Troubleshooting high CPU usage by sisamddaemon when Auto-Protect is enabled

Products

• Endpoint Protection
• Endpoint Security Complete

Issue/Introduction

When looking at resource utilization of Symantec Endpoint Protection (SEP) Linux Agent, you notice that sisamddaemon is using a large amount of CPU resources.  The issue goes away when Auto-Protect scanning is disabled.  (/opt/Symantec/sdcssagent/AMD/tools/sav autoprotect -d) 

Environment

Symantec Linux Agent (14.3 RU1 or later)

Cause

By default, Auto-Protect will scan any file that is accessed or modified.  On busy servers, this activity can cause high CPU usage when installed applications have heavy disk utilization. 

Resolution

To resolve the issue, you can make exclusions for known good software and files that are frequently accessed.  You can determine which files Auto-Protect is scanning by monitoring scan activity for 10 minutes. To do this:

1. Login as root account or equivalent (who allow to become root or to run sudo)
2. Run following command (root can run a command as sisips uid without password)

su - sisips -c "./sisipsconfig.sh -approfile 10"  

=> this will start profiling the Auto-Protect scan activity for 10 minutes.

3. If high CPU usage is seen, note the time.
4. Collect and check the following log for what AP scanned at that time and make appropriate exclusions.
/var/log/sdcsslog/amdlog/profile.log

Note: Only files marked as 'Completed' in the profile log were actually scanned.  Excluded files will show in the profile log, but should not show as 'Completed'. If they do, exclusions should be verified.