Endpoint performance recommendations?

Thank you for reaching out to the community forum.

By default, an automatic exclusion is added for SQL to avoid, which is a recommended exclusion to make SQL work smoothly; you can check this documentation for Automatic Exclusion of third-party products. You can try adding this one and observe the behavior of the device when running SQL.

For Visual Studio, since it's used for developer use, We're expecting that it would be busy and we're accessing multiple files so an Exclusion by excluding them on On-demand scanning and choosing scheduled scan. 

Hello Glenn,

thank You for quick response.

To clarify MS SQL SSMS does not equal MS SQL Server instance.

But thank You for the recommendations.

Just to be sure - is process exclusion effective for all used files?
Since file exclusion list would take me ages to define and that is not how I imagine modern security product to work, while I appreciate the thoroughness of scans.

David

Is it slow due to scanning or a large number of events being sent to SSPService.exe for behavioral?

Do you find the processes running excessively are:

- SophosFileScanner.exe (worker)

or

- SSPService.exe

or both?

If SophosFileScanner.exe is busy, turn on, in Endpoint Self Help - SophosFileScanner.exe - Scan Summaries - Debug.  This will create on or more CSV file of items scanned and time taken under C:\ProgramData\Sophos\Sophos File Scanner\Logs\.  This will tell you what is scanned and how long it takes.  A pivot table could be useful.

If SSPService.exe is busy, turn on Info level logging in ESH for SSPService.exe and check the SSP.log under C:\ProgramData\Sophos\Endpoint Defense\logs\ for the events being sent to the service to process.  This might give a clue as to what events are being processed.

Thanks.

Process exclusions will prevent scanning on the files accessed by the process, as well as any network communication that the process performs.

Behavioural scanning will continue to take place. 

Thank You for detailed recommendation!

I will try to check this and test more, once I get to it