smc.exe using 99% of cpu

[Migration User]

I am having problems with a SEP 11MR4 MP2 client on Win 2000 SP4 in which smc.exe uses 99% of the cpu rendering the machine useless while smc is running. I have tried turning off network threat protection but the problem still happens. I also uninstalled and reinstalled the client and the problem comes back. Any alternative suggestions would greatly be appreciated. Thanks

[Thomas K]

Are you using any Nortel VPN client software on these systems?

Thomas

[Migration User]

No I do not have Nortel vpn client software on the systems

[Thomas K]

Is this happening on all of your Win2k clients? Are you running any disk encryption or other VPN client software?
Can you PM me your exported msinfo32 file?

Thanks,
Thomas

[Migration User]

Do you use Win2k as a terminal server?

[Migration User]

I have seem similar thing to this on a few random XP clients.  Most of the ones reported to me have been desktops so they have no encryption software and no VPM software installed.

One machine hasnt reported it again since I made sure it was fully patched and a full defrag was run on the machine.

[Migration User]

No I am not using Win2k as a terminal server.

[Thomas K]

Can you enable debugging on the client? Do this for SMC and Rtvscan.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008122313093748

Please upload the logs to the fileshare account for analysis.

Thomas

[Migration User]

Can provide us with the SP installed on the Win2k Machine? I belive it should be service pack 4.

[Migration User]

Also along with the logs that Thomas requested could you post the hardware specs for this client. Namely the amount of RAM and what CPU? Also just to be clear are you seeing a fluctuation int he CPU spikes or does it stay at a constant 99%?

Grant-

[Thomas K]

Grant,  His system meets the minimum requirements I have the msinfo32. I will PM you.

[Migration User]

Is this happening to all clients?

[Migration User]

Same situation here, smc usage 100% when connecting with Cisco VPN client, case opened
After closing VPN connections sms is back to normal 0-2%
Regards
Jan

[Migration User]

It will stay at 99% for most of the time, the lowest I have seen it is 92% for a breif period then shoots back up to 99%

[Migration User]

This is the only client in my test group that is having the issue, however it is also the only win2k client I have in my test group right now.

[Thomas K]

Did this issue start after an upgrade? If so, what version was running on the Win2k client before?

Thanks,
Thomas

[Migration User]

Yes the issue started after upgrading the client to MR4 MP2. It was previously running on 11.0.4000.2295 and then was upgraded to 11.0.4202.75

[Migration User]

Hi do you have the NTP component?

[Thomas K]

@ ashx, I see that your case was resolved by installing the previous version. Can we mark this thread as solved?

Thomas

[ch1221 2]

I have the same issue on some of my Win200 Pro SP4 clients after upgrading them to MR4MP2.  SMC spikes to a constant 99% and they lose communication with the SEP server.  I have a case open with support on this (320-201-760 if anyone wants to reference it).

[Thomas K]

@ ch1221 2, I posted a comment to the owner of your case noting the workaround is to install previous Agent version on the Win2k system.

Thomas

[ch1221 2]

Reverting the client to a previous version may be a workaround but it's not a solution.  I have other clients that need the fixes from MP2 so applying the update package to the group also updates these Win2000 systems with the issues.  This is causing my rollout of MP2 to be delayed now.
Symantec needs to find the root cause and fix it rather than tell customers to revert back to an old version.  That's not an acceptable answer.

[Migration User]

I agree with ch1221 2, it was a workaround for me so that I had a usable machine again but was not a solution to the problem.

[UBIFCU]

I too have this SMC.exe 99% CPU usage. I would gladly install aprevious agent, but how/where do I get it?

[Migration User]

Hi ashx and UBI I guess you need to open a case with Symantec Support.  Btw is the 99% cpu on idle?

[UBIFCU]

It's 100% of the time, idle or otherwise. Rarely dips below 90% and is 99% most of the time.

I found my old discs, so I created an install package from that. I'll see if it works.

[Migration User]

What is the service pack of windows?

[UBIFCU]

SMC.exe goes to 99% CPU when the network interface cannot be automatically restarted after installation, so the setup of SEC remains incomplete (hence my commnication issues). It's trying to apply policies and it can't because the inteface hasn't restarted properly. Restarting the network interface dropped SMC.exe back down to normal operating tolerances (0-5% cpu) on all 4 of the PC's I was having issues with, let the install complete, and allowed the clients to communicate properly back with the server.

