Skip to main content

Troubleshooting endpoint performance issues

When encountering an issue with endpoints hanging or freezing, it is important to gather as much information as possible for the Support team to diagnose the issue.

Before reaching out to Support, complete the following steps to ensure a smooth troubleshooting experience.

Initial steps

Enable debug logging to allow the endpoint agent to capture additional details. For more information, see Enable debug logging on the Malwarebytes Endpoint Agent.

Take note of the time the issue occurs. If the issue consistently happens at a specific time, there may be a conflict with a scheduled scan or another software that performs activities at that time. Also take note of any steps to reproduce the issue if they are known.

Layer testing

Once debug logging has been enabled, specific components of Malwarebytes can be disabled to narrow down the cause of the issue. This is called layer testing. Follow the steps below to temporarily disable Malwarebytes and perform layer testing.

Create a test policy with all real-time protection disabled

  1. On the left navigation menu, click Configure > Policies.
  2. Click New to create a new policy.
  3. Name the policy Troubleshooting - Protection disabled or anything discernible as a test policy.
  4. On the left, select Protection settings.
  5. Disable all protection under Real-time protection.
  6. If you have a subscription for Endpoint Detection and Response (EDR), select Endpoint Detection and Response on the left and disable Suspicious activity monitoring.
  7. Click Save.

Create a test group

Once a test policy has been created, you need to create a test group and assign the test policy.

  1. On the left navigation menu, click Configure > Groups.
  2. Click New to create a new group.
  3. Name the group Troubleshooting.
  4. Select the test policy created above.
  5. Click Save.

Test with endpoints

Lastly, move the affected endpoints you want to test to the new group.

  1. On the left navigation menu, click Manage > Endpoints.
  2. Select the affected endpoints from which you already gathered logs.
  3. In the top right, click Actions > Move.
  4. Select the Troubleshooting test group.
  5. Click Save.

After making changes to a policy or group, the endpoint should receive the new policy within a few minutes. To force an immediate policy change instead:

  1. On the left navigation menu, click Manage > Endpoints.
  2. Select the affected endpoints.
  3. In the top right, click Actions > Check for Protection Updates.
  4. On the left navigation menu, click Tasks.
  5. Wait for the new task status to show Success. 

Attempt to reproduce the issue with all protection disabled. If the issue does not occur, enable protection layers one-by-one and test after each layer is re-enabled. Test the protection layers in the following order:

  1. Suspicious activity monitoring (EDR only)
  2. Behavior protection
  3. Malware protection
  4. Web Protection
  5. Exploit Protection

Once the issue returns, collect diagnostic logs and contact support. For more information, check the following links:

Related articles