Video Screencast Help
Search Video Help Close Back
to help

Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

Created: 21 Feb 2012 | 12 comments
ClassicII's picture
0 0 Votes
Login to vote

Hey guys,

 

We were running 11.0.6 and have updated to 12.1.1000. We did this to solve this problem in this tech note.

 

http://www.symantec.com/business/support/index?pag...

 

The problem is we are still seeing the same issue. High cpu utilization, and memory usage. At least with 11.0.6 we could kill the process not it just respawns after 2 seconds.

Comments 12 CommentsJump to latest comment

rocky90245's picture

I'm running OS 11.0.7101 and having same issue of high CPU and memory climbing usage. But after killing the process, it re-appears after two seconds. So not being able to kill it also applies to OS 11.0.7.

 

I saw this issue last week and guessing it was pushed by my admin.  How long has your issue been occuring?

0
Login to vote
  • Actions
sandra.g's picture

Which Mac OS are you running, 10.6? Is there a directory service integration in use (as noted in the document--just for curiosity's sake)?

If you can, please provide screenshots from Activity Monitor showing the CPU/memory usage. Thanks!

sandra

Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection

Don't forget to mark your thread as 'solved' with the answer that best help

0
Login to vote
  • Actions
rocky90245's picture

I'm running Mac OS 10.6.8. 

How to determine if there's a directory service integration in use?

Attaached is a screen shot from Activity Monitor.

Thanks.

Activity Monitor Screen Shot - Scannotification.jpg
0
Login to vote
  • Actions
ClassicII's picture

Sandra, Thank you for your reply.

 

Yes we are running 10.6.8 and we are connecting to an active directory server.

Screen shot 2012-02-22 at 8.26.01 AM.png
0
Login to vote
  • Actions
sandra.g's picture

I've been consulting with a colleague. Please try the following:

  1. On the Go menu, click Applications.
  2. Open Utilities.
  3. Open Terminal.
  4. At the prompt, type the following:

    sudo rm -r ~/Library/Preferences/com.Symantec.schedScanResults
     

  5. Press return.
  6. Type your administrator password.
  7. Press return.
  8. Quit Terminal.

I've deleted this file myself (same OS as you, SEP 12.1) and have seen no ill effects.

Thanks,

sandra

Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection

Don't forget to mark your thread as 'solved' with the answer that best help

0
Login to vote
  • Actions
ClassicII's picture

Sandra, It looks like that was a folder. I removed mine, what should we expect to see now? The process is still running. Would we need to reboot or should removing that eventually change something?

 

EDIT: interesting enough we piloted 12.1 to 6 users. 3 users including me have the scannotification at the top at 50% and the other 3 do not. All 5 are the same machines with the same deployed image. All 6 were upadated and not a fresh install.

0
Login to vote
  • Actions
sandra.g's picture

Please try rebooting, thanks. (the -r switch should have deleted it and everything in it.)

Do you also still see configd at the top using more CPU, as in the screen shot? If you click on ScanNotification in Activity Monitor, is there an indication below of how many cores are involved?

For what it's worth, I show the process as running, but shows 0.0% CPU usage.

sandra

Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection

Don't forget to mark your thread as 'solved' with the answer that best help

0
Login to vote
  • Actions
rocky90245's picture

I copied pasted the following command at the profile level in Terminal prompt (computer name: ~username$):

sudo rm -r ~/Library/Preferences/com.Symantec.schedScanResults
 

And received the following result:

No such file or directory

 

Is the file located in another directory or is there another command to delete the schedScanResults file?

0
Login to vote
  • Actions
sandra.g's picture

Apologies--leave out the tilde.

sudo rm -r /Library/Preferences/com.Symantec.schedScanResults

When I deleted it, it regenerated itself on reboot.

sandra

Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection

Don't forget to mark your thread as 'solved' with the answer that best help

0
Login to vote
  • Actions
ClassicII's picture

Sandra, is whats in that folder telling the program when the last scan was complete? If it gets corrupt is that why maybe the scan never stops or get stuck?

I have not been able to reboot yet. I am still testing some things.

 

I have an i7 with 8 cores It is going across the 4 real cores.

0
Login to vote
  • Actions
sandra.g's picture

Corrupted preference is what we're thinking, based on information I found.

sandra

Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection

Don't forget to mark your thread as 'solved' with the answer that best help

0
Login to vote
  • Actions
rocky90245's picture

Sandra,

The command without the tilda worked. I even rebooted once, and did not see the ScanNotification process running.  Will let you know if it re-appears for some reason.

Thanks.

Screen shot 2012-02-22 at 3.48.50 PM.png
0
Login to vote
  • Actions