Hope this helps out everyone in this thread.

[UBIFCU]

Also, all the PC's I was having trouble with had static IP's.  I dont' know if this is related or not.

[Migration User]

Out of about 50 computers & servers, I am having this issue with so far 1 WXP Pro computer across the WAN from the parent server, which happens to be the only computer across the WAN that has been joined to the domain (FWIW).  Version of SEP is 11.0.4202.75.  Previous SAV was 10.1.5.5000.

@UBIFCU
But then wouldn't you think a reboot would solve the problem because a reboot in essence is a restart of the network interface?
My smc.exe 100% CPU problem persists despite rebooting, but I will reinstall and try your restart-the-network-interface suggestion.

[UBIFCU]

The problem persisted for me even through reboots. The only reseaonable explanation for htat would be that since the network interface isnt' up when the computer starts, SEP doesn't try continuing it's install until it detects network, then starts calling for the restart again, then right back to 99% CPU.

[Migration User]

Hi UBI, please post SEP inst.Log

[Migration User]

Well I tested intstalling SEP 11 client, then disabling/enabled the Local Area Network (first by disabling/enabling the network device in the device manager, then later by right clicking on Local Area Network). 

Still my smc.exe is consuming all remaining CPU resources.

[Migration User]

(Sorry, I don't wish to hijack the thread.)

Is there a way to get the policies and "drop" them into a folder on the client, in order to trick the client into thinking it got the policies all by itself? 

Maybe if I can do this once, it will do it succefully when it attempts it on its own next time....long shot I  know.  I'm willing to try anything right now.

[UBIFCU]

JasAld,

Try just clicking repair on the connection. That's what worked for me. Are you using DHCP on that workstation?

[Migration User]

I also tried disabling and enabling as well as repairing the connection and smc is still hammering the cpu. I am using DHCP.

[UBIFCU]

Maybe try switching it to a static IP, the reverting back to DHCP. If that doesn't work, I'm out of ideas.

[Migration User]

Switched to static IP and tried again but still no luck.

[Migration User]

I ended up putting the unmanaged client onto the box as a temporary solution.... I'm racking my brain with this problem.  Thanks Symantec. 

[Migration User]

Hi we have had this same problem on a few of our test computers high cpu usage due to smc.exe I can not pin it down exactly what the problem is, but in our situation the laptops in question had wirless cards installed and they we trying to connect to a unsecure local wireless network while connected to our lan. They were sending packets but getting no response. I dropped the wirless connecting and everything settled down. I have also seen the same problem when a computer has two network cards Endpoint tries to communicate with the wrong card.
We have 80 computers on test at the moment of which 15 had similar problems (Hope the remaining 1500 do not have similar problems)

[Migration User]

Is the NTP component installed?

[Migration User]

Hi

We do not NTP installed we have antivirus/spyware only
We have now also had the same problem with Vista business sp1 wireless network and Windows VPN when the VPN is brought up the smc maxs out If you drop the VPN everything goes back to normal. Logging on to our Lan via RJ45 the laptop comunicates with the console and everything is fine

[Migration User]

This could be a hardware issue please log a case to Symantec Support.

[Migration User]

We have a domain controller/server and the SMC.exe cpu usage hits 60-80%, we have just upgraded our memory, but the same problem exists. SEP version MR3, our symantec nominated local support advised us to use the package for Vista  even though the server is a running  2003 server. is this a valid solution?

[Migration User]

It appears that the clients that are having the issue for me are on a different vlan than the gateway is and 11MR4 MP2 client has problems with this. Also for machines that are dual core the smc.exe will only be using 50% where as single core will use 99%.

[Migration User]

i have the same problem. When the ip's is different of gateway, the smc use 50% of cpu. when i replace the gateway on the same vlan of ip adress no problem......

[Migration User]

Hi,

who is facing that smc.exe uses about 100% of the CPU after the migration to MR4 MP2 and does not have this issue when he downgrades to a previous release, should open a case with the technical support to collect all the required logs to continue this investigation.

Thanks,

[Rob374]

Im using 11.0.4202.75 and its just happened on one of our Windows XP machines

I uninstalled from SAV 10 then installed directly to this version

Im trying to uninstall now and reinstall

In my case - the computer in question moved from one ip address to another (different locations)

[Rob374]

In my case - the computer in question moved from one ip address to another (different locations)

[JerryRejalde]

We also encountered the same issue on Win2k pro, any update from Symantec?

