Symantec Endpoint can cause major performance issues with CA Network Flow Analysis.

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

Problem:

NFA demonstrates poor performance when Symantec Endpoint is installed on NFA servers including:

• Slow data processing.
• Slow query processing causing queries to timeout.
• Causes Anomaly Detector queries to hang and timeout on Harvesters.
• GUI Performance Issues. 

Environment:

All versions of NFA.

 

Cause:

Symantec Endpoint operates at the System Kernel level which mean that even just excluding specific directories or disabling services does not help NFA performance.

We have not seen this issue with other anti-virus programs to date, when they are set to exclude C:\Windows\Temp and <install_path> and all its subdirectories as documented in the NFA documentation.

  

 

Environment

Release: RAIB1H99000-9.3-Network Flow Analysis-Interface Bundle-Hardware
Component:

Resolution

Solution:

Completely uninstall the Symantec Endpoint software from all NFA servers and reboot each server.

This should result in major performance improvements with your NFA environment so long as your systems meet the current specifications in the NFA Documentation.