Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 16 replies
  • Subscribers 3 subscribers
  • Views 16502 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos will cause performance issue (slow response) on Windows Server 2019

Jameel Alsarraj

Hello,

 

I have the following scenario:

- I have created a new virtual machine, which has Windows Server 2019 installed and has NO Sophos yet, all works fine and the server's performance is normal (CPU usage is between 15% and 25% most of the time and e.g. IE opens within 1 to 2 seconds)

- I installed Sophos (10.8.4.227 EV 3.74.1) on the server, and the server started to experience a performance issue and slow response with high CPU (between 80% and 100%) when I only run simple applications (e.g. when I open IE or Explorer, it takes up to 5 or 6 seconds to open the window, and the CPU is bouncing at 100% for few seconds and still hight until I do nothing on the server for few seconds)

- As I mentioned above, If the server is idle for a few seconds, the CPU will drop down to around 20%, but once I open IE again it will jump up to around 100% and IE takes a long time to open.

- If I then uninstall Sophos, the problem will still present, even all Sophos components are removed (not sure if there is something still running in the background or if the impact of Sophos on another component in Windows is still affected)

 - Also, I have noticed that the "Sophos System Protection" is not being installed, not sure if this is related to Windows Server 2019, or to Sophos version 10.8.4.227, or is it intended by Sophos to have this component included in another one !!

Does anyone have the same issue with Sophos and Windows Server 2019? are there any recommendations? or should I wait for a new release of Sophos?

The same Sophos policies and configs are applied on Windows Server 2016 servers, and they have no performance issues at all !!

 

Our Sophos is managed by SEC 5.5.0

 

Please let me know if you need more information.



This thread was automatically locked due to age.
Parents
  • 0

    Hello Jameel,

    easy part first - Sophos System Protection has been removed with 10.8.4.3.

    all Sophos components are removed
    and rebooted afterwards? I'm not aware that there could be leftovers. Can you identify the process or processes consuming the CPU?

    Christian

  • 0 in reply to QC

    Hello Christian,

     

    Thanks for being always there for help.

     

    Yes, I rebooted the server many times after removing Sophos.

    Actually, it is not easy to limit the processes which consuming the CPU, but here are some which I could notice after monitoring the Task Manager:

    - System Interrupt

    - Internet Explorer (or Windows Explorer) itself when I open it until it is opened (which might be normal)

    - Services and Controller app

    - Windows host process (Rundll32)

    - Service Host: Local System (including 18 items)

    - Task Manager itself (which might be normal)

     

    To be honest, all the above-mentioned processes might be normal to have slightly high CPU consuming, but this performance issue occurred only after I installed Sophos the first time, so when the server was newly created and had no Sophos before, there was no performance issue at all !!

    Best regards,

    Jameel

  • 0 in reply to Jameel Alsarraj

    Hello Jameel,

    System Interrupts should normally not stand out. And they shouldn't spike if you start an application like IE. A possible cause are driver issues (as this is a VM the real hardware is not the prime suspect but who knows). 2019 is already supported by Endpoint for some time and I haven't heard of performance issues - especially ones that persist after uninstalling. We're not yet using 2019 though so this is not first-hand experience.
    Is this your first 2019 VM? Could you perhaps try to reproduce the problem (i.e. performance ok for a day or so, install Sophos - issues, uninstall - issues persist) with another VM?

    Christian

  • 0 in reply to QC

    Hello Christian,

    Actually this is the second VM on which we are testing Sophos with Windows Server 2019, and both machines behaved the same !!

    But here I have to mention, that both VMs were created from the same VM Template in VMware, so they are identical in drivers, settings, .. etc.

    Best regards,

    Jameel

  • 0 in reply to Jameel Alsarraj

    Hello Jameel,

    if the issue is reproducible and presumably connected with Sophos you should open a case with Support. Especially as it seems the machines are not returned to their previous state after uninstall.

    Christian

  • 0 in reply to QC

    Hello Christian,

     

    I will do, thank you anyway for your help.

    Best regards,

    Jameel

  • 0 in reply to Jameel Alsarraj

    Hi Jameel,

    You can also try to create the batch file for uninstall using the article https://community.sophos.com/kb/en-us/122126

    SAJ
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.
  • 0 in reply to SAJ

    Hi Saj,

     

    The article is only for Sophos Central Endpoint and Central Server, I have a Sophos Endpoint Protection which is managed by SEC.

    for example, I cannot find the command uninstallcli.exe (even though I can uninstall from Control Panel/Programs and Features), but I am not sure if I can go further with this article !!

    Best regards,

    Jameel

Reply
  • 0 in reply to SAJ

    Hi Saj,

     

    The article is only for Sophos Central Endpoint and Central Server, I have a Sophos Endpoint Protection which is managed by SEC.

    for example, I cannot find the command uninstallcli.exe (even though I can uninstall from Control Panel/Programs and Features), but I am not sure if I can go further with this article !!

    Best regards,

    Jameel

Children
Unfiltered HTML