Agent is crashing due to memory exhaustion

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection (SEP) agent is getting crashed due to memory exhaustion.

Cause

On review of agent (ccSvcHst.exe) crash dump, Listener.dll is found to be causing the fault in this scenario.

Example folder path: C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.1169.0100.105\Data\Definitions\EDRDefs\20210816.004\Listener.dll

On further analysis, the issue was found due to the contents of ccSubSDK folder growing very quickly (reference Article ID: 155680).

This folder filling issue is causing memory exhaustion and Listener.dll to crash because there is no heap memory available to allocate.

Resolution

This issue is fixed in SEP 14.3 RU1.

As a workaround, Client Submissions can be disabled for the clients on lower version of SEP.