Endpoint Protection

 View Only
Back to discussions
Expand all | Collapse all

ccSVcHst dmp files filling our server

  • 1.  ccSVcHst dmp files filling our server

    Posted Feb 03, 2015 03:27 AM

    Overnight our backup server (Windows Server 2008 R2 x64) which is running Symantec Endpoint Protection 12.1.5 (RU5) got filled up with 220 GB worth of ccSvcHst.dmp files, i have tried to purge them but i got Access Denied error, even with smc stopped.



  • 2.  RE: ccSVcHst dmp files filling our server

    Posted Feb 03, 2015 03:43 AM

    Have you try diabled Tamper protection ?

    If not please try to disabled tamper protection and re-try



  • 3.  RE: ccSVcHst dmp files filling our server

    Posted Feb 03, 2015 03:46 AM

    Thanks James007. So i disabled tamper protection while booted in Safe Mode and i was able to delete the dmp files. Anyway to avoid this in the future?



  • 4.  RE: ccSVcHst dmp files filling our server

    Posted Feb 03, 2015 03:50 AM

    How many system having problem ?

    Does any specify scaning alert ?

    If it's tamper protection alert try to creating tamper protection exception to these files on Symantec endpoint protection manager.

    if it's only one system you can reinstall sep client.



  • 5.  RE: ccSVcHst dmp files filling our server

    Posted Feb 03, 2015 03:52 AM
    Could be because of latest defs..what's the definition date on this server?


  • 6.  RE: ccSVcHst dmp files filling our server

    Posted Feb 03, 2015 04:58 AM

    1 system only no scanning alert, will reinstall th eclient and see from there.

     

    Cheers.



  • 7.  RE: ccSVcHst dmp files filling our server

    Posted Feb 03, 2015 05:00 AM

    Definitions are 2015 r19 (i just updated them to r34) for Virus and 2015 r11 for Proactive Threat Protection



  • 8.  RE: ccSVcHst dmp files filling our server

    Posted Feb 03, 2015 07:39 AM
    You can run the symhelp tool on the affected machine to check for errors.


  • 9.  RE: ccSVcHst dmp files filling our server
    Best Answer

    Broadcom Employee
    Posted Feb 05, 2015 06:17 AM

    Hi,

    Thank you for posting in Symantec community.

    I would be glad to answer your query.

    Try the following workaround for single client.

    1) Disable Tamper Protection.
    2) Open a Command Prompt window.
    3) del "C:\ProgramData\Symantec\Symantec Endpoint 
    Protection\12.1.5337.5000.105\Data\Install\Logs\*.dmp"
    4) Using regedit.exe, set 
    HKEY_LOCAL_MACHINE\SOFTWARE(\Wow6432Node)\Symantec\Symantec Endpoint 
    Protection\CurrentVersion\Common Client\Debug\CrashHandler\DumpOn* to 0.
    5) Re-enable Tamper Protection.
    6) Open a Command Prompt window.
    7) cd "C:\Program Files (x86)\Symantec\Symantec Endpoint 
    Protection\12.1.5337.5000.105\Bin"
    8) smc -stop
    9) smc -start



  • 10.  RE: ccSVcHst dmp files filling our server

    Posted Feb 09, 2015 10:35 AM

    I have this issue on 2003 and 2008 servers that have TB' of data on it. I will try this registry change. thanks!



  • 11.  RE: ccSVcHst dmp files filling our server

    Broadcom Employee
    Posted Feb 12, 2015 08:04 AM

    Is there any update? 

    OR

    If issue has been resolved mark this thread as a solved with the best answer that helps you.



  • 12.  RE: ccSVcHst dmp files filling our server

    Posted Feb 12, 2015 08:09 AM

    Namaskar Chetan,

     

    Problem seems solved, thanks



  • 13.  RE: ccSVcHst dmp files filling our server

    Broadcom Employee
    Posted Feb 12, 2015 08:14 AM

    Glad to know it's resolved now.