High CPU Usage on Symantec Endpoint Protection for Macintosh clients with NAVX process

Products

• Endpoint Protection

Issue/Introduction

After installing the Symantec Endpoint Protection for Macintosh (SEP for Mac) client, higher CPU usage is noted on the workstation - most notably with the NAVX process. Although the settings for the scans performed by NAVX have been tuned via policy with respect to compressed files, etc. a User may still notice higher than normal CPU usage when using the top command in the Terminal, or by checking with Activity Monitor in the Utilities folder.

Resolution

The NAVX process is the command line scanner used by SAV for Macintosh and SEP for Mac versions 11 RU6 thru 12.1 RU4 only--NAVX is not present in newer versions of SEP.

NAVX is the process used in those versions when scheduled scan events are triggered, either by a local user scheduling a scan, or when a SEPM Administrator schedules a scan via policy for a User's system. There can be a spike in CPU usage with NAVX in the following situations:

• The initial scan of the drive as the QuickScan database file is created
• Scans of large files
• Scans of compressed files

Adjusting NAVX via policy or through the Auto-Protect preferences on an unmanaged system to not scan compressed files can help alleviate some CPU-related issues with respect to NAVX. However, a User may still see at times NAVX using what appears at first glance to be a disproportionate amount of CPU time. In this case, please note the following:

NAVX is a multithreaded application with a low priority. When the CPU is idle, Mac OS X will allow NAVX to run and give it more CPU time in order to accomplish its scanning tasks. When another process with a higher priority requests CPU time, as NAVX is multithreaded, it will continue to work with a reduced CPU rate as the higher priority task is given more CPU time by Mac OS X. As a result, when a system sits idle NAVX will appear to be taking a large chunk of CPU time when a scan is running and no other tasks are requesting CPU time when viewed in Activity Monitor or in the Terminal with the top command.

Furthermore, NAVX is a single-core process. This means that when NAVX is running on a system to perform a scan, the percentage of CPU usage recorded, either at idle time, or when other processes are running at a higher priority taking CPU time from NAVX, the NAVX process runs on just one core of the processor. The remaining cores remain free for all other processes on the system to use. As all modern Intel-based Macintosh systems are multi-core, NAVX is using a significantly reduced amounts of CPU on average when other running processes are in use than what may be observed when the system sits idle.