Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
This discussion is archived
1391 Views 7 Replies Latest reply: Apr 12, 2013 4:12 PM by kenobe RSS
jpeg9999 Newcomer 26 posts since
Jul 22, 2011
Currently Being Moderated

Nov 30, 2012 12:17 PM

Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

It takes about 1-15 minutes to save an IPS Rules policy on our ePO server.  It is running 4.5 patch 6 on SQL 2008 R2 on 2008 Server R2.

 

Saving any other policy is fine.

 

How best can we troubleshoot this problem?  Any input is appreciated.

  • hbssadmin Newcomer 28 posts since
    Jul 18, 2012
    Currently Being Moderated
    1. Feb 1, 2013 9:25 AM (in response to jpeg9999)
    Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

    Has this been resolved or are you still waiting for feedback?

  • HerbSmith Apprentice 92 posts since
    Dec 9, 2009
    Currently Being Moderated
    2. Feb 5, 2013 5:08 PM (in response to hbssadmin)
    Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

    It is very slow with HIPS 8.0 P2 and latest extensions when running ePO 4.6 P4.  When making IPS exceptions it can take 2-4 minutes.  When saving the policy it can take up to 5 min.   Seems to be related to number of exceptions in the policy.   Once they get past about 5 things go downhill.

  • StefanT Apprentice 113 posts since
    Jul 10, 2009
    Currently Being Moderated
    3. Mar 6, 2013 7:29 AM (in response to HerbSmith)
    Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

    I'm glad I'm not the only one with this issue, ePO 4.5 patch 5 and ours takes around 10-15 minutes to save. I do have a large number of bespoke signatures but not 1000's!

     

    Another 'feature of the product'

     

    Stef

  • HerbSmith Apprentice 92 posts since
    Dec 9, 2009
    Currently Being Moderated
    4. Mar 6, 2013 8:36 AM (in response to jpeg9999)
    Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

    I have had ticket open with Platinum support for almost two weeks now.   It is going nowhere.   Saving of IPS rules takes well over two minutes.   Even Firewall rules are taking much longer than before.  The ePO server itself is not overly busy,  but the problem appears to be on the SQL server side.  Our lead DBA tells me they see blocks being put on transactions when I try to save HIPS rules.  It appears trying to save the rule puts a block on the processing of routine client updates.  Then waits for those in process to clear, and then does it processing and saving.   In looking at the ePO counters on the ePO server the number of client requests processed goes to zero.   The number of open client connections zooms up, many times hitting the 244 max.  CPU activity spurts for a few seconds as client connections go up.  Then client requests start getting processed again and the number of connections returns to normal. 

        2 minutes to create an exception from an event, and then another 2-3 minutes to edit save the rule makes working with HIPS a problem.   And some of the new rules with HIPS 8.0 P2 need LOTS of tuning.

  • StefanT Apprentice 113 posts since
    Jul 10, 2009
    Currently Being Moderated
    5. Mar 6, 2013 8:40 AM (in response to HerbSmith)
    Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

    Let's hope it gets fixed, we've learned to live with it........................amend policies...............save..................go for coffee (and maybe lunch)!

     

    Stef

  • HerbSmith Apprentice 92 posts since
    Dec 9, 2009
    Currently Being Moderated
    6. Mar 6, 2013 5:12 PM (in response to jpeg9999)
    Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

    Just heard from support.  "it is running as expected"   If you have a large number of rules it will take awhile.   I have been timing things this afternoon.  I have done at least 8 saves between creating new exceptions from events and editing the actual polcy.  Typical time to save 3 min 15 sec.  Best time 1:59 Sec.  I have wasted close to a 1/2 hour just today.

    If buffer overflow rules 985 and 6032 were not tripping on well known MS products all the time for all kinds of different reasons I could get rid of close to 40 rules.

     

    I was also advised to put in a Product Enhansement Request.   The black hole of ideas.

     

    Thanks

    Herb

  • kenobe Apprentice 90 posts since
    Mar 15, 2012
    Currently Being Moderated
    7. Apr 12, 2013 4:12 PM (in response to jpeg9999)
    Re: Slow Saving HIPS 8 Policies in ePO 4.5 patch 6

    Same problem at my site.  We had serious issues on 4.5 MR4 and were told to wait until MR5 then all would be good.

     

    It's just as bad on MR5.  Edit policy, no problem.  Save policy, wait 20 mins, screen timeout, click ok, wait 20 more mins, get logged out.  !@^#@!$^!@^$@

     

    This is ridiculous.

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points