ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

SymDaemon process causes high CPU usage


Article ID: 161933


Updated On:


Endpoint Protection


The SymDaemon process may consume a high amount of CPU in Symantec Endpoint Protection (SEP) for Mac.


This can be caused by compressed file scanning in SEP for Mac, and some relief may be obtained by disabling compressed file scanning where it is unnecessary. 

Use the most current version of SEP for Mac


Compressed file scanning is typically not recommended, especially for AutoProtect. Extra CPU resources are required to decompress and examine such files. If there are any risks in compressed files they do not present a threat unless decompressed and SEP AutoProtect scanning would catch the risk if the file was decompressed during normal file operations.

See How to Disable Scanning of Compressed Archives in SEP for Mac

If compressed file scanning has been disabled and symptoms persist, please open a case with Symantec Technical support. Enable symdaemon debug logging and gather the following data when SymDaemon CPU usage is high:

  • GatherSymantecInfo report (including "Useful data NOT collected by GatherSymantecInfo" described at bottom of that article.)
  • A leaks report, via command line:
    sudo leaks SymDaemon > leaks.txt
  • A process sample report of SymDamon from Activity Monitor:
    run Activity Monitor, choose View->All Processses, select SymDamon process, and View->Sample Process, save report.
  • SymDaemon fs_usage logging, gathered for a few minutes while CPU usage is high.