Endpoint Protection

 View Only
Expand all | Collapse all

Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

  • 1.  Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 21, 2012 01:02 PM

    Hey guys,

     

    We were running 11.0.6 and have updated to 12.1.1000. We did this to solve this problem in this tech note.

     

    http://www.symantec.com/business/support/index?page=content&id=TECH158110

     

    The problem is we are still seeing the same issue. High cpu utilization, and memory usage. At least with 11.0.6 we could kill the process not it just respawns after 2 seconds.



  • 2.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 21, 2012 02:33 PM

    I'm running OS 11.0.7101 and having same issue of high CPU and memory climbing usage. But after killing the process, it re-appears after two seconds. So not being able to kill it also applies to OS 11.0.7.

     

    I saw this issue last week and guessing it was pushed by my admin.  How long has your issue been occuring?



  • 3.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 21, 2012 06:26 PM

    Which Mac OS are you running, 10.6? Is there a directory service integration in use (as noted in the document--just for curiosity's sake)?

    If you can, please provide screenshots from Activity Monitor showing the CPU/memory usage. Thanks!

    sandra



  • 4.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 12:56 AM
      |   view attached

    I'm running Mac OS 10.6.8. 

    How to determine if there's a directory service integration in use?

    Attaached is a screen shot from Activity Monitor.

    Thanks.



  • 5.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 09:30 AM
      |   view attached

    Sandra, Thank you for your reply.

     

    Yes we are running 10.6.8 and we are connecting to an active directory server.



  • 6.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 11:14 AM

    I've been consulting with a colleague. Please try the following:

    1. On the Go menu, click Applications.
    2. Open Utilities.
    3. Open Terminal.
    4. At the prompt, type the following:

      sudo rm -r ~/Library/Preferences/com.Symantec.schedScanResults

       
    5. Press return.
    6. Type your administrator password.
    7. Press return.
    8. Quit Terminal.

    I've deleted this file myself (same OS as you, SEP 12.1) and have seen no ill effects.

    Thanks,

    sandra



  • 7.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 11:32 AM

    Sandra, It looks like that was a folder. I removed mine, what should we expect to see now? The process is still running. Would we need to reboot or should removing that eventually change something?

     

    EDIT: interesting enough we piloted 12.1 to 6 users. 3 users including me have the scannotification at the top at 50% and the other 3 do not. All 5 are the same machines with the same deployed image. All 6 were upadated and not a fresh install.



  • 8.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 01:44 PM

    Please try rebooting, thanks. (the -r switch should have deleted it and everything in it.)

    Do you also still see configd at the top using more CPU, as in the screen shot? If you click on ScanNotification in Activity Monitor, is there an indication below of how many cores are involved?

    For what it's worth, I show the process as running, but shows 0.0% CPU usage.

    sandra



  • 9.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 02:11 PM

    I copied pasted the following command at the profile level in Terminal prompt (computer name: ~username$):

    sudo rm -r ~/Library/Preferences/com.Symantec.schedScanResults
     

    And received the following result:

    No such file or directory

     

    Is the file located in another directory or is there another command to delete the schedScanResults file?



  • 10.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 04:01 PM

    Apologies--leave out the tilde.

    sudo rm -r /Library/Preferences/com.Symantec.schedScanResults

    When I deleted it, it regenerated itself on reboot.

    sandra



  • 11.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 04:12 PM

    Sandra, is whats in that folder telling the program when the last scan was complete? If it gets corrupt is that why maybe the scan never stops or get stuck?

    I have not been able to reboot yet. I am still testing some things.

     

    I have an i7 with 8 cores It is going across the 4 real cores.



  • 12.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 04:22 PM

    Corrupted preference is what we're thinking, based on information I found.

    sandra



  • 13.  RE: Endpoint Protection Mac updated to 12.1 ScanNotification process still using high cpu

    Posted Feb 22, 2012 07:15 PM
      |   view attached

    Sandra,

    The command without the tilda worked. I even rebooted once, and did not see the ScanNotification process running.  Will let you know if it re-appears for some reason.

    Thanks.