Endpoint Protection

Hello all,

Just upgraded to the latest SEPP release (MR4MP2) and noticed my own laptop was running slow.
It appears the SMC service takes 50% of cpu all the time (Sygate Firewall Service).
After some trying and testing I came to the conclusion this only happens when running on the VPN to our office.
When I closed the VPN the cpu usage dropped to 6 - 7 %

Anybody seen this and knows a resolution or are we back at MR1MP1 level again?

Arno

Hi,

I have the same problem on computers but there isn't vpn software installed. always smc.exe consuming 50% of cpu.
 I've upgraded the computer from MR3 to MR4 and after to MR4 MP2. The computer don't reports status to manager. the only solution is cleanup installation of MR4 MP2 and install other version (for me the MR3).

Which VPN client are you using?

I've seen some issues with older Checkpoint Secure Client versions. Upgrading the VPN client solved the issue.

BR,
Tuomas

Two years in the product, and noting but trouble and trouble.
I have to admit I always keep my breath when selling this stuff.

For the problem:
Just native Windows Vista PPTP VPN.
Nothing special. Just my CPU fan is making overtime, to keep things cool.

I guess I will have to roll-back to MR3 as well, since this was at least a stable release for me.

You guys should open cases with Symantec. This way if there is high cpu issue with the MR4 MP2 build , develpoment becomes aware and can work on finding a resolution that may help a lot of customers like you.

Thomas

Yeah,
Have you tried that when not being a silver or platinum partner?

Oke,

It took me two hours, but I have a case open at tech support.
I will post back the result as soon as anything usefull comes up.

ObieOne,

How is your Symantec case progressing? Do you have anything helpful that you can post here?

Cheers,
Thomas

Hi,

Symantec is currently investigating on it. There is already a precise guideline for the Technical Support Engineers to quickly collect what the other teams need to address this issue.

Thank for your cooperation,

I am currently still under investigation with Symantec.
We have narrowed it down a very little, but there is no solution or workaround yet.
I have considered rolling back to MR3, but then we have to downgrade the management server and other clients as well, which is not easy to do.

This issue appears only when the VPN is connected. When you close the VPN, it drops again.
The CPU usage stays normal, until Symantec wants to 'talk' to the management server.
As soon as the clients connect to the management server, the cpu goes up to 50% (e.g. when you ask for 'update policy')
Disabling the Symantec client, does not help.
Only by closing the VPN or stopping the SMC service, this can be resolved.
I have installed a new client package without the firewall, with no result.
The issue does not show on the management server, or on the RRAS server, which both also have SEPP installed.
This meaning, the issue is in the Symantec Management Client itself, or at least I think.

I am currently trying to get some log files and a crash dump to their tech support, but I have some trouble creating them.
I'll keep you posted, when I know more.

Arno

Thanks Obie for being patient on this issue. It would be nice if you could post the case number for this issue. I am currently trying to help a customer with a similar issue (he is connecting using Cisco VPN). I am curious if you would hit the same high cpu usage when you use Cisco vs the standard Windows Vista? I asked him to try the Vista and have not heard back yet. I will post back with some specifics on his case once I know them because I feel the more information the better : ) If you have any specific questions or want more help in creating the crash dump let me know and I will be happy to help. Sorry that this has become and issue.

Grant-

Hi Grant,
I don't know if we are allowed to provide the case number, but I am currently working with Micah Magpale from Technical Supoort to get this sorted. Maybe you can ask him?

You are allowed to post it if you wish, but if you feel more comfortable you can PM me. You don't have to at all, it just makes it easier for me to see exactly what the information being passed between you and support is. It also makes it easier for me to escalate issues or check on the current status when I have the case number. Symantec is such a huge company that this is usually the fastest/most efficient route. This is just an issue that I am interested in because I have seen it crop up quite a few times lately and I have not been able to offer much assistance. So I am very curious as to the outcome.

Cheers
Grant

I will continue this topic here:
https://www-secure.symantec.com/connect/forums/smcexe-using-50-or-more-processor-while-vpned-office

It is the same problem and it is more easy to keep track in one place.

have you verified the configuration of ip adress and gateway is in the same Vlan's ? Because i have the same problem on workstation's what have an ip adress different of gateway vlan's....