Endpoint Protection

I upgraded our 11.0.5 SEPM to 11.0.6a Sunday night but ever since the CPU has been maxed out.  The PHP-CGI.exe processes seem to be the issue.  We have run a repair on the SEPM with no results.  I have opened a case(412-138-286) with Symantec but they don't seem to have any ideas at the moment. 

In doing some testing, we found that turning off the SEPM service does not kill the PHP-CGI processes.  Only stoping the Symantec Web Server does that.  So it seems that what ever changed in the way that the SEPM handles the connections from my clients is causing the issue.  Any ideas?

Thanks in advance.

MadTheory,

Just a thought. Maybe the server needs a reboot? I'm not really sure, as I thought that RU6a was supposed to address this.

Mike

This issue was fixed in RU6a

Periodic CPU spike when using Symantec Endpoint Protection Manager Java console
Fix ID: 2022713
Symptom: With RU6, a periodic CPU spike occurs when a user selected the Policies, Clients, or Admin page in the Symantec Endpoint Protection Manager Java-based console.
Solution: This issue was caused by a periodic refresh of the Home page to prevent a time-out of the PHP session. The refresh task now refreshes the Reports page, which consumes fewer resources. In addition, you can now configure the refresh time by setting the scm.keepalivescheduleminute value in the conf.properties file.


http://service1.symantec.com/SUPPORT/ent-security.nsf/docid_p/2007121216360648

Thank you for the reply.  I should have put it in the OP but we have rebooted several times.  I just ran another repair on the SEPM and it seems to be slightly better but not by much.  It drops down to 90% CPU Usage every now and again instead of being stuck at 100.

I upgraded to 11.0.6a from 11.0.5.  We never went to 11.0.6.  I was hoping to avoid the CPU Spike issue but the issue that I am having is not a periodic spike.  The CPU Usage goes up to 100% and stays there.

It may be environmental, but I suggest you open a case with support ASAP. Lets get Symantec engineers looking at your issue, and find the root cause.

We have a similar issue here, cpu and mem usage is very high, caused by semsvc.exe after upgrade to 11.0.6a!

B0unCeR1,
Out of curiosity, do you guys have SAV10 clients sending logs back to your SEPM?  My SEPM has calmed down considerably in the last hour and the only change I have made today is that I stopped my SAV10 clients from reporting to the SEPM.

After more troubleshooting and testing.  I found my CPU usage went back to normal after I disabled uploading SAV10.x logs.  It seems that 11.0.6a is not handling the SAV10 logs very well.