srtsp64.sys cpu usage high

[Migration User]

Hi expert

SEP 12.1.2100 run in Win2k8 r2.

I found System Process usage over 25%.

My VM has 4vcpu so system process using 100% 1 of CPU(CPU1).

I use Process Explorer, srtspx64.exe using cpu.

Could you tell me what is srtspx64 and why srtspx64 using CPU high?

Thank you

Hiro

[ℬrίαη]

What components are installed on the system? Is this constant?

[Mithun Sanghavi]

Hello,

srtspx64.exe seems to be related to Symantec AutoProtect.

Is there a scan running on your machine?

I would suggest you to Check these Articles:

Symantec Endpoint Protection 12.1 - Virtualization Best Practices

http://www.symantec.com/docs/TECH173650

Symantec Endpoint Protection 12.1 - Non-persistent Virtualization Best Practices

http://www.symantec.com/docs/TECH180229

Best practices for virtualization with Symantec Endpoint Protection 12.1.2

http://www.symantec.com/docs/TECH197344

Hope that helps!!

[Migration User]

Thank you for your reply.

I check document later.

Do you know  issue Scan is using 100% 1 of CPU?

 

 

 

[Migration User]

I installed SEP with Virus and Spyware Protection and Proctive Thread Protection, network Thread Proteciton .

 

[ℬrίαη]

Is this constant or intermittent?

[Migration User]

Sorry my response so late.

This issue occur constant.

I found cpu usage high occur first live update after boot.

I try to stop auto-protection then cpu usage go nomal.

But after live update (about daily), this issue occur again.

 

 

[ℬrίαη]

Have you tried with the latest version, 12.1 RU4 MP1a?

You're running an old version.

[MrK1024]

I'm seeing the same thing right noq on one of our Windows Server 2003 R2 systems running 12.1 RU4 MP1 (12.1.4100.4126). 

I believe I've seen this with older versions before as the google results brought up a lot of already visited links.

This server is installed with only "Virus and Spyware Protection".

[MrK1024]

I checked our servers and 4 in total running Windows Storage Server 2003 R2 have this issue.  Process Explorer shows the SYSTEM (4) process chewing up an entire core.  When I look at the threads for the process, SRTSP64.SYS is shown as causing all the activity.

I tried rebooting a couple of the servers overnight and the problem was there when I checked in the morning.  The next step will be to reinstall 12.4 RU1 (12.1.4013.4013).

[MrK1024]

We do have other servers running Windows Storage Server 2003 R2 that don't have the problem.  And we used to have the problem on a Windows Server 2008 R2 server that was running SEP 12.1 RU3 (12.1.3001.165) that went away when it was upgraded to 12.1 RU4.

[ℬrίαη]

It may be scanning the quarantine, have you turned off the option to re-scan the quarantine when new defs arrive?

Have you put in a call to support?

[MrK1024]

Three of the servers have empty quarantines.  The 4th has 1 thing in it.

[MrK1024]

I'll open a support case if the reinstall of RU4 doesn't fix things.  Given the other problem I had with RU4 MP1 (http://www.symantec.com/connect/forums/12140134013-active-scan-causing-server-instability), I don't trust this release.

[Migration User]

I see that there have been intermittent mentions of this over the past couple of years. At present I see this on a real machine running Win7 x64 Ultimate and SEP 12.1.4112.4156.

The system process comes to take 50% of CPU time and this is down to two threads of srtsp64.sys. It occurs intermittently. I have no idea what triggers it but once started it doesnt stop until the Virus and Spyware Protection is turned off. Immediately restarting Virus and Spyware Protection doesnt cause the problem to come back immediately - eventually yes but it might be hours.

I identified the thread IDs (using Process Explorer) as 7680 and 9620 and set up a filter for Process Monitor to include these two TIDs (and turned off all the usual exclusions).

Surprisingly, the only activity found was an occassional IRP_MJ_CLOSE operation to the root of the E:\ drive and once to the C:\ drive. There is nothing odd about the root of E:\ (other than that it contains two junction points). I have attached a screen image of this. At 10:12:02 I disable virus and spyware protection and re-enabled it at 10:13:24.

Does anyone have any ideas?

[Migration User]

There was a user defined exception in Symantec.  When I delete this exception the high cpu utilization goes away.

[ℬrίαη]

Exception for?

[MrK1024]

Reinstalling RU4 (12.1.4013.4013) did resovle the issue for me.  However, I recently tried to install RU4 MP1B (12.1.4112.4156) and the problem came back on 7 servers.  So, I now have a support case open.

We don't have any user defined exceptions on the affected servers, but we have added additional exceptions to the policies. 

In our environment, this problem is only occurring with the Windows Server 2003 systems (1 32-bit with the rest 64-bit).

The problem goes away immediately if I go into the client options and turn off auto protect. 

[MrK1024]

The problem appears to be resolved on all of our servers that were experiencing it.  It looks like the Auto Protect File Cache was at the root of it.  Turning off Rescan cache when new definitions load appears to have fixed things.

http://www.symantec.com/business/support/index?page=content&id=TECH210603

I was initially concerned about turning this off because it seems like this would leave stale whitelisted items in the cache.  But the following article indicates that if the rescan option is off, the cache is cleared when new definitions arrive.

http://www.symantec.com/business/support/index?page=content&id=TECH191600

In our case, I suspect that either there was corruption in the cache and the side effect of the cache being cleared fixed it, or the option itself is suspect and is better left off.

[MrK1024]

I have confirmed that the Rescan cache when new definitions load option is the cause of the problem on our servers.  If I turn it on, the problem starts up after several hours.  If I turn it off, the problem stops after serveral hours.  This timing is consistent with the frequency of definition updates.  This is not a problem we experienced with 12.1 RU4 (12.2.4013.4013).  It looks like some sort of regression was introduced in 12.1 RU4 MP1.

[Migration User]

We had very similar problem described in this thread.  Symantec engineering team confirmed us that this as a known issue and they are working on a permanent solution.

Meanwhile, use this as a temporary fix.

http://www.symantec.com/business/support/index?page=content&id=TECH224108

- Karthik

[Migration User]

I had this exact issue for weeks and no online solution worked.

Windows 8.1 /w Lenovo T420s with the latest and greatest version of SEP

Seems like when the symantec agent ran some system process got stuck on SRTSP64.SYS which pegged my CPU  @ 25-30% until it maxed my memory then hit the virtual mem which bottlenecked the system at this point. This sort of made sense since symantec endpoint has some role to play with the adapters that are installed.. Reboot was the only choice.

Turns out it was an older wifi driver...

I recently discovered a newer Wifi driver for this model (for windows 8.1) and even though it worked just fine with the one i initially installed.

Check the manufacturers website of the workstation being used.... Looked too long on this issue and almost gave up.

Nicholas