Endpoint Protection

CPU usage is running over 100% and slow performance for any web application.

Please help and thanks.

Have you contacted the vendor to see what exceptions may be needed?

What SEP components are installed and in use?

What is the full build or MP number of the build?

I excluded /proc and /sys.

I used SEP 12.1.6 (12.1 RU6 MP4) build 6867 (12.1.6867.6400).

Thanks.

What processes are consuming CPU?

Check Supported Linux kernels first:
www.symantec.com/docs/TECH223240

During 100%, which process is taking most of the resource?

Check if disabling Auto Protect resolves the issue:
#./sav autoprotect 
-d (disable) 
-e (enable)

If so then create exceptions. 

Helpful article: 
Symantec Endpoint Protection for Linux (SEPFL) Scanning Performance Best Practices
www.symantec.com/docs/TECH233522

Try below as well:

Is Virus & Spyware Protection policy:
Advanced Scanning & Monitoring> select "Scan when a file is modified"
Make sure - "Scan files inside compressed files" unchecked.

Else it has something to do with RtdScand. Try to disable RtdScand & monitor the performance:
./rtvscand -k shutdown

Best start iotop with -o option to see running processes or threads actually doing I/O. It's also useful to look at the bottom of the "dmesg" output. Usually it isn't particularly revealing, but in the case of hardware errors or the out of memory killer it can very quickly reveal a problem.

Hope this helps! Cheers

rtvscand and glusterfs are the top.