Endpoint Protection Manager slowness or/and login hangs intermittently

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection Manager (SEPM) slowness or login hangs intermittently. During this hang issue clients gradually start disconnecting from the SEPM. Also the standalone reporting URL doesn't work.

Restarting the SEPM service fixes the issue, but eventually the issue comes back.

Environment

SEPM Version: 14.X

Cause

Apache performance issues.

Resolution

Improve the Apache performance as below by tuning Apache for client communication and reporting component.

• Edit the httpd.conf file by increasing the value for "ConnectionsToQueuePerChild" from '500' to '3000', as it was with 12.1.

httpd.conf default location is C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\apache\conf.

• Reduce the TIME_WAIT socket connection numbers if you see a buildup of TIME_WAIT connections in the log by creating a following registry entries:
  
  TcpTimedWaitDelay
Registry value:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpTimedWaitDelay
Value Type: REG_DWORD
Data: 30 (decimal)

MaxUserPort
Registry value:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\MaxUserPort
Value type: REG_DWORD
Data: 65534 (decimal)
   
• Throttle the agent registration by adding the following 3 parameters in the conf.properties file:
  scm.agentregistration.throttle.low=5
scm.agentregistration.throttle.high=10
scm.agentregistration.throttle.leak=100
  
  
• Reduce the objects cache by adding the following to the conf.properties file:
  scm.cache.threshold=600

conf.properties file is located at C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\tomcat\etc

• If possible, reduce the LiveUpdate frequency on the SEPM to 8h and increase the heartbeat interval of all the groups to at least 30min in a pull mode.
   
• Disable Application Learning temporarily.
   
• If the SEPM is in a virtual machine, check for the following issue: https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2129176
   
• Check if there are any legacy clients forwarding the logs to the SEPM. If yes disable this option temporarily.
   
• Restart the SEPM server for changes to take place and confirm that it fixes the issue.