This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SAVService.exe spiking when saving large documents (.docx / .pdf)?

Is anyone else having issues saving large documents (ex. .docx / .pdf)?  We have a number of users that regularly work with large documents and have been reporting issues somewhat recently by which they go to Save the document, and it takes upwards of 45 seconds to save.  

Upon researching the issue, the SAVService.exe spikes to 50-75% sustained CPU utilization, causes the application (ex. Word) to hang / whitescreen for approx. 30-40 seconds, and then returns back to normal operation.

Creating a file / folder exclusion for users by which real-time scanning is disabled has been our work-around.  We suspect that this actually started in early August, and persists with the latest version of Sophos Endpoint:

 

Core Agent: 2.0.5

Endpoint Advanced: 10.8.1.2

Sophos Intercept X: 2.0.7

OS: Windows 10 1803, able to recreate on 1703 also.



This thread was automatically locked due to age.
Parents
  • Do you see the issue on a computer without Hitman Pro installed without any AV exclusions? 

    For example after removing the workaround exclusions: If you do the following:

    1. Disable Tamper Protection

    2. Rename \windows\system32\drivers\hmpalert.sys to hmpalert.sys.off for example.

    3. Restart the computer

    4. Perform the test

    I'm wondering if the Crypoguard feature taking backups of files is essentially doubling the amount of work SAV is having to do.

    At least this will rule out a large part of the solution.  You can then rename the driver back and restart the computer.

    Regards,

    Jak

  • Hi Jak,

     

    I did as you suggested and still experienced 30+ second 'Save' times.  The only thing that seems to have any positive performance impact, at this point in time, is the exclusion of Real-Time scanning on the particular folder path where the files reside. 

  • OK, good to know.  Are they local or remote?

Reply Children