Problem with Mac Client running slow,

[Migration User]

Hi,

 

I have a question have any of you had any problem with Mac Clients running slow becaus of the Endpoint Client ?

If I uninstall it runs fine.

And its a Synamtec Endpoint 11.6a

 

Best Regards

 

Peter Røder

[Mithun Sanghavi]

Hello,

Symantec is investigation this issue. (I would recommend you to create a Case with Symantec Tech support.)

However, Few recommendations may be helpful as below:

First recommendation: Disable all scanning of compressed files, since needing to unpack the compressed file will add to the CPU load.  See the following document:

Symantec AntiVirus and Endpoint Protection for Macintosh: How to Disable Scanning of Compressed Archives

http://www.symantec.com/docs/TECH106231

Be aware of the "To turn off the default setting for manual scans run by the current user through the client GUI" portion, which is not controlled by SEPM policy and will need to be applied even if it is a managed client.

Also for managed clients there is a seperate setting for scans issued by command by the SEPM administrator, under Antivirus and Antispyware Policy > Mac Settings > Administrator-Defined Scans > Administrator On-demand Scans, Edit. Under "Scan drives and folders" uncheck "Scan Compressed files".

[Migration User]

I think we need more information. (I for one see no issues with slowness with my own system. It is running RU6 MP2 (11.0.6200) on OS X 10.6.6.)

- Which process is using high amounts of CPU? If it's navx:
High CPU Usage on Symantec Endpoint Protection for Macintosh clients with NAVX process
http://www.symantec.com/docs/TECH140574

If so, then yes, you will want to follow the instructions regarding compressed scans, though I wouldn't call it a known issue--it's expected that more CPU would be used if the scanning engine needs to work with compressed files.  Also, the first scan you run will take longer, but subsequent scans will take less time.

If it's another process, which one?

- Is this occurring when users are running specific programs, like they're compiling code?

- Are you using disk encryption?

Thanks,
sandra

[Migration User]

I am also facing same issues. Client on Mac OS X 10.6.6 is running slow.

 

Can any let us know how to disable SEP Mac OS X 10.6.6?

 

Regards,

Subodh R. Dangat

[Mithun Sanghavi]

Hello,

I personally would recommend you to follow the Symantec KB:

Symantec AntiVirus and Endpoint Protection for Macintosh: How to Disable Scanning of Compressed Archives

http://www.symantec.com/business/support/index?page=content&id=TECH106231
 

HOPE THAT MAY HELP YOU ALL...

[Migration User]

Hi There,

I not agree with this recommendation to not scan compressed files. For me it's high security risk, for example, scan exclusion allow an attacker to exploit/install malicious software without Symantec control.

In this case it is not advisable to install antivirus on MAC computer.

Best regards,

Stephane.

[Migration User]

I must respectfully disagree. You say that a "Scan exclusion = Security Risk" but in the same post you say "it is not advisable to install antivirus on MAC [sic] computer." How is not installing antivirus on Mac not a bigger security risk?

Any compressed file that is not scanned by default can be scanned manually through a contextual menu scan (Control- or Right-click, choose "Symantec: Scan Selected file(s) for threats").

Any compressed file that is being uncompressed: the files inside will be scanned by Auto-Protect as they are being written to the hard drive.

For the Mac, exclusions (Centralized Exceptions) only apply to Auto-Protect scanning. Disabling scanning of compressed files is not the same thing as an exclusion.

The 'disable compressed file scanning' settings mentioned above will only apply to Mac computers.

sandra

[Mick2009]

"Thumbs up" to Sandra's advice, above!!  In 2011, an AV to defend you Mac is an absolute "must." Please do read this recent blog from Security Response, and follow its links:

https://www-secure.symantec.com/connect/blogs/i-dont-use-av-because-i-have-mac

 

Thanks and best regards,

 

Mick

[Migration User]

Hi Sandra,

When I said "In this case it is not advisable to install antivirus on MAC computer", that mean, if we need to apply some exclusions for SEP Mac, specially compressed file, all malicious compressed files will not detected and potentialy will be able to infected Windows environment, as Mike has mentionned.

So in this case SEP Mac client reduce our global security in mixed environment (Win+Mac) and I don't see the added value.

I don't search to polemics about antivirus vs MAC, I'm in charge of 40000 Windows computers with SEP. We've a project to integrate Mac computers in our environment with same level of security. And at this time, for my point of view, I think that the SEP client for MAC isn't really stable because I don't have this type of issue with SEP for Windows, that's all.

Best regards, Stephane.

[Migration User]

It's not an issue in the sense that there's a bug in the program. It is actually expected behaviour, and it happens on Windows computers, too: CPU usage will increase and scans will take longer when a scheduled or manual scan encounters compressed files, even longer still depending on how many levels of compression are being scanned. (Scanning of compressed files can be disabled for Windows computers too.)

As for your concern that disabling this scanning on the Macs would pose a risk to Windows computers: If compressed files with malicious content were moved to a Windows machine and expanded, Auto-Protect on the Windows machine would do the exact same thing and scan the files being extracted as they wrote to the hard drive.

sandra