Endpoint Protection

 View Only
Expand all | Collapse all

SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

MichelZ

MichelZMay 17, 2017 11:50 AM

  • 1.  SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Dec 26, 2016 03:56 PM

    Hi,

    If the issue I am about to report is discussed elsewhere a link would be appreciated and my apologies.

    I have ver 14 installed on 5 different managed client machines here at my home for testing before rolling it out to our work machines (all running 12.1.6 MP6).  What I am seeing is from time to time (might be days) the process ccSvcHst.exe (user System) will start consistently consuming 15% – 25% of cpu cycles and remain at this number indefinitely.  This occurs even when a scan is NOT running.  I first noticed this on a Win 7 machine several weeks ago.  I walked by the machine and noticed the fans were running faster than normal. Memory usage was well over 100,000 K.  I have seen it as high 290,000 K.  I have a Win 7 machine right now that is using 13% CPU and was using 288,000 K of memory.  Memory usage is now over 291,000 K and is slowly growing.  The machine has remained in this state for several hours and I will reboot shortly.  This morning I had 2 Win 10 Pro Ver 1607 machines consuming 25% CPU and 120,000 K of memory. In all cases no scan was running.  I rebooted both and the issue resolved.  The only solution appears to be a reboot and then things settle down.  I have seen this issue on w10 and w7. It has occurred on normal client installs and dark installs,  None of the machines are running Application and Device control and they receive updates directly from the Symantec Live Update server (not the internal management server).

    Has anyone run into this issue yet?  I thought I would start here before possibly reaching out to support.

    Thanks,

    CQ



  • 2.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Dec 26, 2016 04:05 PM
    Does it happen when content is updating? Can you correlate times from the System log?


  • 3.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Dec 26, 2016 10:35 PM

    It is difficult to know when the problem begins.  Many days can go by with no issues.  Live update runs hourly on all the machines and logs clearly show  content updates with no effect on ccSvcHst.exe.  I have also looked at scan logs and have not been able to establish a causal relationship to the issue.  A few hours ago when I rebooted the machine mentioned in my original post, memory usage had ballooned to over 300,000 K. for ccSvcHst.exe.



  • 4.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Dec 26, 2016 10:37 PM

    Probably best to work with support so they can get some debug logs. I assume it was fine with 12.1? Same OS across all machines?



  • 5.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Dec 27, 2016 08:53 AM

    Also, have you run the SymDiag tool to see if there are any issues with the client(s)?



  • 6.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Dec 27, 2016 10:55 AM

    The problem has occurred both on machines with Win 7 and Win 10.  The SymDiag tool showed no significant issues.  I was using a Win 10 laptop  this morning and I noticed the fan noise increase.  I immediately ran task manager and could see the noted issue with ccSvcHst.exe.  I checked scan logs and live update logs to see if either had just run with negative results.  I am puzzled why no one else has reported this on the forums.  I never noticed this issue with 12.1.6.   I will look into contacting support.  Perhaps this issue has already been addressed for a future release.



  • 7.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jan 02, 2017 04:18 PM

    I've got the same problem. But sometimes only. On one machine only. I have upgraded 14 (from 12.1.6) in November. The problem occurred 3 times since then. When it happens I can't start even the program (SymCorpUi.exe freezes), nor the uninstall (it works for a while, then stops at once)!  Only Cleanwipe helps!!! Then the reinstall... After reinstalling it works fine. But in 3-4 weeks, it happens again... Very annoying :-(

    Zoltan

    PS.: Windows 7 x64



  • 8.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jan 10, 2017 01:25 PM

    I am also having the same issue with a few servers, Windows 2012 R2 and 2008 R2.  CleanWipe and a fresh install works for a week or 2 then the issue comes back.  Same with a simple reboot.  I do notice that the Symantec icon doesn't show up in the System tray when ccSvcHst.exe spikes in Memory and CPU usage.

    Never saw the issue before I upgraded to 14 from 12.1.5.

    Nothing seems to correlate to when it happens.



  • 9.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jan 17, 2017 10:30 AM

    Hi,

    To date, I have not started a support call with Symantec.  I have been observing to see if I could find a pattern.  The only thing I have found is in some cases when the problem begins if I try launching Live Update my screen flashes and nothing pops up. Not even a message. Reboot always fixes the issue.

