Scheduled scans are taking 8 hours, or more, to complete

Products

• Endpoint Protection

Issue/Introduction

You notice that on some computers, scheduled scans can take up to 8 or more hours to complete when configured for "Best Application Performance" or "Balanced Performance".  This also prevents other manual or scheduled scans from starting.

The following entries can be seen in the vpdebug logs during the scan.  

11:58:50.528579[_1168][_5024]|ScanThrottling: User is not Idle. Sleeping 3000 ms for the Best Application Performance scan.

After 8 hours, you will see the following entry:  

11:59:02.528579[_1168][_5024]|ScanThrottling: Past unthrottling threshold. Continue to scan. 

 

Cause

Since 12.1 RU5 the scan job manager functions had some overly sensitive idle time detection algorithms that were causing scans to unnecessarily pause.

Symantec Endpoint Protection (SEP) minimizes the impact of scans on computer performance by throttling scans when a computer is busy.  Scans are configured to use the "Best Application Performance" setting by default.  This means that if a computer is busy, the scan will delay for 3 seconds (3000ms).  SEP will continue to check if the computer is busy every 3 seconds.  If the computer remains busy, the scan can be delayed for up to 8 hours.  After 8 hours, throttling of the scan is disabled regardless of whether the computer is idle or not.

Resolution

This issue is fixed in Symantec Endpoint Protection 12.1.6.8 (RU6 MP8) and 14.0.0.2 (MP2).  For information on how to obtain the latest build of Symantec Endpoint Protection, see Download the latest version of Symantec Endpoint Protection.