SEP high cpu usage and freezes due to large profilemanagement.dat file?

[Symnder]

Hello all,

On our exchange servers, sep clients are unstable. Sep gui freezes, sometimes gui does not open at all and when I try to stop sep using command "smc -stop" password prompt does not appears. Restarting the server temporarily solves the problem but after 10-15 minutes same things start to happen.

When this problem occurs, ccsvchst.exe process always consumes %4 cpu. I checked the process with "process monitor" and it seems that ccsvchst is reading "ProfileManagement.dat" file which is located in "C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.3384.1000.105\Data\Config" folder. Weird thing is, this file is around 4 GB on all problematic exchange servers. The "ProfileManagement.dat" file size on the other servers which don't have this problem is really small, around 1 MB.

On one exchange server I re-installed the client and "ProfileManagement.dat" file started with small size around 1 mb. Also all the problems, freezes and cpu usage of ccsvchst.exe stopped. 

Do you have any information about this file and why it becomes very big? Also do you have any workaround to reset this file (it seems like a database) without reinstalling the sep client?

BTW, sep client version is 14.3.3384.1000.105 and OS version is Win Srv 2016 with latest updates.

[OblaGonte]

Hi,

I am facing same issue which my version is 14.3 RU3. All just hang which we cant uninstall it, Symdiag also wont open/hang. We also can see the profilemanagement.dat file is huge on these affected exchange server host.

Any ideas? Should we upgrade to RU4?

[SHHSU]

HI BolaGonte,

How about the workaround to add "C:\ProgramData\Symantec\Symantec Endpoint Protection\" into Exclude list to prevent from SEP scanning.

[Gregory Anderson]

I believe it you Windows assigned page file that is causing the resource issue.

Try setting the page file manually to what you see in the image .

[John Owens]

Please open a case.

Do you have a large amount of file hash exceptions set?

Profilemanagement.dat is used when applying profiles and location changes to the endpoint.  Likely an issue with policies.

------------------------------
John Owens
Strategic Support Engineer | Symantec Endpoint Security Division (SES)
Broadcom Software
------------------------------

[Yaser]

Hi

I want to brought attention to this issue because recently I see several customers facing this issue on their client or servers. the product version for this customers is 14.3 RU6 or RU7.

the symptom is high CPU usage of ccSvcHst.exe (about total 1 CPU core), growing size of "C:\ProgramData\Symantec\Symantec Endpoint Protection\[Product version]\Data\Config\ProfileManagement.dat" to event more than 1 GB and ccSvcHst.exe constantly read ProfileManagement.dat file.

The report of problem start about 2 week ago and escalating.

Please see the attachment

[Ed Agoff]

This may be related to a known issue involving automatic scanning exclusions generated by SEP. Apply the workaround described here: Endpoint Protection client process hang / high CPU usage on Microsoft Exchange servers. Please open a support case otherwise for further troubleshooting.

[Erick Fiquer]

Hello Waser, has the problem been fixed?