    I was hoping someone from Symantec might respond to this issue here on the forums.  My history with support has been shaky and I am trying to avoid going that route unless absolutely necessary.  Right now I am waiting for the first service pack to see if the issue is corrected. Several other known issues with 14 need resolution as well.  A Symantec response in this forum would be appreciated.

    CQ



  • 10.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jan 17, 2017 11:20 AM

    Same here. Upgrading from 12.1 to 14 make the PC unusable. Very high disk usage



  • 11.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jan 17, 2017 11:36 AM

    I have the same problem with SEP 14.0.1904  Self Managed Client installed on Windows 10 Profesional  Version 1607 (OS build 10.0.14393.693)   

    ccSvcHst.exe  will start consistently consuming 15% – 25% CPU and 160,000k of memory. The averrage CPU  15%. This occurs even when a scan is NOT running. 



  • 12.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jan 18, 2017 06:54 AM

    Seeing the same issue with 14. Can not find a patern in this.

    OS: 2012 R2 fully patched
    SEP: 14 build 1904

    2017-01-18 12_52_39-server1.home_.lan - Remote Desktop Connection.png



  • 13.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jan 18, 2017 11:06 AM

    Always nice to mention what CPU is being used.

    A single core Atom CPU or a 4 core Pentium 7 = big differense.

     

    I was presented with performance issue for some test workstations.

    Turned out they were virtual Win 7, single processor/single core machines with 512 KB memory.

    Problem was located when I received that information..

     



  • 14.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jan 18, 2017 11:48 AM

    I have 4 different physical machines that have experienced this problem.  One has an Intel  i5 the rest have i7s.  3 of the 4 have 8gb of memory.  The other one has 16gb of memory.  In Martijn Groothuis's graphic I have seen 2 of the machines show the same 25% usage that remains steady until a reboot.  The others show 13%-15% constant usage until reboot.

    I have noted similar usage numbers during defwatch scans but that usage always drops when the scans are completed.  The problem machines stay at these percentages and fan noise increases as the CPU usage heats up the machines.  I have left the machines alone for over an hour and the CPU percentage never returns to normal.  No scans are running and live update is not running. Reboot required.

    I have also noted on a couple of machines (a W7 and a W10) that occasionally defwatch scans never show completion in the scan log.  I see a defwatch scan right now on the W7 machine that started over 4 hours ago and has NOT completed.  No excessive CPU utilization is occurring.  The only solution is to reboot as you cannot run another scan.

    Is defwatch possibly related to the issue we are experiencing?

    CQ



  • 15.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jan 31, 2017 07:25 PM

    Hello Everyone,

    Please open a support case for assistance.  Symantec Endpoint Protection (SEP) generates Windows Preprocessor (WPP) events which can be written out in Event Tracing Log (ETL) format.  ETL events are tied to Process ID (PID) and Thread ID (TID) pairs.  If a utility such as Process Explorer is used to identify the PID/TID pair responsible for the bulk of CPU utilization during issue reproduction the ETL log can then be reviewed to see what activity the thread is performing. This plan requires contacting support due to the nature of the ETL data.  Translating ETL data requires a Trace Message Format (TMF) file which is not publicly available. More data may be needed to identify root cause however this data set provides a solid starting point for the agent receiving the case.

    Generate SEP WPP ETL with the SymDiag tool
    https://support.symantec.com/en_US/article.TECH207795.html

    Download SymDiag
    https://support.symantec.com/en_US/article.TECH170752.html

    Process Monitor
    https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx



  • 16.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 01, 2017 12:45 PM

    Scott_001,

    I am willing to open a case but I don't want to waste my time if support/engineering is already aware there is an issue.  I find it hard to believe they don't already know about it.  Can you confirm that this issue is not known to them?

    FYI I roled back one of my Win 7 machines to 12.1.6 MP6 and the CPU issue has vanished.

    Thanks,

    CQ



  • 17.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 01, 2017 08:12 PM

    Hi CQ,

    I'm a TSE in product support and I do have a ticket open with engineering for similar symptoms.  I hesitate to assume shared root cause based on symptoms, particularly with the process in question. ccSvcHst stands for Common Client Service Host, as the name implies different instances of ccSvcHst can be spun up to host different modules.

    The engineering ticket in question has not reached root cause analysis so it's not possible to confirm shared root cause at this stage.  That said, having a support agent review the WPP events for the PID/TID pair in question would provide a degree of confidence in a shared root cause if the pattern of WPP events are the same.



