Systems running Sophos Central Server Core Agent exhibit high CPU and RAM usage after updating Splas

dwheeler
dwheeler Member Posts: 1 ✭
edited December 2023 in Remote Monitoring

Systems running Sophos Central Server Core Agent exhibit high CPU and RAM usage after updating Splashtop Streamer

After the most recent update from Splashtop, it caused a glitch in Sophos that sent the CPU and RAM on one of our servers through the roof. Read the KB if it applies to you.

Tagged:

Comments

  • nina
    nina Internal Posts: 428 ✭✭✭✭✭

    Thanks for sharing!

  • jboustani
    jboustani Member Posts: 1 ✭

    Same is happening on machines with Sentinel1. The Sophos fix also helps with S1 protected workstations and reduced S1's CPU consumption but the Splashtop streamer itself is still consuming abnormally high CPU resources.

  • drosenbaum
    drosenbaum Member Posts: 1 ✭

    We are having the same issue without using Sophos or S1. Is there a fix for the update?

  • graham
    graham Member Posts: 2 ✭

    Seeing this often, added the exlusion last week but some machines still seemt to be affected until reinstall splashtop. Any one else seen this behavior?

  • scottm
    scottm Member Posts: 2 ✭

    I have an open Ticket with Sophos. To resolve a new version of Splashtop needs to be installed, which it doesn't look like Atera has updated in a while. you need 3.5.8 or abobe. see note from Sophos Below..

    We've seen a large increase in performance issues lately for users who utilize Splashtop. This is due to an incompatibility with our software from one of their recent updates. Please see if you are running the latest version which has been shown to potentially resolve this issue (version 3.5.8). If you are running the latest version and are still experiencing issues, below is the list of exclusions for Splashtop, as we have seen an increase in software conflict with their recent update from before 3.5.8. 

     

    During our investigations we found that Splashtop components are creating a very large number of file events, causing our on-access scanner to consistently scan the files / processes.    

     

    C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRAgent.exe  

      

    Please add the above as a process exclusion.  

       

    As a final exclusion, please add a file / folder exclusion for the directory: 

     

    C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\log\ 

     

    Once all exclusions have been configured, please perform a reboot of the system.  

  • scottm
    scottm Member Posts: 2 ✭

    I ran the Inventory Manager. Then Removed the Client. Waited a few minutes and then try the "Connect" button to force an install. The version change from 3.5.6 to 3.5.8.


    I contacted Atera Spport and they say they are aware of the issue and suggest to use this script


    # Define variables 
$downloadUrl = "https://ateranetworks.zendesk.com/attachments/token/JfG6adjBRfqwNq8kzLzyfhplj/?name=SplashtopStreamer.exe" 
$downloadPath = "C:\Windows\Temp\Splashtop_Streamer.exe" 

# Download Splashtop Streamer 
Invoke-WebRequest -Uri $downloadUrl -OutFile $downloadPath 

# Install Splashtop Streamer 
Start-Process -FilePath $downloadPath -ArgumentList "/s" -Wait 

# Clean up downloaded file 
Remove-Item $downloadPath

    I am surprised that the automation policies or software patches don't check or update teh Splashtop agents.

    This should be added as check for future agent updates...

Topics