Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 3 subscribers
  • Views 5006 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Endpoint Protection Standard slowing down network after installation

ZivanayiMukuku

After installing Sophos EPS on a 11 user network (i.e. 10 clients 1 server) there was an immediate slowdown in the client PCs saving a basic excel file to file server was taking too long. Both server and client are running Sophos EPS. what could be causing this? i have tested by removing the EPS on client PC and the client PC performs optimally.



This thread was automatically locked due to age.
  • 0

    Hello,

    I'm not sure what management platform you have, i.e. is it SEC or Central?  

    In either case there is the option to exclude scanning of remote files.  I would suggest testing that initially to prove that is the sole option that makes the difference here.

    The other thing to toggle is to disable just realtime scanning on the server and leave remote scanning on the client.  

    Beyond that, I would suggest using Process Monitor (technet.microsoft.com/.../bb795533.aspx) and Wireshark in combination.  If you can capture the slow save with a .PML (don't exclude any events when saving as .PML) and Wireshark running to gather a pcap, that would be all Support should need.  Maybe submit in a sample file if you have one you can send.

    As an initial test I would add the "Duration" column to Process Monitor, can you see savservice.exe for example taking a long time to read/write the file?  The Wireshark log with a filter for "smb or smb2" would be good at the same time to see what's going on at the network layer.  

    If the above doesn't narrow it down you might need a PML log from the server at the same time to see what the System process is doing.  I as assuming the server is a Windows file share.

    Regards,

    Jak

Unfiltered HTML