Sudden poor performance in WMS

Question

We had an issue today where the performance of the WMS web interface went from good to extremely slow... on the order of 1 min to login. ThinOS clients displayed a waiting for WMS sync notice on startup aswell for about a minute.

Having investigated all day I found that since a Sophos update the "Dell WMS memcached" service was failing. In Services it showed as "paused". But the underlying memcached.exe was not running. Also running memcached.exe manually resulted in it simply terminating with no output (it is a command line program).

Eventually, and by much trial and error, I identifed that after disabeling Sophos Central's component "Exploit Mitigation" the service could immedialtely be started.

Just wanted to share incase anyone else with WMS and Sophos has this issue.

KOYOTE76 · Accepted Answer

Thanks Graeme32 for your input, saved me some hours!What helped for me was a custom Threat Protection policy (Sophos Central) for the WMS server with the following changed options:- Disable Prevent malicious use of syscall instructions    and- Exclude C:\Program Files\DELL\WMS\ServiceMgr
ssm.exe (Exploit Mitigation And Activity Monitoring)

flemo74 · Answer

@KOYOTE76​ Thanks for the find. Fixed our issues as well

chris.fulton · Answer

We also had this exact same problem.  Many thanks for providing this info, as it saved us a lot of time troubleshooting

DELL-Scott H · Answer

Thank you @Graeme32  for sharing this.   I have passed it along to my team for visibility.

CRSI IT · Answer

We are running into the same issue as well. The memcache service was Paused and causing slowness. However, even after turning off "Exploit Mitigation" and restarting the service, we have been unable to push our configuration files to our thin clients.

Do you have this issue as well?

CRSI IT · Answer

Quick update to my last post.  I found that turning off 'Windows Firewall'  in Sophos Endpoint allowed our config file to push to thin clients.

DELL-Scott H · Answer

Thanks for sharing

. Sounds like the Sophos FW was probably blocking the MQTT port (1883) used for real time communication from clients to WMS, which tells the TC's to come and get changes. I would guess the TC on the system information tab, About screen would show MQTT communication as having failed.

Wyse Management Suite

Sudden poor performance in WMS

Was this post helpful?