Endpoint Protection Small Business Edition

Our file server is a VM on Hyper-V and it also hosts Endpoint Protection Small Business Edition 12.1.4013.4013. Over the last 4 weeks, we've had 2-3 times where the CPU gets pegged at 100%, mostly with the SYSTEM process being the main culpret. It was so bad, no one could do anything and it took forever to gracefully shut the VM down.

It came back this week, though hovering between 25 and 75% CPU. I contected Dell and they connected to my Host and the VM and confirmed my findings that there were no alerts in the logs. However, two times, we did see a scan kick off of SEP and it was scanning the large VDISK for the file server. I disabled the client on the file server (again, the host for SEP as well) and CPU has stayed in acceptable range.

So, my questions are:

What would cause SEP to start doing this, when it has ran just fine over the year we've had this Hyper-V set up?

Should I offload SEP to another server (VM)?

Is there an update I should apply to see if it stops this problem?

Any exclusions I should be aware of?

Any other tips?

I cannot afford another business hours reboot.

Thanks...

Is a scan kicking off when the client receives new file definitions? Check the system log for this.

A guide on exceptions is here:

Recommended exceptions for Endpoint Protection on hyper-v

You are running an older version. 12.1.5 is the latest:

Upgrade or migrate to Symantec Endpoint Protection 12.1.5

Good stuff...I have an update Window next weekend and will look over and apply the exceptions and also update to 12.1.5.

Also, are you running only the AV component?

Hi,

Thank you for posting in Symantec community.

In the latest version of SEP following fix note is available, cross verify whether you are facing the same issue?

High CPU usage of ccSvcHst.exe

Fix ID: 3461676

Symptom: ccSvcHst.exe may experience high CPU usage when File System Auto-Protect scans some files.

Solution: Optimized performance of the Auto-Protect kernel driver (srtsp.sys).

This is interesting to know it has run just fine over the year, so I believe configuration part shouldn't be a concern.

However cross verify necessary steps are followed by refering above shared article. (http://www.symantec.com/docs/TECH133846 )

For give the ignornance of my question but how can I tell? I think it is running the full compenent that the client provides.

If you open the GUI all three components should show up.

Ah gotcha...only one component...VIRUS AND SPYWARE PROTECTION.

Question...when I enter my serial number to download the update, it says...The Serial Number was not found.

I am on the SMALL BUSINESS version...does that matter?

It shouldn't. It just needs a serial associated with your account. You can contact support and they will generate a new one for you.

SEP 12.1 Small Business Edition uses Hard Enforcement.

If license is expired Content update downloads stop for both server and clients.In Small Business Edition it's 1:1 mapping with CAT server.

License has expired? If license is valid and systems isn't accepting it then call license department to look inot this issue.

Customer support assistance: http://www.symantec.com/support/assistance_care.jsp