High CPU usage, unresponsive Linux commands, and poor system performance after Symantec Endpoint Protection (SEP) for Linux is installed.
This may occur if SEP for Linux compress file scanning is enabled, particularly real-time file scanning (Auto-Protect).
By default, SEP for Linux will include compressed files in manual and scheduled scans--this can be OK, depending on the number and size of the files.
Auto-Protect scans do not normally include compressed files and it is not recommended to change this because of the negative impact on system performance.
To adjust scanning of compressed files in SEP for Linux, see How to configure scanning of compressed files in Endpoint Protection for Linux
See also Scan performance issues with Endpoint Protection for Linux