XDR agent potentially prevent Performance Monitoring from being run

[tmeksik]

Hi

Our client has been having issues running Windows Performance Monitoring tool - which may be caused by an XDR agent.

This issue sort of happened out of nowhere but there was this one behaviour which suggested the XDR agent may be a culprit. There was this one endpoint where perfmon could be run just fine as soon as the agent was paused. Once the protection was turned back on, they faced the same problem again. There were at least 5 other endpoints where perfmon couldn't be run (but it has not been tested if pausing the protection would also help). The error message was "The Data Collector Set or one of its dependencies is already in use" (screenshot attached).

There was also one other endpoint where perfmon worked just fine even when the agent was running...

All these endpoints had the same protection profile. Most were running Windows 2012 R2 including the one which perfmon ran just fine with XDR enabled. All ran the same XDR agent version 8.1.1.43337.

To sum it up - we don't really know if this was XDR doing. Even if it was (since the issue went away on one endpoint as soon as XDR was stopped), it could be just specific to a handful of endpoints - not universal. So firstly I'd like to know if anyone ever faced this issue before?

Thanks

Tum

[afurze]

Tmekisk,

Please open a support case and provide the support file from the endpoint(s) in question.  You can retrieve the support file by going to Endpoints -> All Endpoints, right-clicking on the endpoint and selecting Retrieve support file under Endpoint control.