smc.exe using 99% of cpu

Are you using any Nortel VPN client software on these systems?

Thomas

Is this happening on all of your Win2k clients? Are you running any disk encryption or other VPN client software?
Can you PM me your exported msinfo32 file?

Thanks,
Thomas

Do you use Win2k as a terminal server?

I have seem similar thing to this on a few random XP clients.  Most of the ones reported to me have been desktops so they have no encryption software and no VPM software installed.

One machine hasnt reported it again since I made sure it was fully patched and a full defrag was run on the machine.

Can you enable debugging on the client? Do this for SMC and Rtvscan.

http://service1.symantec.com/SUPPORT/ent-security....

Please upload the logs to the fileshare account for analysis.

Thomas

Can provide us with the SP installed on the Win2k Machine? I belive it should be service pack 4.

Also along with the logs that Thomas requested could you post the hardware specs for this client. Namely the amount of RAM and what CPU? Also just to be clear are you seeing a fluctuation int he CPU spikes or does it stay at a constant 99%?

Grant-

Grant,  His system meets the minimum requirements I have the msinfo32. I will PM you.

Is this happening to all clients?

Same situation here, smc usage 100% when connecting with Cisco VPN client, case opened
After closing VPN connections sms is back to normal 0-2%
Regards
Jan

Did this issue start after an upgrade? If so, what version was running on the Win2k client before?

Thanks,
Thomas

Yes the issue started after upgrading the client to MR4 MP2. It was previously running on 11.0.4000.2295 and then was upgraded to 11.0.4202.75

Hi do you have the NTP component?

@ ashx, I see that your case was resolved by installing the previous version. Can we mark this thread as solved?

Thomas

I have the same issue on some of my Win200 Pro SP4 clients after upgrading them to MR4MP2.  SMC spikes to a constant 99% and they lose communication with the SEP server.  I have a case open with support on this (320-201-760 if anyone wants to reference it).

@ ch1221 2, I posted a comment to the owner of your case noting the workaround is to install previous Agent version on the Win2k system.

Thomas

Reverting the client to a previous version may be a workaround but it's not a solution.  I have other clients that need the fixes from MP2 so applying the update package to the group also updates these Win2000 systems with the issues.  This is causing my rollout of MP2 to be delayed now.
Symantec needs to find the root cause and fix it rather than tell customers to revert back to an old version.  That's not an acceptable answer.

I agree with ch1221 2, it was a workaround for me so that I had a usable machine again but was not a solution to the problem.

I too have this SMC.exe 99% CPU usage. I would gladly install aprevious agent, but how/where do I get it?

Hi ashx and UBI I guess you need to open a case with Symantec Support.  Btw is the 99% cpu on idle?

It's 100% of the time, idle or otherwise. Rarely dips below 90% and is 99% most of the time.

I found my old discs, so I created an install package from that. I'll see if it works.

What is the service pack of windows?

SMC.exe goes to 99% CPU when the network interface cannot be automatically restarted after installation, so the setup of SEC remains incomplete (hence my commnication issues). It's trying to apply policies and it can't because the inteface hasn't restarted properly. Restarting the network interface dropped SMC.exe back down to normal operating tolerances (0-5% cpu) on all 4 of the PC's I was having issues with, let the install complete, and allowed the clients to communicate properly back with the server.

Hope this helps out everyone in this thread.

Also, all the PC's I was having trouble with had static IP's.  I dont' know if this is related or not.

Out of about 50 computers & servers, I am having this issue with so far 1 WXP Pro computer across the WAN from the parent server, which happens to be the only computer across the WAN that has been joined to the domain (FWIW).  Version of SEP is 11.0.4202.75.  Previous SAV was 10.1.5.5000.

@UBIFCU
But then wouldn't you think a reboot would solve the problem because a reboot in essence is a restart of the network interface?
My smc.exe 100% CPU problem persists despite rebooting, but I will reinstall and try your restart-the-network-interface suggestion.

The problem persisted for me even through reboots. The only reseaonable explanation for htat would be that since the network interface isnt' up when the computer starts, SEP doesn't try continuing it's install until it detects network, then starts calling for the restart again, then right back to 99% CPU.

Hi UBI, please post SEP inst.Log

Well I tested intstalling SEP 11 client, then disabling/enabled the Local Area Network (first by disabling/enabling the network device in the device manager, then later by right clicking on Local Area Network). 

Still my smc.exe is consuming all remaining CPU resources.

(Sorry, I don't wish to hijack the thread.)

Is there a way to get the policies and "drop" them into a folder on the client, in order to trick the client into thinking it got the policies all by itself? 

Maybe if I can do this once, it will do it succefully when it attempts it on its own next time....long shot I  know.  I'm willing to try anything right now.