  • 18.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 08, 2017 03:03 AM
      |   view attached

    Hi 

    We have the same problem in servers with Windows 2012R2.

    I've narrowed the problem to the excessive usage of disk using ProcessMonitor. When ccSvcHost is using 100% CPU, it's also continuosly accessing this file: 

    C:\ProgramData\Symantec\Symantec Endpoint Protection\14.0.1904.0000.105\Data\IPS\netstat.db

    Hope it helps to find a Solution.

    Twinlan

     

    SymantecCPUProblem.jpg



  • 19.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 14, 2017 03:37 AM

    We are also seeing this issue since an upgrade to SEP14.0.1904.0000

    In a rather large estate however we have mainly seen the issue on vCenter servers both running Windows 2008 R2 (both VM Guests)



  • 20.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 21, 2017 05:10 PM

    Hi,

    Last weekend I upgraded our SEP manager to 14 MP1 and pushed out client updates to my group of test machines.  I was hoping the CPU issue might be gone.  Yesterday, one of the Win 7 Pro machines jumped to 13% CPU usage and remained there until I finally rebooted.  So far none of the Windows 10 machines have experienced the ccSvcHst.exe issue with 14 MP1.  Today, I finally opened a support case with the hope that perhaps we can resolve this issue.  I am not going to role out 14 to our clients until Symantec can determine why some machines exhibit this behavior.  98% of our clients are running Win 7 Pro SP1.   I have another Win 7 Pro machine and two Win 10 machines that have not ever exhibited the problem.  Will keep you all posted.

    Thanks,

    CQ



  • 21.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 21, 2017 06:15 PM
    13% is not that much. Are other processes using 87% so it slows down the machine? It might just be active or full scans running in the background.


  • 22.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 21, 2017 06:45 PM

    TORB,

    13% -20% is quite normal when a scan is running or live update is processing. The problem I have noted continues on long after scans and updates are done.  Usually I walk into a room and hear the fans spinning faster which indicates the CPU is running hotter and has been doing that for an extended period.  I normally see ccSvcHst.exe using 13% - 20% and remainder is System Idle Process.  The machines do slow down some when this issue occurs.  The percentage stays at that level until I finally re-boot the machine.  Under 12.1.6 MP6 and MP7, I never experienced this issue on the same machines.  I have seen this issue come up on 4 different machines in my test group.  3 running Windows 10 and 1 running Win 7.   2 others running Win 10 and 1 other Win 7 machine have not exhibited this issue.

    Thanks,

    CQ



  • 23.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 22, 2017 02:33 AM

    TORB,

    We've experienced different percentages in different machines. That's not the problem.

    The only important thing it uses an entire core/vCPU. In our case we have 2 vCPU machines where the process uses 50% CPU, an 8 vCPU machines where the process uses 12% CPU (100/8).

    Twinlan



  • 24.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 22, 2017 11:24 AM

    Scott_001,

     

    My Case# is 11690307 and was filed online yesterday.  I would appreciate if you took a look at it.  I have not heard back from support yet.

    Thanks,

    CQ



  • 25.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Feb 24, 2017 03:02 PM

    Hi,

    A quick update.

    Support had me make a few changes to the policies but after a couple of days the problem is back on certain machines.  Support now wants me to use SysInternals ProcMon.exe to capture data for ccSvcHst.exe.  Will keep you all posted.

    CQ



  • 26.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Mar 04, 2017 11:20 AM

    Hi Twinlan SL,

    Support had me use ProcessMonitor to capture logs when the problem occurs.  I was able to capture data from 3 different machines running Win 7 Pro, Win 10 Pro, and Win Server 2008 R2 respectively.  The logs showed the same pattern your screen shots exhibit.

    I uploaded the logs several days ago and my latest case update shows they are still under analysis.  I am hoping Symantec can get to the root cause of this issue.

    CQ



  • 27.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Mar 13, 2017 04:53 PM

    Symantec updated an IPS driver to solve a read lock on netstat.db-wal. This is the file it seems to be locked through netstat.db when the CPU is high.

    I don't have any affected computers, can someone see if this fix solved the issue.

    https://support.symantec.com/en_US/article.TECH239793.html

     

     



  • 28.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Mar 14, 2017 03:36 PM

    I'm opening a case right now for the same issue. High CPU, SymGUI vanish.. but my netstat.db-wal file is 24kb. I'm having this on several virtual servers running 2012R2. So far I've had to uninstall as nothing works.

