Endpoint Protection

Hi Team,

I have been working on win server 2003 it is a file server and found that "system" process taking high CPU usage for some particular time and gets normal and then again gain high CPU usage.

During CPU usage if i disable SEP then server becomes normal immediately.

please provide me with permanent solution and cause for it.

SEP: 12.1.4112.4156

SEPM:12.1.4104.4130

please let me no for more infomation.

Is it constant or intermittent? Does it happen only during content downloads? Is a quick scan running when new virus definitions are loaded?

How to turn off Active Scan when new definitions arrive

We are having a similiar issue but not exactly the same. in our environment it was High I/O and the fix: 3292642 in RU5 seems to fix it. so just go ahead and try upgrading your SEP client alone to RU5 or above. your older version of SEPM can support higher version of SEP client. 

New features and fixes in Endpoint Protection 12.1.5 (RU5)

Please do not reply to my post, I'm not the OP. Thank you.

Hello Brain,

It is not constant, as it is intermittent so it is very difficult to say when it can occur, is there any way that we can identify its occurance.

There is no active scan running when new definition arrive

is there any tool in symantec where we can find the cause of high CPU usage or to identify which process/file symantec is taking large amout of time?

also please let me know where there is high CPU usage running what are the possible things need to be checked during runtime.

please help me out for possible solutions

You can use a tool like process explorer and process monitor to see what activity is taking place. You would need to run these during the time of high CPU.

As i login to server it shows that 100% CPU usage and i checked in TASK manager and observer that in Processes tab "SYSTEM" taking more den 90% 

During high CPU if i stop and start symantec, the CPU usage automatically comes to normal.

can anybody explain me about SYSTEM process. what it do?

How it is linked with symantec?

Thanking in Advance. :) 

The System process is a kernel mode process which runs system threads (the kernel and loaded device drivers) taking care of network i/o and/or disk i/o, et al.

Cause(s):

1.  3rd party applications such as:

A. Antivirus on the remote machines keeps on scanning the server.

B. Firewall programs.

2. Issues with network interface card (NIC) drivers/firmware. 

3. Scripts and batch files that place excessive load on the server, possibly run from the remote machines.

4. Windows Security Auditing configured aggressively as to Audit, in particular audits on success.

okay i got you.

so what would be the solution for this when "SYSTEM" process taking high CPU usage.

how this issue can be resolved?

Hi,

I would recommend to upgrade SEP client.

There are some fixes in the later releases.

High CPU usage of ccSvcHst.exe

Fix ID: 3461676

Symptom: ccSvcHst.exe may experience high CPU usage when File System Auto-Protect scans some files.

Solution: Optimized performance of the Auto-Protect kernel driver (srtsp.sys).

Reference: New features and fixes in Endpoint Protection 12.1.5 (RU5)

• http://www.symantec.com/docs/TECH224706

SEP 12.1 RU6 MP1 is the latest release.