I have just recently purchased and installed Symantec Endpoint Protection for Small Business Server - version 12.0.1001.95 and have had early problems with huge memory leaks. My first install was a few weeks ago and after I had been running for less than 24 hours I started receiving emails indicating I had low memory. I looked and found that dbsrv9.exe was using more than 500 mb of ram (and I only had 1G of ram installed.)  I called support and they said I needed more than 1G so I changed to 4G and just reinstalled it all. I'm still seeing dbsrv9.exe taking 364mb of ram, SemSvc taking 129MB of ram and clamd taking 100 mb of ram. I only have 3 clients and nothing else is currently running on my Windows 2003 Server (SP2) 32-bit server.

I'm paying a lot more for a virus scanner than I'd like to (or that I can really afford - I'm just a very small 1-man company) so I was hoping that I could count on Symantec to sell me a decent product. I don't think this is going to work for me. I've perused the internet and these forums and it seems that this problem was around last year and there were a lot of posts but I never saw any solutions. There was some mention of a knowldegebase article for performance tweaking but nothing from symantec.

Is this what I should expect to get from Symantec?

Is there ANYTHING else out there for doing virus scanning on a server machine that works?

I cannot afford to waste any money in trying to get a small business going here. We use Symantec at my day job and it seems to work but maybe they run a single server just for Symantec. Seems like a waste but is that what it takes?

Thanks,

Bob

yes you are right, we shall work on the memory issue of SEPM however before that, there are few things we need to take into consideration.

You are having only 3 clients, first thing is you dont need  a Symantec endpoint manager in the first place. SEPM usually takes lot of memory and space, this was designed to support huge clients.You can remove SEPM and install all the three clients as unmanaged, set a virus scan schedule and set liveupdate to run automatically. this will not without any issues. You dont need to waste any more money, check this document to install clients as unmanaged or set the cpu usage to use less cpu as per this document. 

Installing unmanaged client software using the installation CD

http://www.symantec.com/business/support/index?page=content&id=HOWTO11090

P.S: installing from CD is same as from your download from website packages.its one and the same.

I agree with what Rafeeq has to say. There are a lot of features bundled with Symantec endpoint and its not necessary that you need to use all of them. They are designed to cater different needs. The fact that SEPM has the capacity to manage the clients centrally clearly depicts that it requires a good hardware configuration. The process consuming memory mentioned by you are for SEP, however its not necessary that they are the one doing it, by this i mean that if any or all of these processes are in a svchost which has multiple processes running we need to eliminate it first, because its possible that there may be a conflict with the other process running in the same svchost. Therefore identify the PID number of the concerned process and then with the Process monitor check whether they are the only single process running or are they embedded in the svchost.

dbserv9 is the database service and is unrelated to virus protection.  What is clamd?  That sounds like a third party anti-virus, Clam AV.  Is the SEP client installed?  Do you see RTVscan running?

For clarification, SEPM is the management console for SEP 11.  SPC is the management console for SEP 12 Small Business.  The terms are sometimes used interchangeably and the two consoles perform similar functions, but are not the same thing.

sandra