Endpoint Protection

 View Only

  • 1.  Symantec Endpoint process ccsvchst.exe

    Posted Mar 28, 2012 01:15 AM

    Hi;

    Got an issue here regarding Symantec Endpoint process ccsvchst.exe. This process causes high CPU usage at DNS server. We have tried to stop this services but failed. Our customer need a solution regarding this issue because when this process spike a high CPU usage it will make their internet connections slow and it getting worse everyday. Please help.



  • 2.  RE: Symantec Endpoint process ccsvchst.exe

    Broadcom Employee
    Posted Mar 28, 2012 01:33 AM

    what version of SEP is installed?

    does it happen all the time?

    i suggest to open a support case as well.



  • 3.  RE: Symantec Endpoint process ccsvchst.exe

    Posted Mar 28, 2012 02:42 AM

    the SEP version is 12.x..and its happen everyday at 12.30pm..we also have remove all Symantec component except symantec AV...but the issue still occur..



  • 4.  RE: Symantec Endpoint process ccsvchst.exe

    Broadcom Employee
    Posted Mar 28, 2012 05:22 AM

    Hi,

    It would be great if you could provide exact SEP version.Proivde us version code.



  • 5.  RE: Symantec Endpoint process ccsvchst.exe

    Broadcom Employee
    Posted Mar 28, 2012 05:32 AM

    is liveupdate scheduled/scan at this time or any other task triggers at this time?



  • 6.  RE: Symantec Endpoint process ccsvchst.exe

    Trusted Advisor
    Posted Mar 28, 2012 05:36 AM

     

    Hello,

    Does this happen when any Terminal Services is started or there are Terminal connections to the Server?

    What version of SEP 12.1 are you carrying? Is the SEP 12.1.671 OR SEP 12.1 RU1?

    If SEP 12.1.671, then could you check what happens after you Migrate to the Latest version of SEP 12.1 RU1 (SEP 12.1.1000)?

    Also, please Simplify the Exceptions policy to obtain a better performance.

    Also, take into account the automatic exclusions done by the SEP Client:www.symantec.com/docs/TECH89592.
     
    Let us know what you happens next.


  • 7.  RE: Symantec Endpoint process ccsvchst.exe

    Posted Mar 28, 2012 05:54 AM

    Hi;

    "..it would be great if you could provide exact SEP version.Proivde us version code.."

    Here are the details for the DNS server and SEP

    1)  OS: Microsoft Windows Server 2003 Standard Edition with Service Pack 2

    2)  SEP Version: Symantec Endpoint Protection 12.1RU1

    3)  Symptom: Process “ccsvchst.exe” is using a lot of CPU and Memory resources.

     

    "..is liveupdate scheduled/scan at this time or any other task triggers at this time?.."

    the liveupdate sheduled/scan have been configured every Friday 12.30pm..not every day..there is no other task running on that time

     

    We already done some exceptions at the Exceptions policy to obtain a better performance, but its the issue still occur.



  • 8.  RE: Symantec Endpoint process ccsvchst.exe

    Posted Mar 28, 2012 06:25 AM

    Please check if you have NTP enabled on SEP client

    Regards



  • 9.  RE: Symantec Endpoint process ccsvchst.exe

    Broadcom Employee
    Posted Mar 28, 2012 06:38 AM

    Hi Fuad.Hasbullah,

    You have following options

    1) You can downgrade SEP version & check.

    or

    2) If it's causing major peroformance issue bring it to Support notice.

    Support phone numbers listed below

    Regional Support Telephone Numbers:

    United States: https://support.broadcom.com (407-357-7600 from outside the United States)
    Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
    United Kingdom: +44 (0) 870 606 6000
    Additional contact numbers: http://www.symantec.com/business/support/contact_techsupp_static.jsp   India: Toll-Free 000 800 4401 456 directly                                                                                                    

    OR

    You can log a web case as well

    QuickStart Guide - Create and Manage Support Cases in SymWISE

    http://www.symantec.com/docs/HOWTO31132

    How to update a support case and upload diagnostic files with MySupport

    http://www.symantec.com/docs/TECH71023



  • 10.  RE: Symantec Endpoint process ccsvchst.exe

    Posted Mar 28, 2012 08:27 AM

    You mentioned that everyday at 12.30 you this issue happens. Did you check whether that is the time when SEP client downloads the virus definitions?

    Also please check the following link,

    http://www.symantec.com/docs/TECH170756

    Though the above link is not for 2003 server thought it may help you.