[Migration User]

Are your win2k clients on SP4? does this happen when you use VPN?

[Hogan Chen]

I had same issue in the past, it was due to wrogn default gateway sitting, once changed to correct gateway setting, issue went away and smc.exe running "0" percent of CPU. I would suggest you to do the following troubleshooting to determine the cause of the issue. 1. Remove the client from Add/Remove programs (better use the clean wipe tool) and reboot the machine, 2. install a unmanged package of the client. 3. reboot the system and check smc.exe started to run high percentage of CPU. if the issue stil exist, check whether you have any VPN software that could possibly cause the issue, if the isseu no longer happened, drop the managed group sylink.xml on the client and you should see the issue return right after that, check your network setting, especially the gatewaysettings.

[JerryRejalde]

It's on SP4, no we are not using any VPN client.

[Migration User]

@Jerry

Is NTP (Network Threat Protection) Installed? Please install AV and AS only, create a separate package for it.

[JerryRejalde]

They need NTP, so it is installed. Is there any other solution. 

[Migration User]

Hi Jerry, if you are behind a corporate firewall then there's no need for NTP. Try to do a repair of the SEP installation on the control panel, add/remove programs.

[JerryRejalde]

Paul,
    They need NTP feature eventhough there's a corporate Firewall. You cannot just ask the client to not just install NTP because of that issue. I mean Symantec should look at this issue...
 

[Migration User]

Symantec is aware of this issue:
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009061712031848

We read these discussions, as you can see the short term workarounds are the ones that the customers already found out and reported in this forum.

I suggest you to follow this related discussion as well:
https://www-secure.symantec.com/connect/forums/smcexe-using-50-or-more-processor-while-vpned-office

[Migration User]

One more here with the same problem.

In our case, it's a Windows XP machine, no VPN client installed. The problem appeared just after migrating from MR4 to MR4 MP2.
Besides the high CPU usage, the communication with SEPM seems to be normal.

A little comment:, maybe useful: using Process Explorer (Sysinternals tool) to list the details of the smc.exe process, I saw that the file MSVCR80.dll is who is consuming all this CPU

[Migration User]

After upgraded to 4202 I had two clients experience the SMC.EXE using 50% of CPU cycles. One was a desktop, no VPN and the other was a laptop. both XP pro. How can we identify devices that this problem may occur on?

[Benjamin John]

I think it's already mentioned in this thread... In my case, having the wrong gateway (ipconfig) will cause smc to use 99% of the CPU.

IP: 192.168.1.12
mask: 255.255.255.0
gateway: 192.168.2.1

Gateway should be 192.168.1.1 (unless it really is 192.168.2.1) Even though you may be able to access network resources with the wrong gateway, SEP doesn't like it.

[Clint]

FYI: I'd like to echo chenh's comment about a wrong default gateway setting.  Recently had a single PC where SMC was hitting 99% CPU utilization and the SEP icon in the System Tray didn't have its normal green dot.  A "route print" on the workstation showed the wrong default gateway for that n/w segment.  TCP/IP was configured to use DHCP but for whatever reason, someone had manually entered a default g/w into the Advanced TCP/IP Settings dialogue box.  After deleting this entry, everything returned to normal.

Clint

[Migration User]

Hi all,

SEP 11 RU5 was released a couple of days ago, did someone already test it regarding the issue of the smc.exe process?

Regards,

[Migration User]

I have tested SEP11 RU5 on most of the clients that were having the issue for me and it has been successful thus far.

[Migration User]

hi i faced same problem with MR4 MP2
SMC.exe is taking 99% of CPU usage. then i loged a call with symantec. they told me to upgrade MR5

now in mr5 every thing is working fine. the cpu utilization comes to normal. 

[Migration User]

Please see note below on how stop SMC service on a desktop if its going through the roof

• Open regedit
• HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\SYMANTEC ENDPOINT PROTECTION\SMC\smc_exit_test 1 to 0

Then from the Symantec installed DIR etc c:\program files\symantec\symantec endpoint protection\

Then run.

• SMC –STOP

Then run an upgrade.
after installation run

SMC -start

Then all done !!!

Enjoy.