Client scan performance tuning options

Products

• Endpoint Protection

Issue/Introduction

Additional information about Symantec Endpoint Protection scan tuning options.

Resolution

Tuning the performance of scheduled scans can be accomplished on the Symantec Endpoint Protection Manager (SEPM) within the Antivirus/Antispyware policy via Scheduled Scan > Advanced Scanning Options > Tuning.  Tuning the performance of on-demand scans can be done in the Antivirus/Antispyware policy, under Administrator Defined Scans > Administrator On-Demand Scan Settings > Advanced Scanning Options > Tuning.

The Scan Tuning feature in Symantec Endpoint Protection works by monitoring file Input and Output (IO). If Symantec Endpoint Protection is doing most of the file IO, the scan will continue unthrottled. If another process is performing a large amount of IO then Symantec Endpoint Protection will throttle the scan until the IO caused by other processes is reduced. If a scan is throttled, Symantec Endpoint Protection will continue to scan but at a much slower speed.

On Windows, the tuning options behave as follows:

• Best Scan Performance – Symantec Endpoint Protection scans as fast as it can. No throttling is done.

• Balanced Performance – Symantec Endpoint Protection will throttle if other processes are doing a lot of IO. If other processes are doing some, but not a lot of IO, then Symantec Endpoint Protection will not throttle the scan.

• Best Application Performance – Symantec Endpoint Protection gives preference to other applications. If other processes are doing some IO, Symantec Endpoint Protection will throttle the scan until the amount of IO by the other processes goes down.

Symantec Endpoint Protection scan tuning does not change the scan process priority; instead, it uses the more efficient method of monitoring file IO as described above.

On macOS, the tuning options behave differently:

• Best Scan Performance – Symantec Endpoint Protection will fully utilize up to four cores (400% CPU).

• Balanced Performance – Symantec Endpoint Protection will fully utilize to two cores (200% CPU).

• Best Application Performance – Symantec Endpoint Protection will fully utilize a single core (100% CPU).