Full Scan, high load

[Migration User]

We are weekly running a schedulet full system scan, on workstations. Unfortunately this is taking A LOT of resources on the employees computers.
Is this normal? Are there anyway we can avoid this?

Are there any folders / files, that are recommended to exclude from scanning that causes this behaviour?

One solution will be to run the quickscan instead, by I am afraid this would no be sufficient on the system.

[Migration User]

Yes, if you install the whole package then it is normal. What is the size of the RAM?

[Migration User]

Hi IBM,

I fully agree with you.

Pls see the post in the attached link..

https://www-secure.symantec.com/connect/forums/schedule-scan-consumes-more-90-cpu-utilisation

Rgrds,
SAM

[Migration User]

Thanx for the great information
It is really usefull

[Migration User]

If you have the Auto Protect turned on, You dont need to run the full scan that often.
Once or twice a month is fine, Unless a computer has been compromised.
Yes, It does take lot of resources. That is normal.

[Migration User]

When you run a full scan it will slow down the computer.So it is advised to schedule this scan after production hours or during Lunch or something liek that.

[Migration User]

Slow dDown of the machine's performance is ntirely dependent on the configuration of the machine you are having and the co-current process running

[Migration User]

HI,

As far as after production hour is concerned, everywhere now its going Green , hence no more wastage of electricity/power supply specially for schedule scan.

And for lunch time scan, users goes for lunch atleat for 30-40 min, but the scan goes continously for say more than2 hours.

Thnx for your rcomments

Rhrds,
SAM

[Migration User]

Yes Agreed with SAM this is happening at everywhere were SEP installed.

[Migration User]

Hi Everybody,
did anybody tried the tuning option that comes under administrator on demand scan settings and then advanced scanning options? Make the slider go down at the bootom option, i.e, best application performance.

[Migration User]

Hi,

Tunning option is not much more helpfull.

[Migration User]

Hi mansoor,
if the tuning option is not helpful then it will depend totally on your system configuration, but still i think this issue is quite solved in the latest symantec 11.0.4014.26 release, as it takes only 256 mb of ram to run, but still during the scan time it will depend on how well configuration does your system have.....

[Migration User]

Sapta,

I totally disagree with you.

I think you haven't seen my post properly and replying blindly. If you could have seen then its clearly says about the version, current system configuration and current tuning options.

Pls see it once again.

https://www-secure.symantec.com/connect/forums/schedule-scan-consumes-more-90-cpu-utilisation

I hope you will get all the details now.

Rgrds,
SAM

[Migration User]

hi sam,
i am sorry i am unable to see ur screenshot, but by reading your system configuration, i think xp sp3 might have some issues, but still i am not telling that machines does not gets slow during schedule scan but in my network rtvscan does not take 90% of the cpu during scanning

[Migration User]

connect/imagebrowser/view/image/798301/_original

Here is the link.

Rgrds,
SAM

[Migration User]

Hi Sapta,

XP3 fixes many things in windows and I think now whole world are using the same but you are still with SP2.

http://support.microsoft.com/kb/946480

This is not regards to SP3 this could be a issue with our product.

Because we try other AV with positive result.

[Migration User]

connect/imagebrowser/view/image/796741/_original

Ignore my previous image as it was of different issue.

Rgrds,
SAM

[Migration User]

connect/imagebrowser/view/image/796741/_original

[Migration User]

We have similar problems with a small selection of machines (we currently have approx 1000 machines, and this problem occurrs on around 50).
When it does occur however it is quite pronounced  - IE scans can take 10+ hours (I have one client machine where the scan takes over 24 hours) and the machines are quite badly affected during the scan, CPU usage on RTVSCAN is quite high, but more annoyingly, access to all other functionality on the machine is dog slow.
SEP is turned down for best application performance, and all the affected clients are on 11.0.4014 - it affects a variety of OS XP sp2, sp3 and Vista RTM and Sp1, and the spec of the machine doesn't make a massive difference.

There are some very definite themes running through all the machines affected though - most have a combination of:

Disk full or close to full
Lots (many many thousand) of small files
Lots of compressed files / big compressed files (often with many files within or several levels of compression)
Significantly fragmented drives
Drive intensive applications

Sort out most of the above, and the scans become normal again - problem is, I often can't sort out the above due to the nature of the jobs of the people using the machines (developers).

My advice to the OP is to try to optimise the scanned machine as best as possible and then see if you still get issues (use a test machine first).
Do things like remove .zip .cab files where possible, clear down the $backup stuff$ in Windows/Winnt directories - don't forget the Software Distribution folder - this almost always has a build up of files in it.

My request to Symantec is - Please make the scan throttling work - I don't really care if scans take a long time, as long as the machine is usable whilst it is doing.  (please also allow scans to start where they left off if they get interrupted)

Nick

[Migration User]

hi mansoor,
the whole world is changing to a lot of things nowadays, but still something if remains old will still be gold, i really prefer sp2 rather than sp3, as i faced many issues when i upgraded to sp3, so it depends on an individual preference, i also use windows 7 on a lot of mahines in our network, they are probably far far better than xp sp3 from the view of security.....

[Migration User]

 You unfortuanately dont have too much leeway in terms of CPU usage for a scheduled scan. It takes a lot of RAM and CPU while the scan runs...Tuning doesnt help a whole lot

[Migration User]

The scan throttling seems to me to work much better in Vista than it does in XP.   I am starting to test some in Win 7 but since it is build on Vista technology I am expecting the same results there.

[Migration User]

that link is very useful sam !!  thanks

[Migration User]

We too have this issue. We have scheduled our scans to run at night. The only users that have issues are the laptops or users that turn off their computer the night the scan runs. When they log in the next day, Symantec kicks off it's scan and takes up 90 to 100 of the CPU.

[Migration User]

Really this boils down to rethinking the way you have your policies set up. Full scans take up resources bottom line, and they should be ran at least once a week. Some will say less, but I suggest at least once a week. You are already doing the correct thing with you desktops of running the full scan at night. You might have to do the same thing with the laptops. Get it set up to where you can leave those machines on once a week. There are ways you can get it to where it won't kick off that full scan once the scan is overdue for so many hours, but that is useless since the scan HAS to happen at some point. If you are only turning these laptops on during business hours then performance will be affected. One suggestion from another forum was to let the scans run during lunch, so most of the machines aren't hit as much. Also what kind of hardware are you running on these machines, especially how much RAM?

Also it is worth it to mention that you should look at the article posted below. This article will essentially tell you that SEP can be set to do three options that will change the resources that SEP uses on your system. The three options are:

* Best Scan Performance – Symantec Endpoint Protection scans as fast as it can. No throttling is done. This is essentially the way legacy SAV scanned.

* Balanced Performance – Symantec Endpoint Protection will throttle if other processes are doing a lot of IO. If other processes are doing some, but not a lot of IO, then Symantec Endpoint Protection will not throttle the scan.

* Best Application Performance – Symantec Endpoint Protection gives preference to other applications. If other processes are doing some IO, Symantec Endpoint Protection will throttle the scan until the amount of IO by the other processes goes down.

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/ec1422e07c11c714882574b0005ade87?OpenDocument

Hopefully this information helps

Grant