Video Screencast Help

Systems locking up or extremely show until hard shutdown

Created: 24 Sep 2012 | 17 comments

I have several users that are experiencing an issue with their systems that I believe I have narrowed it down to SEP.  

Dell Desktops and Laptops with Seagate Self Encrypting Drives (SED) either 250gb or 320gb.  All of the issues, seem to occur with the 320gb drives.  I originally thought a bad batch of drives, but the group is very random on when the Dell's were ordered.  The users will experience a severe slow down and the hard drive light is constantly on, but when looking at the process utilization, there is none.  I have disabled the encryption, and tested, and the issue still occurs.  Sometimes a rebuild from scratch will resolve, but it usually re-occurs.  The issue is temporarily resolved after a hard shut down and restart, but only for about a week or so.

Any suggestions at all??  Thank you in advance!!!

Comments 17 CommentsJump to latest comment

_Brian's picture

What version of SEP?

Also, what components do you have installed?

Similar thread with some different suggestions:

https://www-secure.symantec.com/connect/forums/sep...

I would start by disabling Insight Lookup and see what the result is.

How the Insight Lookup process works

http://www.symantec.com/business/support/index?pag...

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

griam01's picture

We are running: 12.1.671.4971

 

We have the following components:

Virus and Spyware Protection

Proactive Threat Protection

Network Threat Protection
 

_Brian's picture

Also, that is first version of SEP 12.1. Latest is 12.1 RU1 MP1. Are you able to upgrade one client as a test?

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

oykunsatis's picture

Hello,

As Brian asked, the version and the modules of SEP are so important. At least 12.1 versions must be for better performance. And it's better to start troubleshooting from installing modules one by one. I think only AV module can solve your problem.

 

Regards,

Oykun

_Brian's picture

See what happens if you disable NTP.

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

Ashish-Sharma's picture

This is a shot in the dark, but try disabling Insight lookups for a test and see if this has any impact on performance.

How does Insight Lookup work? - http://www.symantec.com/business/support/index?page=content&id=TECH169282

Thanks In Advance

Ashish Sharma

 

 

griam01's picture

I am testing with disabling Insight Lookups and see if there is a difference on the clients.  Thank you, I will report back what I find.

Vikram Kumar-SAV to SEP's picture

I would suggest check from Seagate if they have have any Recommendation on Antivirus Exclusion of their Software, Encryption software does slow down you machine is a bit, I would also suggest taking it up with Seagate once.

 

Vikram Kumar

Symantec Consultant

The most helpful part of entire Symantec connect is the Search button..do use it.

griam01's picture

Disabling Insight Lookups does not seem to have solved the issue.  Once of the users reported that his system exhibited the issue Monday morning.

Vikram, I am not sure I understand what you mean contact Seagate.  They are the manufacturer of the hard drive, there is no seagate software running.  Do you mean Wave encryption?  If so, this is hardware based encyrption, not software based encryption.  The software based encryption can cause slow system performance, but the hardware based does not due to how it works.

I will play with the NTP settings some more and see what I come up with it.  Any other suggestions???  Thanks for all your help thus far.

 

Ashish-Sharma's picture

HI,

Could you please let us know what Process is taking the highest CPU & memory usage and how much?

Better you can stop Active scan on startup...for better performance.

Go to SEPM-->Policy-->Virus and spyware policy-->edit the scan policy and disable the active scan on windows start up.

  

Check these articles for more info.

https://www-secure.symantec.com/connect/forums/rtvscanexe-scaning-all-cusersxxxntuserdat-endlessly

https://www-secure.symantec.com/connect/forums/how-stop-scanning-ntuserdat

 

 

Thanks In Advance

Ashish Sharma

 

 

griam01's picture

There is no process taking up any utilization during this time.  Everything is normal.  But the hard drive is pegged, the light is on continually.  Anything you try to click or do, is extremely slow.  These systems are developer  machines, core i7, 16GB of RAM, they should not have an issue running.  Even if we close all programs running, the system is extremely slow.  If the users reboots, it is slow to come up, slow to login, still completely slow, until a hard shut down is performed.

Ashish-Sharma's picture

HI,

Try to disabled SEP and checked ?

Thanks In Advance

Ashish Sharma

 

 

griam01's picture

Yes, we tested this with one machine and the user didn't have the issue.

 

The problem with this is that the issue does not happen daily.  It usually takes a few days to a week to occur.  I hate to leave a system unprotected for that long.

Ashish-Sharma's picture

HI,

Have you check when system running slow any scanning progress are running or not ?

Thanks In Advance

Ashish Sharma

 

 

Ashish-Sharma's picture

Try setting the scheduled scan for a different time during the day.  If the machines are never shut off, schedule the scan for in the evening or early morning.  If the machines are shut off at night and on weekends you could try setting the scan time for when the least amount of people would notice it, like when most people are on lunch. 

Or

  1. Open the SEP window
  2. Go to Scan for threats tab
  3. Edit  your scheduled scan
  4. Go to advanced scan options
  5. Go to tuning options
  6. In scan tuning options,either choose Best Application Performance or Balanced Performance.Test each configuration and choose what suits you best.
  7. You could also consider scanning up to a maximum of 3 compression levels.

Check this thread Also

https://www-secure.symantec.com/connect/forums/scanning-1

Thanks In Advance

Ashish Sharma

 

 

griam01's picture

We have checked and there are no scans running during the times that this is occuring.  I am currently trying disabling heuristic scanning and see if that changes anything.  Our scheduled scans only occur on Saturdays at 12:30am.