Advance Anti-malware exclusions not working after upgrading the Deep Security Agent (DSA)

Product / Version includes:

Deep Security 20.0 , Cloud One - Endpoint and Workload Security All

Last updated: 2025/05/08

Solution ID: KA-0012329

Category: Configure , Troubleshoot

Summary

Customers that have enabled Application Control, Integrity Monitoring or Activity Monitor without enabling the real-time scan of the Anti-Malware module may encounter issues excluding file events from the kernel. These exclusions are configured in ds_am-exclude-file.ini or ds_am-exclude-dir.ini file. The issue may happen if you are using either of the agent version below:

20.0.0-2740
20.0.0-2921

As a workaround, rollback to Agent version 20.0.0-2593:

From the manager console, deactivate the target agent.
SSH to the target computer.
Go to /var/opt/ds_agent/am and backup the following files
- ds_am-exclude-file.ini
- ds_am-exclude-dir.ini
- ds_am.ini
Uninstall the DSA version 20.0.0-2740.
Install and activate the DSA version 20.0.0-2593.

If you are using deployment script, make sure to update the agent version control feature in the manager console to deploy a specific agent version.
Restore the files in step 4 and restart the agent service

The fix for this issue is scheduled to be included in the September official release.

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

Advance Anti-malware exclusions not working after upgrading the Deep Security Agent (DSA)

Advance Anti-malware exclusions not working after upgrading the Deep Security Agent (DSA)

Product / Version includes:

Summary