Performance issues when running the Linux client

Products

Endpoint Protection

Issue/Introduction

Performance issues occur when using Symantec Endpoint Protection (SEP) for Linux. The sisamddaemon process may consume above-average resources.

Cause

By default, SEP for Linux is configured to scan for the highest level of security, not the best performance. Auto-Protect may also consume additional resources when scanning compressed files, especially large archive formats (it can only scan 3 archive levels maximum).

Resolution

Disable scanning of compressed files and remote file systems

Scanning of compressed files can be resource intensive. If scanning of compressed files is required by your company's security policy, either perform the scan manually or set a scheduled scan during off-peak hours.
For best performance, files should be scanned by the local host and not by remote clients.

In Symantec Endpoint Protection Manager (SEPM), click Policies > Virus and Spyware Protection.
Select your antivirus (AV) policy, expand Linux Settings, and then under Protection Technology, select Auto-Protect.
On the Scan Details tab, click on Advanced Scanning and Monitoring, and uncheck Scan files inside compressed files (if checked)
Uncheck Scan files on remote computers.
- You can check for NFS mounts locally by running:
```
findmnt -t nfs,nfs4
```
Click OK to save the policy and assign it to the client group.

Confirm sisamddaemon is not CPU pinned

SEP for Linux spawns multiple threads to scan and clean files concurrently across available cores. Pinning the client to a single core can artificially throttle its ability to process data, which can lead to scan backlogs and system-wide file I/O latency.
See About Symantec Endpoint Protection for Linux CPU Usage for more information

Check how many cores the device has
```
nproc
```

Locally run the commands:

pgrep sisamddaemon
taskset -cp <PID of sisamddaemon)

Linux indexes CPU cores startng at zero, an unpinned process will show a range from 0 to one less than your nproc result
- Example: if nproc outputs 8, then the taskset output should show an affinity list of 0-7
- if taskset returns a single number (e.g., 2) or a smaller, restricted range (e.g., 0-3 when you have 8 cores), the daemon is CPU pinned.

Determine if exclusions are needed
1. Collect Auto Protect profiling logs
2. Review the logs and add exceptions for known good software and files that are frequently accessed.
Modify Scan Settings
Scanning all operations can increase resource utilization. See Linux Auto-Protect: Advanced Scanning and Monitoring and "Scan when a file is accessed or modified" vs "Scan when a file is modified"?
1. In Symantec Endpoint Protection Manager (SEPM), click Policies > Virus and Spyware Protection.
2. Select your antivirus (AV) policy, expand Linux Settings, and then under Protection Technology, select Auto-Protect.
3. On the Scan Details tab, click on Advanced Scanning and Monitoring
4. Change the Scan Files When setting to Scan when a file is modified (instead of "Scan when a file is accessed or modified")
Set CPU quota to limit CPU
As a last resort, you can configure a maxiumum CPU quote.
These settings will be lost on system reboot unless you create a cron job on startup.
- Run command:
```
systemctl set-property --runtime sisamddaemon CPUQuota=40%
```
  Tis example caps each cpu to 40% AMD, so if you have 4 cores, you could still see a maximum of 160% CPU being used (40% x 4 cores).