• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs

Not what you are looking for? Ask the experts!

Kudos0

SymAVScanDaemon pegging my CPU

The SymAVScanDaemon is beating on one of my external disks, and sucking between 50-150% of my CPU.  I let it run for a day in hopes that it would finish whatever scan it's working on, but it hasn't completed and there's no way to know what kind of progress it's making.  It has currently run for 17:20:38.60 CPU hours.

I don't think that the Daemon is in a healthy state.  In the console, every three or four seconds or so, I see:

7/3/2009 1:47:16 PM com.apple.launchd[175] (com.symantec.uiagent.application[62614]) Exited abnormally: Bus error
7/3/2009 1:47:16 PM com.apple.launchd[175] (com.symantec.uiagent.application) Throttling respawn: Will start in 4 seconds
7/3/2009 1:47:22 PM /Library/Application Support/Symantec/SymUIAgent/SymUIAgent.app/Contents/MacOS/SymUIAgent[62616] Norton AntiVirus QuickMenu could not connect to SymSharedSettings (Invalid settings)
7/3/2009 1:47:26 PM ReportCrash[62617] Formulating crash report for process SymUIAgent[62616]
7/3/2009 1:47:27 PM ReportCrash[62617] Saved crashreport to /Users/dondo/Library/Logs/CrashReporter/SymUIAgent_2009-07-03-134722_SilverSurfer-7.crash using uid: 501 gid: 501, euid: 501 egid: 501
7/3/2009 1:47:27 PM com.apple.launchd[175] (com.symantec.uiagent.application[62616]) Exited abnormally: Bus error
7/3/2009 1:47:27 PM com.apple.launchd[175] (com.symantec.uiagent.application) Throttling respawn: Will start in 4 seconds
7/3/2009 1:47:33 PM /Library/Application Support/Symantec/SymUIAgent/SymUIAgent.app/Contents/MacOS/SymUIAgent[62621] Norton AntiVirus QuickMenu could not connect to SymSharedSettings (Invalid settings)
7/3/2009 1:47:33 PM /Library/Application Support/Symantec/SymUIAgent/SymUIAgent.app/Contents/MacOS/SymUIAgent[62621] Norton AntiVirus QuickMenu could not connect to SymSharedSettings (Invalid settings)
7/3/2009 1:47:33 PM /Library/Application Support/Symantec/SymUIAgent/SymUIAgent.app/Contents/MacOS/SymUIAgent[62621] Norton AntiVirus QuickMenu could not connect to SymSharedSettings (Invalid settings)
7/3/2009 1:47:37 PM ReportCrash[62622] Formulating crash report for process SymUIAgent[62621]
7/3/2009 1:47:38 PM ReportCrash[62622] Saved crashreport to /Users/dondo/Library/Logs/CrashReporter/SymUIAgent_2009-07-03-134733_SilverSurfer-7.crash using uid: 501 gid: 501, euid: 501 egid: 501
7/3/2009 1:47:38 PM ReportCrash[62622] Saved crashreport to /Users/dondo/Library/Logs/CrashReporter/SymUIAgent_2009-07-03-134733_SilverSurfer-7.crash using uid: 501 gid: 501, euid: 501 egid: 501  
  [continues] 

Replies

Kudos0

Re: SymAVScanDaemon pegging my CPU

This 20k character limit is a pain in the posterior, particularly since you don't tell me how many characters my attempt took. The crashreporter file, part 1:  Process:         SymUIAgent [62621]
Path:            /Library/Application Support/Symantec/SymUIAgent/SymUIAgent.app/Contents/MacOS/SymUIAgent
Identifier:      com.symantec.uiagent.application
Version:         2.0.1 (5)
Code Type:       X86 (Native)
Parent Process:  launchd [175]

Date/Time:       2009-07-03 13:47:33.566 -0700
OS Version:      Mac OS X 10.5.7 (9J61)
Report Version:  6
Anonymous UUID:  91A80943-4B7D-42D5-B88C-D066D0E8849D

