Cortex XDR makes visual studio run slower

[Grady]

My users have reported that visual studio is very slow to open, which seriously affects the work of the development team. Of course, after I turned off the malware function of XDR, the user returned to normal. I set the visual studio installation path to allow operation in the malware policy, and found no results. Has anyone encountered such a problem?

[zarnous]

I haven't encountered this behavior, but i would take a step back and verify the below:

1- The endpoint is meeting the minimum requirement to run the agent (the higher the better) , this can be found here

2- Verify if another Third-Party Security Products running alongside XDR on the endpoint, since this may cause performance issues and some unexpected behaviors, more info can be found here

I hope this helps. 

[Grady]

1. I checked the user's hardware resources, it is no problem, it fully meets the resource requirements of the agent
2. In addition to XDR protection, there is no other third-party protection software on the user's computer

[zarnous · Accepted solution]

do you happen to notice any CPU spike when you start Visual Studio? , and also if you identified the scope of the issue (on how many endpoints) and they all experience the same, then i would have a TAC case open to look at this specific issue and run some analysis, you may proactively collect some logs from one of the impacted endpoints and submit those to your ticket, something like:

1. Raise the log level -

cytool trace stop

cytool trace set all verbose 0x7FFFFFF

cytool trace start

2. Run ProcMon, and reproduce the issue in full

3. Save the ProcMon capture and close ProcMon.

4. Turn off / exclude the responsible component

5. Run ProcMon again to capture the behavior.

6. Collect the agent support file & .PML files.

7. Reset the logging level -

cytool trace stop

cytool trace reset

cytool trace start

And have those uploaded to the TAC case for further analysis. 

[Leo-L]

Hello everyone,

We are facing the same issues. Our developers report serious performance issues.

XDR has been identified as the root cause of these performance issues. We have taken metrics with and without the XDR agent and the build time is substantially longer with the agent installed.

Proper exclusions in "Malware" and "Exceptions" profiles/sections do not seem to make any impact at all.

In our case, XDR should not monitor at all the MVS in order to make sure that delivery timelines are not affected.

Any advice? 

Thank you very much in advance.

Kind regards.

[Grady]

Hello

You can generate trapd.log in the relevant terminal for analysis. My terminal analysis result is that VS is slow because XDR detects Citrix and causes VS to get stuck and crash. It is recommended to find the corresponding crash file name or path and whiten the BTP module