Endpoint Protection

Everytime i logon to our server running SEPM there is a Javaw.exe*32 process that is using 50% CPU or more.
We are running SEP version: 11.0.6005.562
It was a fresh install and no previous versions of Java were installed.
The Javaw.exe version is: 6.0.140.8

We are running the SEPM on Windows Server 2008 R2 x64 as a virtual machine on vSphere 4 with 4Gb RAM and 2 CPU's.
Does anyone know what could be causing this issue? and how to resolve?
Thanks in advance.

Hi there,

Some published article on this:
Javaw.exe and/or semsvc.exe are consuming 100% of the CPU
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007111411423948
 
SemSVC.exe and Javaw.exe spike CPU usage at 100% after upgrading to RU6
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010042913234348
 
To increase the memory allocated to Java (and perhaps improve performance) of the SEPM console, modify:
C:\Program Files\Symantec\Symantec Endpoint Protection Manager\bin\sesm.bat
 
Original:
@start "SESM" "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\jdk\bin\javaw.exe" -Xms64m -Xmx256m -XX:MinHeapFreeRatio=30 -XX:MaxHeapFreeRatio=40 -Dscm.console.conf="C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\conf.properties" -jar scm-ui.jar
 
Suggested:
@start "SESM" "C:\Program Files\Symantec\Symantec Endpoint Protection Manager\jdk\bin\javaw.exe" -Xms1024m -Xmx1024m -XX:MinHeapFreeRatio=40 -XX:MaxHeapFreeRatio=70 -Dscm.console.conf="C:\Program Files\Symantec\Symantec Endpoint Protection Manager\tomcat\etc\conf.properties" -jar scm-ui.jar
 
Performance increase will still be dependant on memory read/write times and I/O speeds of your server.

Hope that hepls.

Moin

Thanks for that info Moin.
The first does not provide much and have already tried that before (restart SEPM services). The second relates to RU6, but we are running RU6a with a fresh install.
The increase of the memory was already done and must of been resolved in RU6a?

Is there any other suggestions?

Do you have any SEP client installed on the Server Box? What are the features? What version of SEP client?

I do have the SEP client installed on this server. Only Antivirus and Spyware Protection are installed and running version: 11.0.6005.562
This was happening before any SEP client was installed.
The process is relating to the SEPM side of things.
E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\jdk\bin is where the javaw.exe process is located.

Try this once
Tuning the Performance of the Symantec Endpoint Protection Manager console

I tried the above 'Tuning the Performance of the Symantec Endpoint Protection Manager console' and it has not changed the javaw.exe CPU usage.
I have attached the Task Manager to show this process and what it happening which may give a better indication as to the problem.


 

 paste/attach the scm-server-0.log with is present in Program Files \Symantec\Symantec Endpoint Protection Manager\tomcat\logs

Also run SEP support toll and see any error is present...

Note that on a virtual machine, the guest OS shows CPU relative to the actual amount of CPU allocated at the time, not to the CPU it thinks it might have.

Have you checked in vSphere what the actual CPU usage is?

It's very possible that your jawa process is consuming 50% of whatever CPU the guest was allocated, but that amount could be way less than the reserved CPU.

One of our SEPMs has, for instance, a process that keeps running at 90% for 10 seconds, then ~0% for 10 seconds, then 90%.. etc...
But when we look at the actual CPU usage, VMWare confirms us that the cpu usage was really constant all the time.

See http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2032 for more info

That may be true, but when you are at the server console, and the mouse is jerky and slow, and apps are very slow to run, it's it's simply nearly impossible to get anything at all done, and you stop the SEPMSVC and/or stop the JAVAW process and things speed right back up.............. well.
AND, this didn't happen BEFORE RU6a................... the servers were fast, stable, and CPU usage looked normal.
Our VMWare console AND the Windows OS task pane both agree about processor use - it's spiking pretty bad at times.

I'm with andgri - this is an issue.
We have pretty much the same configuration.
RU6a either doesn't like Server 2008 R2 (which is ONLY available 64bit!) or VMWare or both, or, it's simply got some resource issues.

1.  If you logon to your server, go to services, restart the SEPM service, then check the javaw process, does it take 50% cpu immediately?
2.  How many people in your organization have access to the SEPM?
3.  Are you utilizing the SEPM web console or are you using the SPC with SEP or any other Symantec products?

