Performance issues caused by DeepGuard

Issue:

When DeepGuard protection feature is enabled, startup of some applications is very slow and takes either a lot of time or longer than usual. What can cause there performance issues when DeepGuard is enabled?   
 

Resolution:

DeepGuard performance issues are usually the result of the Elements Agent, Client Security or Server Security client either being unable to connect to the Security Cloud or Security Cloud being disabled. 

We recommend first to run the WithSecure Connectivity Tool to make sure that all connections towards the WithSecure services work correctly. 

The tool is located in the following folder:

• Client Security: C:\Program Files (x86)\F-Secure\Client Security\ui\fsconnectionchecker.exe
• Server Security: C:\Program Files (x86)\F-Secure\Server Security\ui\fsconnectionchecker.exe
• Elements EPP for Computers/Elements EPP for Servers: C:\Program Files (x86)\F-Secure\PSB\ui\wsconnectionchecker.exe

Also make sure that Security Cloud is enabled. 

How to enable Security Cloud for Elements Agent:

1. Log in to the Elements Security Center 
2. Navigate to the Security configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Real-time scanning settings page
5. Scroll down to the File scanning section
6. Make sure Upload suspicious samples to WithSecure Security Cloud is set as either Upload all suspicious samples or Upload suspicious executables only
7. Click Save profile

How to enable Security Cloud for Business Suite Client Security and Server Security :

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > Real-time scanning
5. Enable User Security Cloud 
6. Distribute the policy (Ctrl + D)

Regarding the performance issues caused by DeepGuard
There are always two levels. The obvious one is if DeepGuard that knows if the application is whitelisted, if it is, DeepGuard doesn't monitor it, so less performance hit.
If DeepGuard doesn't know it's clean, it will monitor it and that can cause performance issues. Excluding will obviously also work to "fix" the performance issues since DeepGuard again doesn't monitor the excluded applications. Whitelisting is just a safer way to reduce the monitoring level that DeepGuard does.
​
For applications running from network shared there's the additional performance hit coming from the SHA1 calculation of the application. Since the binary is on a network share, we can't assume anything about it or cache the results so DG driver will always compute the SHA1 when it see the process launching. Whitelisting doesn't affect this in any way and exclusion is the only way to avoid this performance problem
​
The latter problem mainly affects cases where the application is being launched a lot like several times a minute. It also depends on the network speed and file server load and many things.

Usually whitelisting the application is sufficient to avoid performance issues.
So, you can add example application.exe to excluded processes to optimize disk performance. but you can also add the whole path to excluded applications under real-time scan.

If you are not sure, if the application is clean and can be excluded, you can always submit the executable of that application to us for further analysis. To do so, please use the Sample validation service in the Elements Security Center portal.