AMP for Endpoint 6.0.7 performance problem

[sevkisahin]

hi all,

when i upgrade 6.0.5 or older version to 6.0.7, machines are too slowly and even it does not allow click on desktop.

boot safemod with networking and i uninstall agent, pc go on to work normally. 

what is the problem for 6.0.7 ? manually or console upgrade, the same in both.

thanks.

[Jetsy Mathew]

Hello 

Is this is happening with normal workstations or just Servers ?

However could you please contact TAC so that we can investigate it further based on the logs.

Regards

Jetsy 

[sevkisahin]

we only deploy workstations. not server.

ok, thanks for answer.

[Jetsy Mathew]

Hello sevkisahin

Let me know if you have any Service request opened for the same. I would like to take a look at the logs to investigate it further.

Regards
Jetsy

[Dinesh Verma]

Hi,

Not 100% sure but we do have 1-2 cases where customer faces the same issue. Hard part is you wont be  able to grab the logs since it makes the system totally unusable. Only way to get access to PC is just uninstall in safe mode.

I'd suggest you provide us the memory dump (through TAC case) following this article when system freezes: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard 

I tried reproducing this issue in lab but no luck. There is indeed something we need to see and dump logs would be our way to get to the depth of this issue.

Regards,
Dv

[ostandal]

We rolled out 6.0.7 to windows computers yesterday, and today we had SERIOS issues with our environment, as users were unable to log on to their computers. We had to deploy a GPO to set the CiscoAMP_6.0.7 service to disabled. Is it possible to roll-back to 6.0.5 in an easy way, or do we have to uninstall/reinstall manually?

[Jetsy Mathew · Accepted solution]

Hello ostandal

Do you have Trendmicro running in your environment while using 6.0.7 ?

We have identified the following bug in 6.0.7 version.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi07080/?reffering_site=dumpcr

Regards

Jetsy 

[sevkisahin]

hi all,

we solved this problem. if you use another av program, you should be careful advanced protection service is disable or uninstall other av.

because it is overlap other av. 

have a nice day.

[Jetsy Mathew]

Hello sevkisahin

Just to re-confirm, you can always use AMP with the other antivirus running in your system but you should have exclusions for other AV in AMP and viceversa.

The above mentioned bug is specific to 6.0.7 version.
However glad that you resolved the issue.

Regards
Jetsy

[ostandal]

Yes, indeed, we have Trend Officescan deployed..

[ostandal]

Thanks, Jetsy.
Do you know if a "downgrade" to 6.0.5 in the Console will downgrade the Clients automatically?

[Jetsy Mathew]

Hello ostandal

You have to un-install and reinstall to version 6.0.5 and perform a policy sync for the connectors to get the version updated.

Regards

Jetsy