    Case # 11772750

     



  • 29.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Mar 15, 2017 04:52 PM

    Hi all,

    Thanks for the link TORB.  I definitely will test it on a couple of my machines that have experienced this problem.

    FYI support called me today and told me Ver14 MP1A will be issued in the very near future and that release will correct the high CPU utilization issue.Support could not give me an exact ETA for the new release. My guess would be the fix is the same as the fix referenced in the TECH239793 article.

    Lets keep our fingers crossed!

     

    Thanks,

    CQ



  • 30.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Mar 21, 2017 07:03 PM
    Also check this : There seems to be a issue with Shared Insight Cache. Are you using that? https://support.symantec.com/en_US/article.TECH239861.html


  • 31.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Mar 21, 2017 09:11 PM

    TORB,

    No I am not using that feature.  I see it is a separate install from tools and I have not done that.

     

    Thanks,

     

    CQ



  • 32.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted May 17, 2017 11:50 AM

    Did anyone have a solution for this?



  • 33.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted May 17, 2017 02:46 PM

    Hi,

    See the 2 recommended, temporary work-arounds in https://support.symantec.com/en_US/article.TECH239793.html

    I have tried both and they work.  I ended up turning off the telemetry in my test group and all is well so far.  It is the quickest solution as you do not have to make changes to each affected machine.  It looks like Symantec is going to release CIDS 16.1.2 definitions in a few days which should permanently resolve the issue. Hopefully they have resolved the crashing issue that occurred when CIDS 16.1 was released a couple of weeks ago.  Symantec was forced to role back to CIDS 15.

    Hope this helps,

    CQ



  • 34.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Trusted Advisor
    Posted May 25, 2017 03:25 AM

    Hi all,

    An update on this...

    CIDS 16.1.2 definitions is to be delivered via LiveUpdate to 14 MP1 clients between May 23 and May 30, followed by a full release for 12.1 and 14.0 clients on May 31

    Hope this helps,

    Tony

     



  • 35.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted May 25, 2017 08:01 PM

    Changed again...now TBD:

    http://www.symantec.com/docs/TECH239793



  • 36.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted May 25, 2017 08:26 PM

    Changed again...now TBD:

    http://www.symantec.com/docs/TECH239793



  • 37.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jun 07, 2017 03:09 AM

    Aaaand it got dates again:

     

    Current CIDS 16.1.3 release schedule:

    • 2017/06/06 - Early Adopter Server (EAS)  Release Refresh for SEP 14.0 or higher
    • 2017/06/14 - Staged release for SEP 14 MP1
    • 2017/06/21 - Full release for SEP 12.1 and 14.0 or higher


  • 38.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 18, 2017 03:52 AM

    We started getting a similar issue since a few days with one virtual (2 vCPU) Windows 2012 R2 server installed with SEP 14 MP2. SymHelp didn't show any significant issues. Shared Insight Cache is not used. Netstat.db* does not even exist.

    SEP worked well with 12.1.6, 14 and 14 MP1 on that server. After upgrading it to MP2 on 29.6. ccSvcHst.exe started to consume CPU/RAM on 7.7. for the first time or at least this day my colleagues saw it the first time. 

    First I thought it may be due to scheduled scans not finishing during the night (>3TB file server) so I split the Job (https://www.symantec.com/connect/articles/symantec-endpoint-protection-modifying-xml-based-policies-increased-functionality) into smaller jobs and planned them for different days. This didn't help. ccSvcHst.exe still consumes a lot of CPU (20-90%, avg. at approx. 50-70%) and RAM (I saw a maximum at approx. 400M) without any scan being actually run.

    Turned on debugging (Help->Troubleshooting...->Debug Logs) and didn't find anything "special" in those logs while the issue exists except regular communication with SEPM.

    During the time the issue exists, accessing the files/folders on that server through CIFS/SMB is extremely slow. Displaying a folder with a few files/folders in it takes very long time and may time out eventually. Disk I/O is very low during that time.

    In our case a server-restart is not needed, smc -stop followed by smc -start is sufficient to "resolve" the issue for at least some hours. Currently we're restarting SEP daily on that particular server as this issue existed every morning since about a week. For tonight I plan to add 2 more vCPUs to this VM to see if it helps to cure the symptoms for the users at least and most probably downgrade to MP1 in the weekend to see if that helps ...