When i restart the SEPM service the Javaw process comes back straight away. At times there could be 2 of them running which uses 100% CPU usage and makes the sever dead slow! Kill off this process and everything goes back to normal for a bit (until it starts up again).
There is currently only 1 other person with access to the SEPM
I use the SEPM web console - we are not using SPC.

It seems that ShadowsPapa and i are having the exact same issues with very similar config. I agree with his comments that it doesn't like Server 2008 R2 x64, VMware or both!

Logging a call with Symantec Technicial Support to try and resolve this issue. Still causing us grief on our server.

- Find out which accout using  javaw.exe ( 50%)  in Task manager.
- Add that account in Local Admin Group on that machine.
- Configure correct proxy detail in SEPM. Put Local Admin in SEPM Proxy settings instead of any service account.
- Configure Proxy detail for Java in Control Panel.
 - Reboot machine.

-Service account created in Active directory.

- Javaw.exe was using service account and taking 50% CPU.

- Stopped SEPM, database and SEP client service and same issue after stopping all service. Javaw.exe still causing 50% CPU after stopping all symantec process.

-Can't kill javaw.exe process and it was keep comming back once again.

-Did right click on javaw.exe and open File path it was running from C:\Program Files\Symantec\Symantec Endpoint Protection Manager\jdk\bin location.

-Ran Process Explorer on that machine and found following for javaw.exe in command line

"E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\..\jdk\bin\javaw.exe" -cp "E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\webapps\scm\WEB-INF\lib\scm-server.jar;E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\webapps\scm\WEB-INF\lib\scm-common.jar;E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\webapps\scm\clientpkg\ext\mail.jar;E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\webapps\scm\WEB-INF\lib\jslic.jar;E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\common\lib\jtds.jar" "-Dcatalina.home=E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat" "-Djava.library.path=E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\bin;E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\webapps\scm\WEB-INF\lib;E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\webapps\scm\clientpkg\ext" com.sygate.scm.server.util.DownloadFile "E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat" http://securityresponse.symantec.com/avcenter/venc/auto/index/indexI.html "E:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\temp\indexI.html"

We have two SEPM servers running 2008 Server R2 on VM and we have similar issues with both of these processes. Our biggest issue has to do with memory allocation. It seems that both of these services have a leak as they just continue to consume more and more memory and never drop unless the services are bounced or the server reboots.

We are running RU6a

???

How can a user account be a proxy setting?

These are standard installs, so will use the standard service account.

JAVA is really a pig for resources, it leaks. Everything that uses JAVA ends up messing up our servers. We actually removed a huge Cisco application because it launched so many instances of this same service, it literally crashed servers.
javaw is buggy, to say the least. Too bad so many seem to rely on it.

Just in case you guys weren't aware, with RU6 they added an ajax web console that utilizes a separate java virtual machine.  So they essentially doubled the amount of memory usage that java uses.  The two jvm's run as:
 
java.exe (web console)
javaw.exe (sepm console)

The amount of resources that these processes use depends on the heap size that you have set.  The heap size for the main console on the server, (javaw) is set in the parameters key for the semsrv service within the registry.  By default, the heap size values are usually 64MB min, 256MB max.  If you increased these at some point, then your javaw process could take a 1GB of memory or more.  In addition, when you upgraded to RU6 from RU5, it took the heap size values you had for javaw and applied them to the web console's jvm parameters.  So if you were using a max heap of 1GB with RU5, now you'll have two processes with a max heap of 1GB. 

The heap size values for the web console's jvm are set in a separate location within this file: 
\tomcat\webapps\ajaxswing\WEB-INF\ajaxswing\bin\setEnv.bat

Furthermore, each instance of the web console uses its own jvm.  So if you have 5 people on separate systems all using the web console with a 1GB max heap size, that's 5 separate java.exe processes that could potentially all take 1GB of ram.  If you don't want this to happen, then you need to not utilize the web console and instead use the java remote console.  This will utilize resources on the local box in order to create the jvm.  I hope this information has been helpful for some of you. 

We have now resolved this issue after a few weeks with Symantec Support.
We were required to create a local Admin account on the server , and modify the Proxy Server in the SEPM console to use this new account. We were using a Domain account which had local Admin rights, but for some reason SEP did not like it.
The following doucment talked about this issue, but the solution is not that great (we were using an account with local admin rights already).
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009102716190348

I hope that this may help other people with a similar problem.