Cortex XDR makes visual studio run slower

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Cortex XDR makes visual studio run slower

L2 Linker

My users have reported that visual studio is very slow to open, which seriously affects the work of the development team. Of course, after I turned off the malware function of XDR, the user returned to normal. I set the visual studio installation path to allow operation in the malware policy, and found no results. Has anyone encountered such a problem?

1 accepted solution

Accepted Solutions

do you happen to notice any CPU spike when you start Visual Studio? , and also if you identified the scope of the issue (on how many endpoints) and they all experience the same, then i would have a TAC case open to look at this specific issue and run some analysis, you may proactively collect some logs from one of the impacted endpoints and submit those to your ticket, something like:

 

1. Raise the log level -

cytool trace stop

cytool trace set all verbose 0x7FFFFFF

cytool trace start

 

2. Run ProcMon, and reproduce the issue in full

 

3. Save the ProcMon capture and close ProcMon.

 

4. Turn off / exclude the responsible component

 

5. Run ProcMon again to capture the behavior.

 

6. Collect the agent support file & .PML files.

 

7. Reset the logging level -

cytool trace stop

cytool trace reset

cytool trace start

And have those uploaded to the TAC case for further analysis. 

Z

View solution in original post

5 REPLIES 5

L2 Linker

I haven't encountered this behavior, but i would take a step back and verify the below:

1- The endpoint is meeting the minimum requirement to run the agent (the higher the better) , this can be found here

2- Verify if another Third-Party Security Products running alongside XDR on the endpoint, since this may cause performance issues and some unexpected behaviors, more info can be found here

 

I hope this helps. 

Z

1. I checked the user's hardware resources, it is no problem, it fully meets the resource requirements of the agent
2. In addition to XDR protection, there is no other third-party protection software on the user's computer

do you happen to notice any CPU spike when you start Visual Studio? , and also if you identified the scope of the issue (on how many endpoints) and they all experience the same, then i would have a TAC case open to look at this specific issue and run some analysis, you may proactively collect some logs from one of the impacted endpoints and submit those to your ticket, something like:

 

1. Raise the log level -

cytool trace stop

cytool trace set all verbose 0x7FFFFFF

cytool trace start

 

2. Run ProcMon, and reproduce the issue in full

 

3. Save the ProcMon capture and close ProcMon.

 

4. Turn off / exclude the responsible component

 

5. Run ProcMon again to capture the behavior.

 

6. Collect the agent support file & .PML files.

 

7. Reset the logging level -

cytool trace stop

cytool trace reset

cytool trace start

And have those uploaded to the TAC case for further analysis. 

Z

L0 Member

Hello everyone,

 

We are facing the same issues. Our developers report serious performance issues.

 

XDR has been identified as the root cause of these performance issues. We have taken metrics with and without the XDR agent and the build time is substantially longer with the agent installed.

 

Proper exclusions in "Malware" and "Exceptions" profiles/sections do not seem to make any impact at all.

 

In our case, XDR should not monitor at all the MVS in order to make sure that delivery timelines are not affected.

 

Any advice? 

 

Thank you very much in advance.

 

Kind regards.

Hello

 

You can generate trapd.log in the relevant terminal for analysis. My terminal analysis result is that VS is slow because XDR detects Citrix and causes VS to get stuck and crash. It is recommended to find the corresponding crash file name or path and whiten the BTP module

  • 1 accepted solution
  • 5433 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!