First time using ESET

Discussion in 'ESET Smart Security' started by Shemp, Sep 29, 2008.

Thread Status:
Not open for further replies.
  1. Shemp

    Shemp Registered Member

    Joined:
    Sep 29, 2008
    Posts:
    2
    I support a number of small business networks. A new customer insisted on ESET as their security product. This is my first exposure this this product in a business environment.

    Here's the problem I'm seeing. All the workstations are logging a couple of errors in their event logs. These errors are clearly caused by the ESET Smart Security product as they weren't there prior to the installation and a temporary removal of the product makes the errors go away.

    The version installed in 3.0.672.

    The errors are:
    1. a System error, Event 3019, Source MrxSmb.
    2. A System error, Event 6004, Source EventLog

    I did a Google search on this and found others with this problem. Some seem to indicate this problem had been solved (but this is a new installation with a current version of the software). Others seemed to dismiss the significance of the errors. Regardless of whether or not these errors are significant, a security product should cause them.

    What is the resolution to this problem?

    Thanks!
     
  2. MidSpeck

    MidSpeck Registered Member

    Joined:
    Apr 24, 2007
    Posts:
    30
    Hi, I have not seen the 6004 error since the newer versions, but I do believe that it would be considered a significant error.

    What follows is just to help spark some discussion, as we do see the 3019 warning after ESET NOD32 v3 install, and not before (I am not running ESS, so I believe the problem lies more with the EAV portion).

    Many people dismiss the 3019 warning (Mrxsmb) because your computer will continue to work even with the warning. However, it does make a difference. With one of the programs we use here at work, we have hundreds of thousands of tiny files. Tiny being < 1k. Sometimes we need to copy a subset of these tiny files. If the 3019 MrxSmb warning shows up in the event log while trying to copy these files, the copy will take about an hour or two. Not because the size is large, but because apparently the 3019 warning causes a lot of overhead for each file to occur. If the 3019 warning does not exist, it takes about 3 minutes. That is a huge difference.

    Note: just because NOD32 is installed does not guarantee that the 3019 warning will occur, I have seen it work and not work on the same machine, without rebooting, simply by accessing the server in a different way:
    \\IP address\share
    \\shortname\share
    \\fully.qualified.name\share
    Z:\ -- mapped drive to any one of those

    I have also seen the copy work quickly if I am using one of the above methods, but then as soon as I open another method (like a mapped drive) it'll show up and go slow. Closing the mapped drive speeds it right back up (no 3019 warning). However, I have also seen the mapped drive work just fine.

    Random problems are the hardest to track down. Regardless, I never see the 3019 warning without EAV installed -- which means fast copy speeds always.

    Note: EAV is installed on the client, copying files TO the server. It is ALWAYS fast copying FROM the server to the client. EAV is not currently installed on the server end, so I don't have to worry about that portion currently.

    Have other people seen similar issues? Perhaps we can nail down what actually causes the MrxSmb warning.
     
  3. Shemp

    Shemp Registered Member

    Joined:
    Sep 29, 2008
    Posts:
    2
    The only thing I can add to this is the following:

    Several of the workstations at this Company were new and shipped with a trial version of the ESET Workstation anti-virus product. Even with this trial version (not sure of the version #) the 3019 (Mrxsmb) error was prevalent in the event log.

    The 6004 error seems to be a "new addition" that started when the ESET Smart Security BUSINESS EDITION was pushed out to the clients.

    Not sure this helps narrow down the problem in any way.

    Shemp
     
Thread Status:
Not open for further replies.