Endpoint Protection

Hi,

We are experiencing problems with high memory utilization after upgrading Symantec from 11 to 12.1. Symantec is installed on Windows Server 2008 R2 system. As you can see from the processes tab of windows task manager the memory usage is quite low, but total memory utilized is more than 3GB. To investigate the issue we used RamMap and found out that "mapped file" consume around 2gb.

"Mapped File:Also known as section objects, mapped “views” of files are when the contents of that file are mapped to virtual addresses in memory. This can be a process mapping views of files into its memory (for reading or writing) or for the system file cache. For more details on mapped files, see the references at the end of this post."

Database file located in E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\db\sep05 is consuming almost 1,5GB. As a workaround we are restarting the Symantec Embedded Database and after that the memory utilization go back to normal,

We are looking for a permanent solution

Thanks

Mateusz

Have you checked these Articles???

http://www.symantec.com/business/support/index?page=content&id=TECH123708&actp=search&viewlocale=en_US&searchid=1322726789102

http://www.symantec.com/business/support/index?page=content&id=TECH105629&actp=search&viewlocale=en_US&searchid=1322726789102

Hi Ajit,

I checked both articles before. In Ersecreg.log I can see only AgentInfo notifications, no errors. Please be aware that I have memory problems, CPU utilization is in normal state.

I runned a procmon to check memory utilization. Between 2:23am-2:29am memory goes down from 2530MB to 1530MB, from eventlog I can see that LiveUpdate was working at this time, unfortunatelly the memory did not go back no normal state

2:42am The LiveUpdate service entered the running state.

2:34am New virus definition file loaded. Version: 111130018.

2:43am The LiveUpdate service entered the stopped state.

Hi mpolok,

do you experience any problems with this Memory-consumption? Does anything not work?

From my understanding Database-Systems always try to allocate as much Memory as possible (an MSSQL will grab ALL the Memory you throw at it ;-) ). Windows then manages this Process in detail.

So if you don't have any ntroubles on this machine I would leave it as it is, and let the machine do all the work.

Hi Stephan,

I think that it is the only 'solution'. The weird thing is that we did not have such problem before, it started after migration to 12.1. The memory managements in windows 2008 differs a lot from earlier versions of windows. I am wondering why the active 'mapped file' is so big. The second weird thing is that the memory utilization goes high because of LiveUpdate, how it can be connected with database?!

I will try to leave it for few days and check the overal performance,

Again when the "New virus definition file loaded" event appeared the memory utilization goes up. The sem5.db is consuming 1,35GB

On monday probably we will be out of space, I will not restart Symantec Embedded Database till then

I recently installed SEP12.1 on a new virtual Windows 2008r2 server. A couple of days ago deployed client packages to 4 clients. (2 xp boxes, one win 7 32bit, and 1 win 64bit).

Yesterday I ran the client deployment wizard and installed the client on my server.  2AM this morning I received a text alert:

Server txxxxxa health status: poor. Reason: Memory on your Symantec Endpoint Protection Manager server is running low. Status reported on Dec 6, 2011 2:56:01 AM.

Nice ... 4GB of RAM installed, Running AD with only 4 clients connected at this point, SEM is hogging 3GB of memory.  MPOLOK thanks for providing details.  I was about to go down the same road that you followed....

make sure live update scheduling is not set for continuous

Hi Gurupreet,

Thanks but I done it already in last week - it is running every 8hours, unfortunatally It did not resolve the issue. The memory utilization goes high only when the "New virus definition file loaded" is done.

 As a workaround I am:

1. Restarting the Symantec Embedded Database service or,

2. Empty system working set in RamMap (EMPTY/Empty system working set )

I opened a case in Symantec, I will let you know If we will be able to resolve the issue.

@NBAdmin, sory for that but I am happy that the problem do not only exist on my server :)

@mpolok have symantec responded with anything regarding this yet? My symantec database file was consuming 4b ram this morning, restarting the db service reduces memory usage however it's not an ideal solution,

Thanks

Just stopped by to see if there had been any response from Symantec.... 

Looks like I have 2 options...

1) open a case of my own with Symantec ... based on the (apparent lack of)  response to @mpolok, this would appear to be an exercise in futility

2) buy more memory for my server ... not exactly in my budget, but it is fairly cheap and will probably cost me less than my time to babysit my little memory hog until it's time to make a decision about renewal.  If they do come up with a solution, I would have lots of "extra" memory.  Maybe I should be grateful?