Hi we have had this same problem on a few of our test computers high cpu usage due to smc.exe I can not pin it down exactly what the problem is, but in our situation the laptops in question had wirless cards installed and they we trying to connect to a unsecure local wireless network while connected to our lan. They were sending packets but getting no response. I dropped the wirless connecting and everything settled down. I have also seen the same problem when a computer has two network cards Endpoint tries to communicate with the wrong card.
We have 80 computers on test at the moment of which 15 had similar problems (Hope the remaining 1500 do not have similar problems)

Is the NTP component installed?

Hi

We do not NTP installed we have antivirus/spyware only
We have now also had the same problem with Vista business sp1 wireless network and Windows VPN when the VPN is brought up the smc maxs out If you drop the VPN everything goes back to normal. Logging on to our Lan via RJ45 the laptop comunicates with the console and everything is fine

This could be a hardware issue please log a case to Symantec Support.

We have a domain controller/server and the SMC.exe cpu usage hits 60-80%, we have just upgraded our memory, but the same problem exists. SEP version MR3, our symantec nominated local support advised us to use the package for Vista  even though the server is a running  2003 server. is this a valid solution?

It appears that the clients that are having the issue for me are on a different vlan than the gateway is and 11MR4 MP2 client has problems with this. Also for machines that are dual core the smc.exe will only be using 50% where as single core will use 99%.

Hi,

who is facing that smc.exe uses about 100% of the CPU after the migration to MR4 MP2 and does not have this issue when he downgrades to a previous release, should open a case with the technical support to collect all the required logs to continue this investigation.

Thanks,

Im using 11.0.4202.75 and its just happened on one of our Windows XP machines

I uninstalled from SAV 10 then installed directly to this version

Im trying to uninstall now and reinstall

In my case - the computer in question moved from one ip address to another (different locations)

We also encountered the same issue on Win2k pro, any update from Symantec?

Are your win2k clients on SP4? does this happen when you use VPN?

I had same issue in the past, it was due to wrogn default gateway sitting, once changed to correct gateway setting, issue went away and smc.exe running "0" percent of CPU. I would suggest you to do the following troubleshooting to determine the cause of the issue. 1. Remove the client from Add/Remove programs (better use the clean wipe tool) and reboot the machine, 2. install a unmanged package of the client. 3. reboot the system and check smc.exe started to run high percentage of CPU. if the issue stil exist, check whether you have any VPN software that could possibly cause the issue, if the isseu no longer happened, drop the managed group sylink.xml on the client and you should see the issue return right after that, check your network setting, especially the gatewaysettings.

It's on SP4, no we are not using any VPN client.

@Jerry

Is NTP (Network Threat Protection) Installed? Please install AV and AS only, create a separate package for it.

They need NTP, so it is installed. Is there any other solution. 

Hi Jerry, if you are behind a corporate firewall then there's no need for NTP. Try to do a repair of the SEP installation on the control panel, add/remove programs.

Paul,
    They need NTP feature eventhough there's a corporate Firewall. You cannot just ask the client to not just install NTP because of that issue. I mean Symantec should look at this issue...
 

Symantec is aware of this issue:
http://service1.symantec.com/SUPPORT/ent-security....

We read these discussions, as you can see the short term workarounds are the ones that the customers already found out and reported in this forum.

I suggest you to follow this related discussion as well:
https://www-secure.symantec.com/connect/forums/smc...

One more here with the same problem.

In our case, it's a Windows XP machine, no VPN client installed. The problem appeared just after migrating from MR4 to MR4 MP2.
Besides the high CPU usage, the communication with SEPM seems to be normal.

A little comment:, maybe useful: using Process Explorer (Sysinternals tool) to list the details of the smc.exe process, I saw that the file MSVCR80.dll is who is consuming all this CPU

After upgraded to 4202 I had two clients experience the SMC.EXE using 50% of CPU cycles. One was a desktop, no VPN and the other was a laptop. both XP pro. How can we identify devices that this problem may occur on?

I think it's already mentioned in this thread... In my case, having the wrong gateway (ipconfig) will cause smc to use 99% of the CPU.

IP: 192.168.1.12
mask: 255.255.255.0
gateway: 192.168.2.1

Gateway should be 192.168.1.1 (unless it really is 192.168.2.1) Even though you may be able to access network resources with the wrong gateway, SEP doesn't like it.

Hi all,

SEP 11 RU5 was released a couple of days ago, did someone already test it regarding the issue of the smc.exe process?

Regards,

I have tested SEP11 RU5 on most of the clients that were having the issue for me and it has been successful thus far.

hi i faced same problem with MR4 MP2
SMC.exe is taking 99% of CPU usage. then i loged a call with symantec. they told me to upgrade MR5

now in mr5 every thing is working fine. the cpu utilization comes to normal. 

Please see note below on how stop SMC service on a desktop if its going through the roof

• Open regedit
• HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SYMANTEC ENDPOINT PROTECTION\SMC\smc_exit_test 1 to 0

Then from the Symantec installed DIR etc c:\program files\symantec\symantec endpoint protection\

Then run.

• SMC –STOP

Then run an upgrade.
after installation run

SMC -start

Then all done !!!

Enjoy.