search cancel

SymDaemon process causes high CPU usage

book

Article ID: 161933

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

The SymDaemon process may consume a high amount of CPU in Symantec Endpoint Protection (SEP) for Mac.

Cause

This can be caused by compressed file scanning in SEP for Mac, and some relief may be obtained by disabling compressed file scanning where it is unnecessary. 


Resolution

Compressed file scanning is typically not recommended, especially for AutoProtect. Extra CPU resources are required to decompress and examine such files. If there are any risks in compressed files, they do not present a threat unless decompressed. In that case SEP AutoProtect scanning would catch the risk if the file was decompressed during normal file operations.

See How to Disable Scanning of Compressed Archives in SEP for Mac

If compressed file scanning has been disabled and symptoms persist, please open a case with Symantec Technical support. Enable symdaemon debug logging and gather the following data when SymDaemon CPU usage is high:

  • GatherSymantecInfo report (including "Useful data NOT collected by GatherSymantecInfo" described at bottom of that article.)
     
  • A leaks report using the command line:
    sudo leaks SymDaemon > leaks.txt
     
  • A process sample report of SymDaemon from Activity Monitor:
    run Activity Monitor, choose View->All Processes, select the SymDaemon process, and View->Sample Process, save report.
     
  • SymDaemon fs_usage logging, gathered for a few minutes while CPU usage is high.

Additional Information

Use the most current version of SEP for Mac.