Endpoint Protection

Hello,

I would like to ask for help to solve "Shutdown Delay of VM (running Windows Server 2008) with SEPM 12.1".

Weekly, we do restart the antivirus server, Windows Server 2008 on which SEPM 12.1 is running.

While shutting down, it took over 1 hour and we always did force power off since March 2014.

But, sometimes, that VM shut down normally. How do you think which may cause this error?

I would like to report my surveyed information.

1)    Windows' Status:
    i)     Event Logs              : No severe error occurred
    ii)    CPU                         : Below 20%
    iii)    Physical Memory    : Below 30%
    iv)    Network                  : Normal
2)    Running Processes:
    i)    Highest Memory Using processes:
            dbsrv11.exe    = 554,928 K
            SemSvc.exe    = 235,132 K
            sqlservr.exe    = 224,076 K
            (Last scanned on 07-Aug-2014)
3)    Virtual Machine's Usage Status on esx06:
        General
            Guest OS             : Windows Server 2008 (32-bit)
            VM Version           : 8
            CPU                      : 2 vCPU
            Memory                 : 10240MB
            Memory overhead : 98.52MB
        Resources
            Consumed Host       : 10314.00 MB
            Active Guest            : 512 MB
            Provisioned             : 250.03 GB
            Not-shared Storage : 169.01 GB
            Used Storage           : 169.01 GB (69.60%)

Why do you restart it? What components are isntalled?

Hello Mr. Brian,

Thanks for your interest on my problem. I would like to answer which you want to know.

"Why do you restart it?"

According to our company's weekly schedule, we restart all VMs in our system every weekend(Saturday).

"What components are installed?"

On that VM (antivirus server), only SEPM12.1 was installed and only Symantec is running.

Please give me your advice. Thank you.

Best regards,

Wai Lynn Aung

Have you check STOP SEPM related services than restart ?

Thanks, we will check on this Saturday weekend reboot shedule.

But one thing, as I mentioned, sometimes it did not take too long time. But mostly, it took long, and we did force power off. How do you think about this abnormal shutdown time taking?

Thanks for your information.
 

But I'm asking which components are installed for the SEP client, firewall, IPS, etc?

Mr. Brian, SEP server-client component is installed.

Hi Wailynnaug,

It's means SEP Client Component (AV,PTP,NTP).

Does have you try stop SEPM service stop than restart server.

Dear Brothers,

To investigate the root problem, I watched the shutdown status on last Saturday weekend reboot shedule (16-Aug-2014), and found that the symantec related servies were eating highest memory, then we did shutdown. Once we shutdown that VM, the windows was hung with "Shutting down" logo and we had to do force power off after waiting about 20 minutes.

Highest Memory Using processes:
            dbsrv11.exe    = 555,020 K
            SemSvc.exe    = 239,664 K
            sqlservr.exe    = 224,076 K
            (Last scanned on 16-Aug-2014)

Mr. Bond 007, I will check STOP SEPM related services before restart on next Saturday weekend reboot shedule (23-Aug-2014).