You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/linux-support-perf.md
+8-11Lines changed: 8 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -157,13 +157,9 @@ The Microsoft Defender for Endpoint Client Analyzer (MDECA) can collect traces,
157
157
158
158
To run the client analyzer for troubleshooting performance issues, see [Run the client analyzer on macOS and Linux](run-analyzer-macos-linux.md).
159
159
160
-
161
160
## Configure Global Exclusions for better performance
162
161
163
-
Configure Microsoft Defender for Endpoint on Linux with exclusions for the processes or disk locations that contribute to the performance issues. For more information, see [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](linux-exclusions.md).
164
-
165
-
> [!NOTE]
166
-
> In case after following the above steps, the performance problem persists, please contact customer support for further instructions and mitigation.
162
+
Configure Microsoft Defender for Endpoint on Linux with exclusions for the processes or disk locations that contribute to the performance issues. For more information, see [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](linux-exclusions.md). IF you still have performace issues, contact support for further instructions and mitigation.
167
163
168
164
## Troubleshoot AuditD performance issues
169
165
@@ -179,9 +175,9 @@ Configure Microsoft Defender for Endpoint on Linux with exclusions for the proce
179
175
180
176
In certain server workloads, two issues might be observed:
181
177
182
-
-**High CPU** resource consumption from ***mdatp_audisp_plugin*** process.
178
+
-`High CPU` resource consumption from `mdatp_audisp_plugin` process.
183
179
184
-
-***/var/log/audit/audit.log*** becoming large or frequently rotating.
180
+
-`/var/log/audit/audit.log` becoming large or frequently rotating.
185
181
186
182
These issues may occur on servers with many events flooding AuditD. Such issues can arise if there are multiple consumers for AuditD, or too many rules with the combination of Microsoft Defender for Endpoint and third party consumers, or high workload that generates a lot of events. To troubleshoot such issues, begin by [collecting MDEClientAnalyzer logs](run-analyzer-macos-linux.md) on the sample affected server.
187
183
@@ -227,23 +223,23 @@ Contains important aggregated information that is useful when investigating Audi
227
223
228
224
### Exclusion Types
229
225
230
-
The XMDEClientAnalyzer support tool contains syntax that can be used to add AuditD exclusion configuration rules:
226
+
The XMDEClientAnalyzer support tool contains syntax that can be used to add AuditD exclusion configuration rules.
231
227
232
228
AuditD exclusion – support tool syntax help:
233
229
234
230
:::image type="content" source="media/auditd-exclusion-support-tool-syntax-help.png" alt-text="syntax that can be used to add AuditD exclusion configuration rules" lightbox="media/auditd-exclusion-support-tool-syntax-help.png":::
235
231
236
232
**By initiator**
237
233
238
-
-**-e/ -exe** full binary path > Removes all events by this initiator
234
+
-`-e/ -exe` full binary path > Removes all events by this initiator
239
235
240
236
**By path**
241
237
242
-
-**-d / -dir** full path to a directory > Removes filesystem events targeting this directory
238
+
-`-d / -dir` full path to a directory > Removes filesystem events targeting this directory
243
239
244
240
Examples:
245
241
246
-
If "`/opt/app/bin/app`" writes to "`/opt/app/cfg/logs/1234.log`", then you can use the support tool to exclude with various options:
242
+
If `/opt/app/bin/app` writes to `/opt/app/cfg/logs/1234.log`, then you can use the support tool to exclude with various options:
247
243
248
244
`-e /opt/app/bin/app`
249
245
@@ -290,4 +286,5 @@ When the ratelimit is enabled a rule will be added in AuditD to handle 2500 even
290
286
## See also
291
287
292
288
-[Investigate agent health issues](health-status.md)
289
+
293
290
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
0 commit comments