ccSvcHst.exe spikes CPU at 100% for 5 to 7 minutes on single core servers

Products

• Endpoint Protection

Issue/Introduction

Intermittent 100% CPU usage by ccSvcHst.exe in a virtual machine with a single CPU core and Symantec Endpoint Protection (SEP) 14.0 (MP1, MP2). This lasts for about 5 to 7 minutes.

Environment

SEP 14.0 (MP1, MP2)

Cause

While internal testing did not reveal any performance issue on single core virtual servers, it was determined empirically that unknown environmental conditions on such a system may cause the RegSetValueExA Windows API function to finish 10000 times more slowly than normal. Because SEP waits for the completion of this API call in an endless loop, it results in high CPU usage (for single core systems only). The delay amounts to 6 minutes.

Resolution

This issue has been resolved in Symantec Endpoint Protection 14 RU1 or later, by preventing the endless loop that lead to the high CPU usage. Alternatively, adding another core to the virtual machine will avoid the issue.