  • 39.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 18, 2017 09:28 AM

    As I watch my virtual 2008 R2 server exhibit the same high cpu use as the rest of this thread I wonder what real resolution's out there.   I'm already running 14 MP2.  I"m rapidly losing confidence in this product based on MP1 causing my servers to deadlock and Symantec RELEASED MP1 and then acknowledged those faults publicly.   Uh guys who releases software that deadlocks servers?

     

    I'll read the rest of the thread and see what work arounds some of you have come up with.  I'm not the decision maker on what AV we use but boy I am leaving with a constant bad taste in my mouth for version 14.



  • 40.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 18, 2017 04:58 PM

    Hi all,

    In my opinion turning off telemetry (see http://www.symantec.com/docs/TECH239793) in SEPM for the appropriate group(s) is the quickest solution as you do not have to make changes to each affected machine.  It causes no harm and is a painless solution until Symantec finally gets this issue resolved.  It has worked great for me.

    CQ



  • 41.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 20, 2017 01:51 AM

    We are experiencing the same problem, exactly the same and it was on MP1 and now is on MP2 also. Just to inform you that downgrade will probably not help.

     



  • 42.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 20, 2017 07:33 AM

    Adding 2 vCPU helped mildering the impact on the users. ccSvcHst.exe is now consuming less CPU (20-50%, Avg ~ 25-30%). Even if http://www.symantec.com/docs/TECH239793 is not our problem (netstat.db-wal didn't even exist) I also disabled all Telemetry settings.

    I'll downgrade SEP today evening to 12.1.6 MP8 ... sorry for a mistification in my previous post - I did upgrade that particular server directly from SEP 12.1.6 MP6 to 14 MP2 skipping 14 and 14 MP1 at all. Thanks to @MrBloodyAXE - you made me check our backup and probably saved me some time figuring that out by myself :-)



  • 43.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 21, 2017 05:48 AM

    That: http://www.symantec.com/docs/TECH239793 is not working by me. I'm experiencing high CPU usage by ccSvcHst every moring exact at 6:45 a.m - looks like sheluded task. Our server is W2k8 r2 (working as file server) with 14 MP2 client (with MP1 was the same). We have a few servers more with the same configuration but they are not fileservers, and on those all is OK. 

    I placed the ticket but no answer till now. Is there someone who knows sth new it that case?



  • 44.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 21, 2017 06:19 AM

    Up to now I haven't seen this behavior on any other of our servers. Even not on the other file servers (2k8 r2  and 2012 r2) - knock knock knock.

    In our case ccSvcHst.exe started to consume the CPU at random times during the day. Yes, it did every morning but after restarting SEP (smc stop/start) it did again some hours later without any obvious reason.



  • 45.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 26, 2017 03:29 PM

    Hi,

    Any updates on this? TECH239793 is still dated July, 17,2017.

    CIDS 16.1.4 release schedule:

    • 2017/07/14 - Early Adopter Server (EAS)  Release Refresh for SEP 14.0 or higher
    • 2017/07/18- Staged release for SEP 14 MP1 (original 2332 build only, not the 2349 Refresh Build)
    • 2017/07/25- Full release for SEP 12.1 and 14.0 or higher

    All my clients are still at  15.2.5.21.  I have one client that uses the Early Adopter Server and it has been at 16.1.4.26 for a few weeks.

    My assumption is that Symantec has pushed it back again.

    CQ



  • 46.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 27, 2017 03:11 AM

    I had yesterday support on my server, we installed simple client again and was ok but only til today morning when users started to login to the network. Support said yesterday that if there will a problems i need to switch off AutoProtect on SEP settings - and yes, that make a trick immediately, but that is mean I'm not protected in real time... and have to wait till the system scan (if there is something dangerous) which is workin once per few days... then could be to late :/

    Now i'll give a feedback to support and we'll see what they'll propose...



