Skip to content

Commit b17664a

Browse files
authored
Update linux-support-perf.md
1 parent 39b0552 commit b17664a

File tree

1 file changed

+8
-11
lines changed

1 file changed

+8
-11
lines changed

defender-endpoint/linux-support-perf.md

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -157,13 +157,9 @@ The Microsoft Defender for Endpoint Client Analyzer (MDECA) can collect traces,
157157
158158
To run the client analyzer for troubleshooting performance issues, see [Run the client analyzer on macOS and Linux](run-analyzer-macos-linux.md).
159159

160-
161160
## Configure Global Exclusions for better performance
162161

163-
Configure Microsoft Defender for Endpoint on Linux with exclusions for the processes or disk locations that contribute to the performance issues. For more information, see [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](linux-exclusions.md).
164-
165-
> [!NOTE]
166-
> In case after following the above steps, the performance problem persists, please contact customer support for further instructions and mitigation.
162+
Configure Microsoft Defender for Endpoint on Linux with exclusions for the processes or disk locations that contribute to the performance issues. For more information, see [Configure and validate exclusions for Microsoft Defender for Endpoint on Linux](linux-exclusions.md). IF you still have performace issues, contact support for further instructions and mitigation.
167163

168164
## Troubleshoot AuditD performance issues
169165

@@ -179,9 +175,9 @@ Configure Microsoft Defender for Endpoint on Linux with exclusions for the proce
179175

180176
In certain server workloads, two issues might be observed:
181177

182-
- **High CPU** resource consumption from ***mdatp_audisp_plugin*** process.
178+
- `High CPU` resource consumption from `mdatp_audisp_plugin` process.
183179

184-
- ***/var/log/audit/audit.log*** becoming large or frequently rotating.
180+
- `/var/log/audit/audit.log` becoming large or frequently rotating.
185181

186182
These issues may occur on servers with many events flooding AuditD. Such issues can arise if there are multiple consumers for AuditD, or too many rules with the combination of Microsoft Defender for Endpoint and third party consumers, or high workload that generates a lot of events. To troubleshoot such issues, begin by [collecting MDEClientAnalyzer logs](run-analyzer-macos-linux.md) on the sample affected server.
187183

@@ -227,23 +223,23 @@ Contains important aggregated information that is useful when investigating Audi
227223
228224
### Exclusion Types
229225

230-
The XMDEClientAnalyzer support tool contains syntax that can be used to add AuditD exclusion configuration rules:
226+
The XMDEClientAnalyzer support tool contains syntax that can be used to add AuditD exclusion configuration rules.
231227

232228
AuditD exclusion – support tool syntax help:
233229

234230
:::image type="content" source="media/auditd-exclusion-support-tool-syntax-help.png" alt-text="syntax that can be used to add AuditD exclusion configuration rules" lightbox="media/auditd-exclusion-support-tool-syntax-help.png":::
235231

236232
**By initiator**
237233

238-
- **-e/ -exe** full binary path > Removes all events by this initiator
234+
- `-e/ -exe` full binary path > Removes all events by this initiator
239235

240236
**By path**
241237

242-
- **-d / -dir** full path to a directory > Removes filesystem events targeting this directory
238+
- `-d / -dir` full path to a directory > Removes filesystem events targeting this directory
243239

244240
Examples:
245241

246-
If "`/opt/app/bin/app`" writes to "`/opt/app/cfg/logs/1234.log`", then you can use the support tool to exclude with various options:
242+
If `/opt/app/bin/app` writes to `/opt/app/cfg/logs/1234.log`, then you can use the support tool to exclude with various options:
247243

248244
`-e /opt/app/bin/app`
249245

@@ -290,4 +286,5 @@ When the ratelimit is enabled a rule will be added in AuditD to handle 2500 even
290286
## See also
291287

292288
- [Investigate agent health issues](health-status.md)
289+
293290
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]

0 commit comments

Comments
 (0)