SAVService.exe spiking when saving large documents (.docx / .pdf)?

Is anyone else having issues saving large documents (ex. .docx / .pdf)?  We have a number of users that regularly work with large documents and have been reporting issues somewhat recently by which they go to Save the document, and it takes upwards of 45 seconds to save.  

Upon researching the issue, the SAVService.exe spikes to 50-75% sustained CPU utilization, causes the application (ex. Word) to hang / whitescreen for approx. 30-40 seconds, and then returns back to normal operation.

Creating a file / folder exclusion for users by which real-time scanning is disabled has been our work-around.  We suspect that this actually started in early August, and persists with the latest version of Sophos Endpoint:

 

Core Agent: 2.0.5

Endpoint Advanced: 10.8.1.2

Sophos Intercept X: 2.0.7

OS: Windows 10 1803, able to recreate on 1703 also.

  • Do you see the issue on a computer without Hitman Pro installed without any AV exclusions? 

    For example after removing the workaround exclusions: If you do the following:

    1. Disable Tamper Protection

    2. Rename \windows\system32\drivers\hmpalert.sys to hmpalert.sys.off for example.

    3. Restart the computer

    4. Perform the test

    I'm wondering if the Crypoguard feature taking backups of files is essentially doubling the amount of work SAV is having to do.

    At least this will rule out a large part of the solution.  You can then rename the driver back and restart the computer.

    Regards,

    Jak

  • In reply to jak:

    Hi Jak,

     

    I did as you suggested and still experienced 30+ second 'Save' times.  The only thing that seems to have any positive performance impact, at this point in time, is the exclusion of Real-Time scanning on the particular folder path where the files reside. 

  • In reply to Joseph DeSantis:

    OK, good to know.  Are they local or remote?

  • In reply to jak:

    The files are saved / stored locally. 

     

    As part of troubleshooting, we also renamed the extension from .docx to .somethingelse.  Once the document was in a non .docx format, the file saved almost immediately. 

  • In reply to Joseph DeSantis:

    I think the best thing is to try and find a file or generate one which has the issue you can send in to Support so they can create a problem file request.

    https://secure2.sophos.com/en-us/support/open-a-support-case/describe-issue.aspx 

    Regards,
    Jak

  • In reply to jak:

    Jak,

     

    I appreciate your assistance; fortunately we do have a case open already.  Was hoping that there may be other end-users of the community who could provide some commentary to help establish if this is isolated to my organization or not.

  • In reply to Joseph DeSantis:

    Do you have a sample file you could link/attach here?  Please scrub any PII if you do.

  • In reply to jak:

    Good news.  Worked with the Global Escalation team to update the scanning engine to 3.74 and the problem has been resolved.  We're just waiting to hear when this will be included in the official release.  Save times are back to approx. 10 seconds.