topic Re: AMP for Endpoint 6.0.7 performance problem in Endpoint Security

AMP for Endpoint 6.0.7 performance problem

sevkisahin — Sat, 09 Mar 2019 01:46:45 GMT

hi all,

when i upgrade 6.0.5 or older version to 6.0.7, machines are too slowly and even it does not allow click on desktop.

boot safemod with networking and i uninstall agent, pc go on to work normally.

what is the problem for 6.0.7 ? manually or console upgrade, the same in both.

thanks.

Re: AMP for Endpoint 6.0.7 performance problem

Jetsy Mathew — Tue, 20 Feb 2018 09:53:12 GMT

Hello

Is this is happening with normal workstations or just Servers ?

However could you please contact TAC so that we can investigate it further based on the logs.

Regards

Jetsy

Re: AMP for Endpoint 6.0.7 performance problem

Dinesh Verma — Tue, 20 Feb 2018 10:05:54 GMT

Hi,

Not 100% sure but we do have 1-2 cases where customer faces the same issue. Hard part is you wont be able to grab the logs since it makes the system totally unusable. Only way to get access to PC is just uninstall in safe mode.

I'd suggest you provide us the memory dump (through TAC case) following this article when system freezes: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard

I tried reproducing this issue in lab but no luck. There is indeed something we need to see and dump logs would be our way to get to the depth of this issue.

Regards,
Dv

Re: AMP for Endpoint 6.0.7 performance problem

sevkisahin — Tue, 20 Feb 2018 10:07:23 GMT

we only deploy workstations. not server.

ok, thanks for answer.

Re: AMP for Endpoint 6.0.7 performance problem

Jetsy Mathew — Tue, 20 Feb 2018 10:09:57 GMT

Hello sevkisahin

Let me know if you have any Service request opened for the same. I would like to take a look at the logs to investigate it further.

Regards
Jetsy

Re: AMP for Endpoint 6.0.7 performance problem

ostandal — Wed, 21 Feb 2018 09:18:27 GMT

We rolled out 6.0.7 to windows computers yesterday, and today we had SERIOS issues with our environment, as users were unable to log on to their computers. We had to deploy a GPO to set the CiscoAMP_6.0.7 service to disabled. Is it possible to roll-back to 6.0.5 in an easy way, or do we have to uninstall/reinstall manually?

Re: AMP for Endpoint 6.0.7 performance problem

Jetsy Mathew — Wed, 21 Feb 2018 09:28:50 GMT

Hello ostandal

Do you have Trendmicro running in your environment while using 6.0.7 ?

We have identified the following bug in 6.0.7 version.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi07080/?reffering_site=dumpcr

Regards

Jetsy

Re: AMP for Endpoint 6.0.7 performance problem

sevkisahin — Wed, 21 Feb 2018 09:32:13 GMT

hi all,

we solved this problem. if you use another av program, you should be careful advanced protection service is disable or uninstall other av.

because it is overlap other av.

have a nice day.

Re: AMP for Endpoint 6.0.7 performance problem

Jetsy Mathew — Wed, 21 Feb 2018 09:36:24 GMT

Hello sevkisahin

Just to re-confirm, you can always use AMP with the other antivirus running in your system but you should have exclusions for other AV in AMP and viceversa.

The above mentioned bug is specific to 6.0.7 version.
However glad that you resolved the issue.

Regards
Jetsy

Re: AMP for Endpoint 6.0.7 performance problem

ostandal — Wed, 21 Feb 2018 09:50:33 GMT

Yes, indeed, we have Trend Officescan deployed..

Re: AMP for Endpoint 6.0.7 performance problem

ostandal — Wed, 21 Feb 2018 09:57:28 GMT

Thanks, Jetsy.
Do you know if a "downgrade" to 6.0.5 in the Console will downgrade the Clients automatically?

Re: AMP for Endpoint 6.0.7 performance problem

Jetsy Mathew — Wed, 21 Feb 2018 10:30:16 GMT

Hello ostandal

You have to un-install and reinstall to version 6.0.5 and perform a policy sync for the connectors to get the version updated.

Regards

Jetsy