This plan requires contacting support due to the nature of the ETL data. If a utility such as Process Explorer is used to identify the PID/TID pair responsible for the bulk of CPU utilization during issue reproduction the ETL log can then be reviewed to see what activity the thread is performing.
ETL events are tied to Process ID (PID) and Thread ID (TID) pairs. Symantec Endpoint Protection (SEP) generates Windows Preprocessor (WPP) events which can be written out in Event Tracing Log (ETL) format. Please open a support case for assistance. Is defwatch possibly related to the issue we are experiencing? The only solution is to reboot as you cannot run another scan. No excessive CPU utilization is occurring. I see a defwatch scan right now on the W7 machine that started over 4 hours ago and has NOT completed. I have also noted on a couple of machines (a W7 and a W10) that occasionally defwatch scans never show completion in the scan log.
No scans are running and live update is not running. I have left the machines alone for over an hour and the CPU percentage never returns to normal. The problem machines stay at these percentages and fan noise increases as the CPU usage heats up the machines. I have noted similar usage numbers during defwatch scans but that usage always drops when the scans are completed. The others show 13%-15% constant usage until reboot. In Martijn Groothuis's graphic I have seen 2 of the machines show the same 25% usage that remains steady until a reboot. I have 4 different physical machines that have experienced this problem. Has anyone run into this issue yet? I thought I would start here before possibly reaching out to support. I have seen this issue on w10 and w7. It has occurred on normal client installs and dark installs, None of the machines are running Application and Device control and they receive updates directly from the Symantec Live Update server (not the internal management server). The only solution appears to be a reboot and then things settle down. This morning I had 2 Win 10 Pro Ver 1607 machines consuming 25% CPU and 120,000 K of memory. The machine has remained in this state for several hours and I will reboot shortly. Memory usage is now over 291,000 K and is slowly growing. I have a Win 7 machine right now that is using 13% CPU and was using 288,000 K of memory. I walked by the machine and noticed the fans were running faster than normal. I first noticed this on a Win 7 machine several weeks ago.
This occurs even when a scan is NOT running. What I am seeing is from time to time (might be days) the process ccSvcHst.exe (user System) will start consistently consuming 15% – 25% of cpu cycles and remain at this number indefinitely. I have ver 14 installed on 5 different managed client machines here at my home for testing before rolling it out to our work machines (all running 12.1.6 MP6). If the issue I am about to report is discussed elsewhere a link would be appreciated and my apologies.
0 kommentar(er)
