About Symantec Endpoint Protection for Linux CPU Usage

book

Article ID: 157863

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

Performance reports from a Linux computer that has SEP for Linux installed show high usage of the CPU by a Symantec processes (rtvscand).  This process appears to consume up to 100% of CPU at times.  Is this behavior normal?

 

Resolution

The current release of SEP for Linux is a a multi-threaded application.  Its rtvscand process can have many threads that are actively scanning and cleaning files on the computer.  It is normal to see multiple threads running on multiple cores.

Linux's top utility shows CPU usage as the sum of the CPU usage of all threads, no matter on how many cores it is running. Hence, if rtvscand is using 70% of a single core, 40% of a second core, 20% of a third core and 10% of a fourth core then top will show rtvscand's CPU usage is 140%.  This is normal.  Other tools will show a real-time tree view of a process, including its threads and per-thread CPU usage.

Performance as a whole on modern server hardware should not suffer due to a SEP for Linux scan.