Skip to content


Reply
Affiliate
greggmh123
Posts: 1,976
Registered: ‎01-23-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

[ Edited ]

I've been too busy to make a call, but have been playing email tag with them. Regarding the "cure" for Dell computers, their answer is that "...we actually don't have this." So much for that thought!

 

They wanted me to stop one service at a time and test speed, so I went on site today and tested again, and found the following:

 

I removed the firewall driver and service on one system with a tool supplied by another TM person, but it made no difference.

 

Killing certain services made a difference. I only stopped one at a time so I could find the one responsible.

 

Trend Micro Client Server Security Agent Proxy service STOPPED: no difference
Trend Micro Client Server Security Agent Personal Firewall STOPPED: no difference
Trend Micro Client Server Security Agent Real-Time Scan STOPPED: HUGE difference, as fast as with no agent
Trend Micro Client Server Security Agent Listener STOPPED: no difference
Trend Micro Unauthorized Change Prevention service STOPPED: a lot faster, but not normally fast

 

Load times with all services running:

IE8 = 20-30 seconds

MAS 90 = 18 seconds to login prompt

Windows Explorer = 10-20 seconds to open and list all folders

services.msc = 8 seconds

 


Load times with only Trend Micro Unauthorized Change Prevention service STOPPED:
IE8 = 8-10 seconds
MAS 90 = 8 seconds to login prompt
Windows Explorer = 4 seconds to open and list all folders
services.msc = 3 seconds

 

 

Load times with only Trend Micro Client Server Security Agent Real-Time Scan STOPPED:

IE8 = 2-3 seconds

MAS 90 = 4 seconds to login prompt

Windows Explorer = 1-2 seconds to open and list all folders

services.msc = 2 seconds

 

 

Load times with Trend Micro Client Server Security Agent completely REMOVED:

IE8 = 1 second

MAS 90 = 3 seconds to login prompt

Windows Explorer = 1 second to open and list all folders

services.msc = under 1 second


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Affiliate
greggmh123
Posts: 1,976
Registered: ‎01-23-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

I just installed the WFBS SP3 package on my own network as a test. I have NOT been having any slowness problems, but I did want to see what files changed.

 

About leaving autopcc in the login script 24/7/365, I have not seen the behavior you mentioned where the icon goes away for minutes and comes back. I see no reason to leave it there other than to make new computers get WFBS installed at login. If it is not there, and an update is done to the server, the clients will update anyway.

 

Regarding the SP3 installation, here are some new file versions and some unchanged:

 

WFBS Advanced 6.0 SP2

ntrtscan.exe = 11.2.0.3033

tmlisten.exe = 11.2.0.3033

tmproxy.exe = 5.8.0.1092

tsc.exe = 6.3.0.1015

tmbmsrv.exe = 2.80.0.1080

 

WFBS Advanced 6.0 SP3

ntrtscan.exe = 11.2.0.4012

tmlisten.exe = 11.2.0.4012

tmproxy.exe = 5.8.0.1092

tsc.exe = 6.3.0.1015

tmbmsrv.exe = 2.90.0.1131

 

So, we have three major files that have new versions, but I don't know what was done to them for speed, if anything. I won't be back at my problem client until next week.

 

Gregg Hill


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Affiliate
greggmh123
Posts: 1,976
Registered: ‎01-23-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

Have you followed the steps in the best practices doc for WFBS? For some completely "arse-i-9" reason, the default ActiveAction **WILL** let through a lot of virus infections. I have had infected systems where I had not changed that default action, and looking at the logs showed realtime scan "successfully detected, no action taken" on those files. A manual scan gives the same result. Changing the action from ActiveAction to Clean/Quarantine or Clean/Delete always catches it, right after the previous setting failed to take action (with the same definitions), yet DID successfully detect the threat. That has been one of my gripes for a long time.

 

If only I could sell WatchGuard firewalls to all of my clients! Then I would not have to worry about anything getting through via the Internet.

 

I feel your pain. I was a faithful NAVCE and SAVCE guy myself. I don't know if MBAM, etc, have realtime protection, but they sure are good cleaners...after Trend lets it through! D'oh!

 

Gregg Hill


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Honored Noble
galbicka
Posts: 165
Registered: ‎02-26-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

I called support yesterday and spent two hours on the phone before I could get escalated. I will be posting details on my other thread. Your results testing services mimic mine as well. And support could find nothing pertaining to Dell/broadcom specifically for me either.

Please use plain text.
Honored Esquire
StillLooking
Posts: 109
Registered: ‎05-05-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

   Oh. The solution is simple. Disable the realtime scanner LOL! I have gotten my first feedbacks from SP3. It looks promising. Boot speeds are back to normal. I heard one complaint where their main application and Outlook jet lagged a little opening up but other then that things looks good. Several of these machines have Broadcom NICs. Intel mobos (not Dell) but Broadcom NICs none the less. No reported problems. I went ahead and upgraded three additional networks to SP3. I have not told them. I want to see if anyone volunteers anything good or bad. I will keep posting results and feedback.

