen10
Processor(s): 1 Processor(s) Installed.
[01]: Intel64 Family 6 Model 85 Stepping 4 GenuineIntel ~2095 Mhz
Total Physical Memory: 97.962 MB
Available Physical Memory: 82.362 MB
Perhaps a support ticket to Veeam will speed things up.
hello all
so i have
2 physical servers old / new
old with sql express and new with postgres
i have all other servers virtual
only server with problem has been this new one.
what i have since noticed is its not just veeam thats getting slowed down
its the entire box, so for example launching powershell as admin takes over a minute
changing font size in notepad hangs etc etc
stopping real time scanning doesnt reduced the ram usage on the sophos process
but the box is instantly back to normal and responsive
on a side note as i was using powershell to test, launching powershell would load the window but never return the command prompt
by a process of stopping every other service in turn , i found that turning off AMSI protection would allow powershell to work normally.
so i have completely removed sophos and installed it again, both times i installed it the installation completed without errors. i dont ever remember having to reinstall sophos sserver client.....
its running now with the exclusions for veeam and postgres , overnight its operating normally, previously i was seeing disruption within less than 24 houts, so i will see how i go, checking in with sophos engieer monday
as i explained to the engineer since moving to central and intercept x i never bothered with exclusions and have never had any issues.
and finally , i have anohter box that runs veeam one and veeam 365, the latest version of 365 has a forced migration to postgres. so that box is now running both postgres and sql express ! that has no exceptions either so i will leave that one as it is to see if it gets worse.