Veeam backups failing. Bypass RTS fixes

Veeam B&R version 12.2.0.334 keeps failing unless I disable/override Real Time Scanning > Files.

We have put in place all relevant exception rules that I can find on the Sophos support portal but I find I'm still having issues caused by the RTS.

Managed Detection and Response FTS 2024.2.2.5.3-MR1

Server Core Agent FTS 2024.2.2.8.2-MR1

Server Intercept X FTS 2024.1.1.12.2-MR1

Lockdown 7.1.4.68 (Unlocked)



Added Tags
[edited by: GlennSen at 2:46 PM (GMT -7) on 3 Oct 2024]
Parents
  • We've been quiet for two weeks now and now the same problem occurs again. High RAM usage due to a Sophos process and backup jobs running on errors. Is there now a solution to the problem that lasts longer than weeks?

  • I have the same setup, but never experienced any disruption when Sophos got installed, with OR without exclusions. I'll be watching this thread, if you want to compare configuration with a working system, I'll see if I can accomodate.

    I'm seeing mixed issues in this thread:  PostgreSQL services stopping, Console not working, and backup 'running with errors'. ..interrelated (and to Sophos RTS) or individually standing incidents?

    You are disabling the real-time scanner altogether for Veeam to work correctly. What would happen if you leave it on, but temporarily exclude the entire areas where Veeam, the repo, and the databases are located? Just as a troubleshooting step?

    Also: has a newly built server. If this server is not yet in production, a reinstallation with MSSQL could also be a step to ascertain if the problem lies in the combination PostgreSQL/Sophos?

    If you want to compare notes with my working setup, ask away.

  • We never had any problems and never ruled out any paths. The problems only appeared with the last Veeam version. The RAM usage doesn't increase quickly either. Sometimes it takes a week, sometimes a day or two.

    When you use SSPservice.exe with 400MB of RAM, you notice that it becomes sluggish. From 500MB onwards there are crashes in Veeam.

    Sophos support is really trying hard to fix the problem. The uneven time it takes for the problem to occur just drags the whole thing out. I'm confident that Sophos will fix the problem.

    Is your server an Intel or an AMD?

  • The basic hardware:

    System Model:              ProLiant DL360 Gen10
    Processor(s):              1 Processor(s) Installed.
                               [01]: Intel64 Family 6 Model 85 Stepping 4 GenuineIntel ~2095 Mhz
    Total Physical Memory:     97.962 MB
    Available Physical Memory: 82.362 MB

    Perhaps a support ticket to Veeam will speed things up.

  • hello all 

    so i have 

    2 physical servers old / new 

    old with sql express and new with postgres

    i have all other servers virtual 

    only server with problem has been this new one.

    what i have since noticed is its not just veeam thats getting slowed down 

    its the entire box, so for example launching powershell as admin takes over a minute 

    changing font size in notepad hangs  etc etc 

    stopping real time scanning doesnt reduced the ram usage on the sophos process

    but the box is instantly back to normal and responsive

    on a side note as i was using powershell to test,  launching powershell would load the window but never return the command prompt

    by a process of stopping every other service in turn , i found that turning off AMSI protection would allow powershell to work normally.

    so i have completely removed sophos and installed it again, both times i installed it the installation completed without errors. i dont ever remember having to reinstall sophos sserver client.....

    its running now with the exclusions for veeam and postgres , overnight its operating normally, previously i was seeing disruption within less than 24 houts, so i will see how i go, checking in with sophos engieer monday

    as i explained to the engineer since moving to central and intercept x i never bothered with exclusions and have never had any issues.

    and finally , i have anohter box that runs  veeam one and veeam 365,  the latest version of 365 has a forced migration to postgres. so that box is now running both postgres and  sql express !  that has no exceptions either so i will leave that one as it is to see if it gets worse.   

Reply
  • hello all 

    so i have 

    2 physical servers old / new 

    old with sql express and new with postgres

    i have all other servers virtual 

    only server with problem has been this new one.

    what i have since noticed is its not just veeam thats getting slowed down 

    its the entire box, so for example launching powershell as admin takes over a minute 

    changing font size in notepad hangs  etc etc 

    stopping real time scanning doesnt reduced the ram usage on the sophos process

    but the box is instantly back to normal and responsive

    on a side note as i was using powershell to test,  launching powershell would load the window but never return the command prompt

    by a process of stopping every other service in turn , i found that turning off AMSI protection would allow powershell to work normally.

    so i have completely removed sophos and installed it again, both times i installed it the installation completed without errors. i dont ever remember having to reinstall sophos sserver client.....

    its running now with the exclusions for veeam and postgres , overnight its operating normally, previously i was seeing disruption within less than 24 houts, so i will see how i go, checking in with sophos engieer monday

    as i explained to the engineer since moving to central and intercept x i never bothered with exclusions and have never had any issues.

    and finally , i have anohter box that runs  veeam one and veeam 365,  the latest version of 365 has a forced migration to postgres. so that box is now running both postgres and  sql express !  that has no exceptions either so i will leave that one as it is to see if it gets worse.   

Children
No Data