Endpoint Client - Laptop Resource Impact

Hello All,

 

I have recently deployed Endpoint to several laptops and a couple are suffering from severe slowdown, high mem usage and even higher disk usage. I plan to upgrade the laptops, new SSD should do it, but I have  a few questions:

 

Which of the standard "Threat Protection" base policy configurable settings are likely to cause most resource usage:

 

  • Live Protection
  • Real Time Scanning 
  • Real Time Scanning Remote Files
  • Deep Learning
  • Others?

 

It is also worth noting that I have a Data Loss Prevention Policy also running which could be contributing.

 

I would like to experiment changing the settings to see if this can alleviate these symptoms, if anyone has any experience it would be appreciated. 

  • Hello Dan Spooner,

    high mem usage and even higher disk usage
    I'd think that the measurement units are incommensurable - unless you are talking about disk space, so I'm not sure what even higher is.

    high mem
    this is Central Endpoint, isn't it? In absolute numbers SAVService.exe normally uses 250-300MB, swi_service (web protection) coming in second with around 50MB, the rest much less. In total not more than 400MB or so. You can't significantly reduce SAVService's usage by disabling this or that (apart from that disabling Real-Time isn't a good idea).
    higher disk usage
    you mean I/O rate, or? Which process is it? On fairly recent and decent hardware there shouldn't be such issues under normal operation with the recommended settings. Data Loss Prevention is an "add-on" to normal scanning, it doesn't have activity on it's own.

    Christian

  • Hi Dan Spooner,

    Could you shed some more light on the reported issue?

    • Is it a central client or on-premise client?
    • When did you start seeing this issue? any recent changes that might have caused?
    • Any recent upgrades performed? If yes, please mention what version was it upgraded from.
    • Do you see it while performing any specific task or as soon as it boots up into Windows?
    • As mentioned earlier SAVservice at time consumes ~250MB and it's perfectly normal.
    • Can you share the screenshot of the task manager when the issue is seen?
    • If it is on-premise, please check out the basic troubleshooting.
  • In reply to Gowtham Mani:

    Hi Both, thanks the responses.

    I wasn't explicit on the memory, disk metrics so I will elaborate. 

    • Memory usage is line with your documented expectations, 250-300mb. No issues there.
    • Disk is IO, the laptop in questions is sat 100% disk I/O however now I believe a combination of another AV scanner running, a file sync app running and Endpoint, as well as an old disk are all contributing to this.

    I have removed the other AV, and I will be reviewing it again later today. If it is still very slow I will install a SSD drive and rebuild.

    At this stage I am concluding that the software is behaving normally and this issue is born of other issues with the laptop.

    I will report back once I know the root cause.