Endpoint Protection

I just set up a test environment with three machines that run SEP manager and SEP clients.  The SEP Manager machine is running very slow.  The reason for this is that the LUCOMS~1.exe process is taking up 60-90% of the CPU continually.  Whatever it is not using up the LuCallbackProxy.exe does. 

I have looked at the LiveUpdate session status and it seems to be looking for updates, finding everything is up-to-date, and then restarting the same update process over again and again.  Since I came in today it has been going on for a hour.

I have set LiveUpdate to run daily instead of every four hours and it hasn't seemed to discourage it from constantly looking for these updates.

Any ideas about what I can do to get some control over this update process?  Thanks.

You might want to check this http://www.computing.net/answers/windows-xp/lucoms1exe-is-a-problem/169171.html

I found that after the last Patch Tuesday, June 9, LOTS of machines (all servers, AFAIK, WS2003 & WS2008 x64) that I support have had high CPU utilization (among other symptoms), and SEPM machines in particular have high CPU from LiveUpdate processes that sound like what you're describing. Restarting them twice after the patch restart has solved it in every case. I don't know which patch it was, but I'm convinced it was one of them.

In fact, in one case, I had to do a System State restore today, and I happened to choose the backup made after the 1st restart after Patch Tuesday. The server suddenly had the same symptoms again, including LU utilization. A reboot fixed it.

If your machine has the latest MS patches and has been running since Patch Tuesday, you might give that a try. I'd be interested in knowing if it worked, so please post back.

I had to reboot three times, but after that the constant overwhelming of the processor by LUCOMS~1.exe stopped.  Now every twenty minutes the LUCOMS~1.exe and LuCallbackProxy.exe will run, but only for about 30 seconds and then they disappear when they finish their business.  Much better now.

Thanks for the idea.   I never would have though to reboot more than once after a software install.

Is it regular to have the LUCOMS~1.exe and LuCallbackProxy.exe processes use a high amount of CPU when they're active? We've been running our SEPM server in VMWare for 6 months now, and whenever we do an audit of what servers use the most CPU, Symantec is always up there at the top. Whenever SEPM goes to Symantec to check for updates (I am assuming that's what LUCOMS/LuCallBackProxy are doing?), the CPU spikes. This occurs every 15 mins.
I hesitate to call it a problem, but I find it a little odd that our most CPU hungry server in the environment is SEPM, especially when we have SQL servers, Sharepoint servers, and virtual workstations for code testing also in the virtual environment.

I've attached an image to show you what I mean. You can see in the single-day graph that Symantec has regular spikes in activity. And if you zoom in on the spikes, you can see that our SEPM server is eating up the equivalent of 3GHZ of CPU for a couple minutes as LUCOMS/LuCallBackProxy are doing their things.
The virtual server that SEPM is running on a single virtual CPU, with 3GB of assigned RAM. We have approximately 150 clients locally to manage. Additionally we have a replication partner that manages 30 or so other PC's on the other side of the globe.
Several months ago I tried assigning the local SEPM server another CPU, but that made little to no difference.

Again, this isn't a problem per se, but I'd be interested in hearing some feedback about the two processes eat CPU cycles like delicious candy.

Note that the drop in CPU usage in the day-graph is me updating Windows, and restarting the server twice as per this thread suggested, just to see if that had any effect. (it didn't)

I agree; I've noticed LU does seem to suck a lot of CPU cycles for some reason. But the problem the OP and I had was constant 100% CPU utilization with LU processes accounting for a good 2/3 of it. Not spikes every 15 minutes. Even terminating the LU processes, others would take their place and utilization would remain pegged. But while they were running, LU would take the lion's share. After the reboot(s), it would go back to normal...subjectively, pretty much what you posted, though I've never measured it.

Since I "solved" the constant CPU spike with those reboots my SEPM server has gone through a cycle where the CPU spikes once every 20 minutes or so for a 1-2 minute period and then it calms down again.  During those spikes the CPU utilization is still between  70-90%.

@SMRT, Thanks....Nice writeup....

What version are you running?