ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

About Symantec Endpoint Protection for Linux CPU Usage


Article ID: 157863


Updated On:


Endpoint Protection


Performance reports from a Linux computer that has SEP for Linux installed show high usage of the CPU by a Symantec processes (rtvscand).  This process appears to consume up to 100% of CPU at times.  Is this behavior normal?



The current release of SEP for Linux is a a multi-threaded application.  Its rtvscand process can have many threads that are actively scanning and cleaning files on the computer.  It is normal to see multiple threads running on multiple cores.

Linux's top utility shows CPU usage as the sum of the CPU usage of all threads, no matter on how many cores it is running. Hence, if rtvscand is using 70% of a single core, 40% of a second core, 20% of a third core and 10% of a fourth core then top will show rtvscand's CPU usage is 140%.  This is normal.  Other tools will show a real-time tree view of a process, including its threads and per-thread CPU usage.

Performance as a whole on modern server hardware should not suffer due to a SEP for Linux scan.