symcscan.exe is consuming high memory even when Protection Engine is not running any scan

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

symcscan.exe is consuming high memory even when Symantec Protection Engine (SPE) is not running any scan

Environment

SPE 8.2.x

Cause

This high memory usages is because "buff.current" file loaded in memory for URL filtering/reputation.

Resolution

If symcscan.exe is experiencing high memory usage, please check below conditions:
1. URL filtering feature is disabled 
2. C:\Program Files\Symantec\Scan Engine\Definitions\Stargate\data\sef\webpulse_cache\buff.current file present.

If above conditions are met, then perform below steps to fix High Memory usages in Symcscan.exe service:
1. Stop Symantec protection engine service from service controller
2. Delete <stargate_home>\data\sef
3. Start SPE service.

Note: stargate_home=C:\Program Files\Symantec\Scan Engine\Definitions\Stargate

This workaround will work only if the Stargate engine is at 8.1.10.121 version and above.
If URL filtering/reputation is enabled then High memory usage is expected in SPE service even if SPE is idle. And this is normal.

Note: It is advised to add approximately 4 GB of additional physical memory if URL Reputation/URL Filtering feature is enabled.