  • 47.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 27, 2017 06:32 AM

    My question answered.  Just released July 27, 2017

     

    Current CIDS 16.1.4 release schedule:

    • TBD - Early Adopter Server (EAS)  Release Refresh for SEP 14.0 or higher
    • TBD- Staged release for SEP 14 MP1 (original 2332 build only, not the 2349 Refresh Build)
    • TBD- Full release for SEP 12.1 and 14.0 or higher

     



  • 48.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Jul 28, 2017 04:45 AM

    hi

    i have the same problem on a win 2012 r2 server 64bit with 8Gb of ram

    it is a file server and a virtual machine

    i have many other servers (virtual and not) but i have the problem only on this one

    i hope in a quickly solution

    PS: sepm and all clients are 14.0MP2



  • 49.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Aug 02, 2017 04:01 AM

    i'm trying this:

    created a new group with only the server that has the problem

    changed autoproctec policy on this new group: in advanced scan and control, set the first option with "exec scan when a file is modified"

    at the moment it works



  • 50.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Aug 02, 2017 10:24 AM
      |   view attached

    Hi,

    Expereriencing the same issu on a server W2012R2 with SEP14 MP2.

    Our Client has SEPM14 and all clients are SEP14.

    This server is also a backup server with netbackup.

    The issue is appearing around every 3 hours. We start a symdiag and found a lot of errors

    Don't have yet open a case but will do it soon.

    Here is a screencap of the process that you talk in this topic.

    Don't understand why every  3 hours, this is not the heartbeat, and there is no update !!! looks weird !!

    Will try the different solution you bring in the conversation after we reinstall the client tomorrow.

    Thanks for your help

    Regards



  • 51.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Aug 02, 2017 02:06 PM

    Updated again:

    http://www.symantec.com/docs/TECH246966



  • 52.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Aug 04, 2017 05:46 AM

    Sorry Brian... maybe for my stupidness... But could you tell me: what in that article is regarding to our problem... problem where ccSvcHst.exe increasing CPU to 100% and make our servers dead?  ;)



  • 53.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Aug 04, 2017 05:58 AM

    I have open case for that, they ask me for logs from process monitor... send few gigs :D, then they ask to do some exception in exception policies.... i made it, problem still exist.

    Workaround for me, which more or less makes my server work without interruption. Small bat running every hour in scheduler:

    "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.0.2415.0200.105\Bin\smc" -stop
    "C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.0.2415.0200.105\Bin\smc" -start

    But fo course, we can not work this way...

     



  • 54.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Aug 10, 2017 05:59 AM

    Answer from Symantec Enterprise Support: we do not have any solution for that problem, please wait to the next release of SEP client, which will be in October 2017...

    Yeah... cool.



  • 55.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Aug 16, 2017 02:18 PM

    Sigh, the root cause is that Symantec released a buggy product that is causing me and a lot of you hours and days of lost expensive productivity.  Sorry guys this type of buggy software from a Tier 1 vendor is beyond the pale of "you have to be kidding". 

     

    Here is another link https://support.symantec.com/en_US/article.TECH246966.html   If I was considering Symantec I'd be very very concerned.   

     

     

     

     



  • 56.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Aug 17, 2017 09:07 AM

    Worked like a dream for me!  Thanks for sharing!

    ​edit: ok it seemed to work for a while... :(

     

     

     



  • 57.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Aug 31, 2017 10:18 AM

    on my server it works

    i see big CPU and RAM activity only when is in esecution the weekly scan af all files



  • 58.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Sep 20, 2017 11:20 AM

    Hi,

    Sept. 18th has come and gone and I see Symantec has released ver 16.4.1.31 for the Intrusion Protection Engine/ 16.4.1.35 for the Intrusion Protection Browser Engine.

    I have 7 machines in a testing group and 6 out 7 machines have upgraded to the new versions.  One machine is still at 15.2.5.21. It is running Win 10 Pro.  I have rebooted it and have run Live Update and it has not upgraded.  I ran SymDiag on the machine with no negatives results.  Last evening, I randomly checked 10 production machines at my office.  I found 3 PCs still at 15.2.5.21.  I rebooted and manually ran Live Update with no change to the version.  These machine all run Win 7 Pro.

    Do you think this is just a staggered roll out or do we have a potential issue?  FYI due to the limitations of our network all the machines, including the test group, directly run Live Update from Symantec's server.  They do not download definitions from the management server.

    Thanks!

    CQ



  • 59.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Oct 12, 2017 06:47 PM

    This seems to have been fixed for me when I upgraded to 14 MU 2



  • 60.  RE: SEP Ver 14 Client ccSvcHst.exe increased CPU and Memory Usage

    Posted Nov 03, 2017 12:33 PM

    Hi, Bdiggity

     

    Can someone from: Symantec confirm it has been fixed ? we always have this issue on some of our servers

    Thanks a lot

    Regards