 

   One last question. Gregg you said that when you run autopcc on a workstation that already has the agent installed you did not see the Trend icon by the clock disappear for 3 or 4 minutes (as if it were re-installing)? That really suprises me. I have ran autopcc on several different computers on several different networks and the results have always been the same. The Trend icon disappears for 3-4 minutes then reappears and running autopcc in a login script will result in the login script staying visible for the entire 3-4 minutes. Tech Support says autopcc updates (not re-installs). I kind of question that based simply on how long autopcc takes to run and the fact that the Trend icon disappears for the entire autopcc process. Does anyone else have any input on autopcc? Not really critical. The spped on the box is priority 1. Just curious.  


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Affiliate
greggmh123
Posts: 1,976
Registered: ‎01-23-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

Well, poop! It has been so long since I have reviewed my login scripts that I forgot I had removed autopcc from them...probably for that very reason. Yes, on my Windows 7 Ultimate 64-bit, when I run autopcc, it does dump the icon for two minutes.

 

How much memory do you have on the problem computers? It seems that the ones at my client with the slowness problems all have 512MB of memory. I upgraded one to 1GB and they said it is far faster. I will boost two more to 2GB next week. I just remoted into that client and looked at all their systems that have 1GB or more of memory and they seem fairly normal. The two problem systems with 512MB are SUPER SLOW unless I kill the realtime scan service or unload the agent. All of the computers are using about 750-850MB of memory, so the two with 512MB are paging a lot. Apparently, WFBS does not like that paging? They are FAST without WFBS, so I really didn't think of it too much until last night.

 

I am going to update their remote site to SP3. They have no slowness there, but I'll with that one and then do the main office.

 

Sorry for the autopcc confusion.

 

Gregg Hill


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Affiliate
greggmh123
Posts: 1,976
Registered: ‎01-23-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

I just checked several more of that client's computers that have only 512MB, and they were all fairly quick, BUT they are NOT using more than the installed 512MB, according to the Commit Charge Peak memory reading in Task Manager.

 

I may be on to something here!

 

Gregg


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Affiliate
greggmh123
Posts: 1,976
Registered: ‎01-23-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

A bit of reiteration, and some more info:

 

It seems that the workstations at my client with the most slowness problems all have 512MB of memory. I upgraded one to 1GB last Monday and they said it is far faster. I just remotely accessed that client and looked at all their systems that have 1GB or more of memory and they seem fairly normal (they are using around 800MB-900MB). The two big problem systems with 512MB installed (using around 750MB) are SUPER SLOW unless I kill the real-time scan service or unload the agent. Almost all of the computers, regardless of memory installed, are using about 750-900MB of memory, so the two with 512MB are paging a lot. Apparently, WFBS 6.0 SP2 does not like that paging? They are FAST without WFBS 6.0 SP2 or with the real-time scan service stopped, so I really didn't think too much about the 512MB being any problem until last night.


I just checked several more of that client's computers that have only 512MB, and they were all fairly quick, BUT they are NOT using more than the installed 512MB, according to the Commit Charge Peak memory reading in Task Manager.


Because I found that the two systems with 512MB installed that are using around 750-850MB are SUPER slow, I decided to install the WFBS 6.0 SP3 release that came out a few days ago, due to some mention here of getting better performance.


So far, WFBS 6.0 SP3 has made a marked difference in speed over SP2 at their remote site as well as main office. I just installed it about two hours ago at the main office, and all their workstations are faster, even the two that use more memory than the 512MB that is installed. Those two are MUCH faster so far, but still slower than the others. I will boost those two systems to 2GB next week after they have had a few days to settle in with WFBS 6.0 SP3, because they always seemed OK for a few days after an installation.


Gregg Hill


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Honored Esquire
StillLooking
Posts: 109
Registered: ‎05-05-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

   I am pretty sure all my computers on all my networks have a minimum of 1GB. Half of them probably have 2 but as I mentioned above the runtime speed of the workstations really wasn't the issue. I remember when they first came out with Smart Scan. That murdered the runtime speed of the workstations but switching back to conventional seemed to fix the issue.

 

   I went ahead and put SP3 on a total of 5 networks the other day. All feedback has been very positive. Boot times were normal and I went back to Smart Scan as opposed to Conventional. As you mentioned it is still really too early to tell about SP3. Only time will tell if the slowness will creep back in but right now it looks good.

 

   I got my WFBS 7.0 download today. I think I am going to pass. Trend has had a series of mis-steps and speed issues ever since 5.0. I am tired of debugging their software for them. If 6.0 SP3 solves the speed issues then I plan on staying with it for a while. Let someone else debug 7 :smileyhappy: Now if I could only get it to actually stop malware :smileyhappy: 


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.
Affiliate
greggmh123
Posts: 1,976
Registered: ‎01-23-2010

Re: Improving the performance of OfficeScan clients or Client/Server Security Agents

To improve your chances of catching malware, have you read my comments above starting with "Have you followed the steps in the best practices doc for WFBS?"

 

The default settings WILL let in "successfully detected" bad guys under certain circumstances. ActiveAction is BAD!!!

 

They are


I am a Trend Micro Affiliate. My comments and advice come from my personal knowledge and experience. I’m happy to volunteer what I can to help others have a great Trend Micro experience.
Please use plain text.