When installing Symantec Critical System Protection agent on Unix servers with prevention feature enabled, system performance degrades noticeably when the system has a large number of active processes.
SCSP maintains a data structure that contains information about all the active processes and dead processes whose children are active. For every file system access call, the Symantec Critical System Protection kernel driver traverses this list of information. The traversal time of linked lists increases with the number of active processes in the system, leading to system wide performance degradation.
This issue has been resolved in SCSP Agent 5.2 RU8 MP3 HF1, 5.2 RU8 MP4 or above
The fix replaces the linked list with a hashed list, allowing for much higher performance during information lookup. This fix reduces the access time to the data structure resulting in improved performance.
Symantec Critical System Protection version: 5.2.5 and newer
Note: Issue originally discovered on an AIX platform, but could happen on other platforms as well if there are a large number of processes running.