Endpoint Protection

Howcome very often after an update from symantec the computer has a performance activity of 30% till 100% while the computer is doing nothing.

Meaning that if i need to use my computer it is very very slow.

After the upload symantec systemfiles keep the cpu busy while not needed.

It is not scanning or so

do you see what are the process that is utilizing high CPU/Memory?

As I can understand - you do not like that system is loaded while doing nothing, and you think that SEP is the root of the problem?

Well, you can tell for sure if it is really Symantec software by monitoring processes with Process Monitor from Sysinternals. The site is here: http://technet.microsoft.com/en-us/sysinternals

Then, if it is really SEP casing the system slowdown - we should expect some explanations from Symantec here.

hi,

after the client has new defuinitions, it will perform a DefWatch Scan. Due to that there may be a temporary peak in CPU utilization.

regards,

Aniket Amdekar

Hello,

There are few Things to check to find the Root cause of this issue:

1) What OS are you carrying?

2) How much RAM are you carrying on the machine?

3) What Process is carrying the highest CPU usage?

4) What version of SEP are you carrying?

Always make sure you are carrying the Latest version of SEP on your machine.

The Latest version of SEP is 11.0.6300

You could download the same from https://fileconnect.symantec.com

Incase, the SEP clients are managed, try performing these steps:

From the SEP-Manager:
- Edit the Antivirus and Antispyware policy of affected clients.
- In the policy editor click "Quarantine" on the left-hand menu.
- On the general tab click "Do nothing" under the heading "When new Virus Definitions Arrive"

Using process monitor usually only shows services.exe which is of no value to determine the exact service causing the issue.

RAM and OS have nothing really to do with why CPU spikes.

Disabling the entire AV and CPU returns to normal -- points to AV, question is what in the AV is causing this to spike CPU to 100%?

As well, users complain that it happens everyday at certain time -- we have scheduled scans once per week,  what could be causing the AV to appear to come to life and do something every 24hrs?

I guess it can be the scan that happens after definitions update.

You can cehck and maybe disable from Antivirus policy -> Administrator defined scans ->Advanced and remove the check from "Run an active Scan when new definitions arrive"

We have servers whereby source files are replicated to another server over the network on a minute basis ... could this be causing AV to continuously monitor for files being accessed as the replication service read the file on the source server and tis causes AV to kick into action and sometimes spikes the CPU to 100% and if excessive reading from the source server does this, can this be stopped somehow in the AV setup?

The only way I can think is an explusion policy... Or disabling teh File system auto protect.

But you were saying that it only happens once everyday almost at same time....