Weekly Scheduled scan does not abort after specified time

Products

• Endpoint Security Complete

Issue/Introduction

There have been specific instances whereby weekly scheduled scans have continued past a defined period of time. The scans(Best Application Performance) have still continued and have not aborted.

 

Cause

What's happening is that due to the number of files being scanned, SEP spent the entire time enumerating files trying to get to the resumption point where the scan was previously paused.  If we honored the time window while trying to locate the resumption point, we may never scan anything if we are unable to get to the resumption point in the available time.

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/Dialog-Overview/virus-and-spyware-protection-dialog/advanced-scanning-options-tuning-v8132730-d49e11486.html

What is meant by the recommendation to have at least four logical processors when using the "Best Scan Performance" throttling option is that with fewer logical processors, SEP may starve other processes of CPU time. SEP can utilize two logical processors fully while scanning, so a system with only two logical processors could spend all available CPU cycles on scanning, leaving none for other processes.

While the other throttling policies would briefly pause the scan if CPU usage is high, "Best Scan Performance" will not throttle under any circumstances.

Having four or more logical processors is also useful for "Best Application Performance" and "Balanced Scan Performance" scans, since these scans will throttle when the SEP processes account for 55% and 65% of CPU usage, respectively. Having more total CPU cycles means the scan is less likely to throttle.

Resolution

There is a need  to either use a longer scan duration or not limit it, upgrade the H/W due to the load (4 logical CPUs or more), or both.