atp_database_mirror.exe flooding router and internet connection
Hi,
we are running Cyber Backup 15 build 25729 on different HyperV 2019 customer servers.
Approx. every 60-120 minutes the process "atp_database_mirror.exe" is opening thousands of connections to the internet at once, trying to download something from servers like this one:
e.g. 104.124.11.51 (a104-124-11-51.deploy.static.akamaitechnologies.com)
This is flooding the internet router and completely overloading the internet connection for several minutes.
If we kill the process the internet congestion stops immediately.
I observed the exact same problem at 3 different customer sites.
By the way: the internet links of the sites are: 100 mbit, 400 mbit and 600 mbit. So it's not a slow link!
What is the "atp_database_mirror.exe" process doing?
Why is it regularly downloading so much data with too many connections?
We only licensed Cyber Backup, NOT Cyber Protect.
So in my opinion there should be no download of antivirus signatures or similar data.
How can this behaviour be stopped?
The customer is very upset about this regularly blocking his internet.
Regards,
Dennis
Hello Maria,
You can either view these logs (on AMS):
Windows: %ProgramData%\Acronis\AtpDatabaseMirror\Logs\atp_database_mirror.log
I looked at this log.
It seems the process is trying to download thousands of files AT ONCE ("emalware.*.gzip").
"to download: 932 files, 258115.000000 Kb"
This is way to aggresive in my opinion!
I really think this should only be done in background with much lower priority for not disturbing normal internet connections.
The full feature comparison list is here: https://kb.acronis.com/content/65304
According to feature list, Cyber Backup 15 Standard does not include "antivirus and anti-malware protection".
For what reason does the software create a local mirror of malware definitions then?
Please ask your customer to navigate and adjust the protection settings:
Settings -> Protection -> Protection definitions updates
We don't have this menu in Cyber Backup 15 Standard !!
How can we disable "atp_database_mirror" ??
Regards
Dennis
Hello Dennis.
I looked at this log.
It seems the process is trying to download thousands of files AT ONCE ("emalware.*.gzip")."to download: 932 files, 258115.000000 Kb"
Please open a case with Acronis Support Team for the issue investigation, provide this log and share a link to this forum thread with engineers.
Hello Dennis,
I have the same problem, that the atp_database_mirror.exe opens connections and download files which blocks my internet link.
I also have the Cyber Backup 15 Standard license and there is no option to disable the service.
Did you contact the support and could they help you?
Regards
Sven
Hello Sven,
thank you for posting in this forum thread!
Our developers are reproducing and investigating this issue (thanks to the logs that Dennis collected from affected server and provided to our support engineers).
We recommend that you also collect Acronis System Information from the affected server and Process Dumps of atp_database_mirror.exe process:
procdump -ma atp_database_mirror.exe
Please open a case with Acronis Support Team and provide the resulting logs to the engineers.
Hello Sven,
the problem is still under investigation by Acronis support.
I found myself a preliminary workaroud by blocking the "atp_database_mirror" process in Windows Firewall (outgoing connections) !
Regards
Dennis
This is also an issue for me and every now and then atp_database_mirror.exe block my internet and often breaks my conference calls. I wonder if there is a way to thortle the Internet usage for that program.
Hello Kimmo,
Welcome to Acronis forums!
Please accept our apologies for your negative experience with this issue (TTASK-37937).
Our developers are working on it. We recommend that you open a case with Acronis Support Team, provided the logs from the affected server, and share a link to this forum thread.