Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu
Created: 21 Feb 2012 | 12 comments
Hey guys,
We were running 11.0.6 and have updated to 12.1.1000. We did this to solve this problem in this tech note.
http://www.symantec.com/business/support/index?pag...
The problem is we are still seeing the same issue. High cpu utilization, and memory usage. At least with 11.0.6 we could kill the process not it just respawns after 2 seconds.
Discussion Filed Under:
Comments 12 Comments • Jump to latest comment
I'm running OS 11.0.7101 and having same issue of high CPU and memory climbing usage. But after killing the process, it re-appears after two seconds. So not being able to kill it also applies to OS 11.0.7.
I saw this issue last week and guessing it was pushed by my admin. How long has your issue been occuring?
Which Mac OS are you running, 10.6? Is there a directory service integration in use (as noted in the document--just for curiosity's sake)?
If you can, please provide screenshots from Activity Monitor showing the CPU/memory usage. Thanks!
sandra
Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection
Don't forget to mark your thread as 'solved' with the answer that best help
I'm running Mac OS 10.6.8.
How to determine if there's a directory service integration in use?
Attaached is a screen shot from Activity Monitor.
Thanks.
Sandra, Thank you for your reply.
Yes we are running 10.6.8 and we are connecting to an active directory server.
I've been consulting with a colleague. Please try the following:
sudo rm -r ~/Library/Preferences/com.Symantec.schedScanResults
I've deleted this file myself (same OS as you, SEP 12.1) and have seen no ill effects.
Thanks,
sandra
Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection
Don't forget to mark your thread as 'solved' with the answer that best help
Sandra, It looks like that was a folder. I removed mine, what should we expect to see now? The process is still running. Would we need to reboot or should removing that eventually change something?
EDIT: interesting enough we piloted 12.1 to 6 users. 3 users including me have the scannotification at the top at 50% and the other 3 do not. All 5 are the same machines with the same deployed image. All 6 were upadated and not a fresh install.
Please try rebooting, thanks. (the -r switch should have deleted it and everything in it.)
Do you also still see configd at the top using more CPU, as in the screen shot? If you click on ScanNotification in Activity Monitor, is there an indication below of how many cores are involved?
For what it's worth, I show the process as running, but shows 0.0% CPU usage.
sandra
Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection
Don't forget to mark your thread as 'solved' with the answer that best help
I copied pasted the following command at the profile level in Terminal prompt (computer name: ~username$):
sudo rm -r ~/Library/Preferences/com.Symantec.schedScanResults
And received the following result:
No such file or directory
Is the file located in another directory or is there another command to delete the schedScanResults file?
Apologies--leave out the tilde.
sudo rm -r /Library/Preferences/com.Symantec.schedScanResults
When I deleted it, it regenerated itself on reboot.
sandra
Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection
Don't forget to mark your thread as 'solved' with the answer that best help
Sandra, is whats in that folder telling the program when the last scan was complete? If it gets corrupt is that why maybe the scan never stops or get stuck?
I have not been able to reboot yet. I am still testing some things.
I have an i7 with 8 cores It is going across the 4 real cores.
Corrupted preference is what we're thinking, based on information I found.
sandra
Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection
Don't forget to mark your thread as 'solved' with the answer that best help
Sandra,
The command without the tilda worked. I even rebooted once, and did not see the ScanNotification process running. Will let you know if it re-appears for some reason.
Thanks.
Would you like to reply?
Login or Register to post your comment.