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000004
Crashed Thread:  0

Thread 0 Crashed:
0   libSystem.B.dylib              0xffff01a4 __atomic_add32 + 4 (cpu_capabilities.h:230)
1   APQuickMenu                    0x004bad51 0x4b8000 + 11601
2   APQuickMenu                    0x004ba118 0x4b8000 + 8472
3   APQuickMenu                    0x004b9da6 0x4b8000 + 7590
4   com.symantec.quickmenu         0x00483e1b sortByName + 1526
5   com.symantec.quickmenu         0x00483a51 sortByName + 556
6   com.symantec.quickmenu         0x00482aa1 0x481000 + 6817
7   com.symantec.quickmenu         0x004829ec 0x481000 + 6636
8   com.symantec.quickmenu         0x00482957 0x481000 + 6487
9   ...ymantec.uiagent.application 0x00003509 -[UIAgentApplication applicationWillFinishLaunching:] + 859
10  com.apple.Foundation           0x942fb43a _nsnote_callback + 106
11  com.apple.CoreFoundation       0x91de364a __CFXNotificationPost + 362
12  com.apple.CoreFoundation       0x91de3923 _CFXNotificationPostNotification + 179
13  com.apple.Foundation           0x942f8690 -[NSNotificationCenter postNotificationName:object:userInfo:] + 128
14  com.apple.Foundation           0x94301ee8 -[NSNotificationCenter postNotificationName:object:] + 56
15  com.apple.AppKit               0x9114c8ad -[NSApplication finishLaunching] + 515
16  com.apple.AppKit               0x9114c333 -[NSApplication run] + 83
17  com.apple.AppKit               0x91119834 NSApplicationMain + 574
18  ...ymantec.uiagent.application 0x00002498 _start + 210
19  ...ymantec.uiagent.application 0x000023c5 start + 41

Thread 1:
0   libSystem.B.dylib              0x9456f286 mach_msg_trap + 10
1   libSystem.B.dylib              0x94576a7c mach_msg + 72
2   libSystem.B.dylib              0x945e41e7 mach_msg_server + 675
3   ...ec.sharedsettings.framework 0x0013c292 ZssStString::operator=(ZssSymbol*) + 1508
4   libSystem.B.dylib              0x945a0155 _pthread_start + 321
5   libSystem.B.dylib              0x945a0012 thread_start + 34
 [continues] 
Kudos0

Re: SymAVScanDaemon pegging my CPU

Aha.  Info attached.
File Attachment: 
Kudos0

Re: SymAVScanDaemon pegging my CPU

dondo,

It looks like SymAVScanServer is actually not pegging the CPU, but our alerting application (SymUIAgent). You can confirm this by looking in Activity Monitor.

However the real issue is this line in your syslog (which was very helpful, thanks!): 

/3/2009 1:47:33 PM /Library/Application Support/Symantec/SymUIAgent/SymUIAgent.app/Contents/MacOS/SymUIAgent[62621] Norton AntiVirus QuickMenu could not connect to SymSharedSettings (Invalid settings)

It seems as if somehow your settings file for Norton AntiVirus became corrupted. It might have been because your computer shut down unexpectedly, or something happened while we were trying to write the settings.

The easiest way to fix this is to simply uninstall & reinstall. This is unfortunate,  and I'm going to push for a simpler solution to this. If for some reason you cannot uninstall, you can try the following (I've never tried this before so it may not work:)

1. Open the Terminal application in your Applications -> Utilities folder.

2. Type (or copy & paste), without the quotes "sudo rm -f /Library/Application\ Support/Symantec/Settings/1/com.symantec.nortonantivirus*"

Press return, type your password when asked and then restart your computer. If it works, that will delete the corrupted settings file and help get things working again.  If you can't get that to work, or aren't comfortable with Terminal, try un-installing and re-installing. Very sorry for the inconvience.

Ryan

Message Edited by ryan_mcgann on 07-04-2009 05:49 PM
Ryan McGannPrincipal Software EngineerMacintosh Products & SolutionsSymantec
Kudos0

Re: SymAVScanDaemon pegging my CPU

Thanks, Ryan.  

In the original post, I noted:

The SymAVScanDaemon is beating on one of my external disks, and sucking between 50-150% of my CPU.  I let it run for a day in hopes that it would finish whatever scan it's working on, but it hasn't completed and there's no way to know what kind of progress it's making.  It has currently run for 17:20:38.60 CPU hours.
That information was from the activity monitor; it was definitely the SymAVScanDaemon which was eating my CPU.  From what you say, there may have been a couple problems.

Unfortunately, I couldn't wait another day for resolution, so I force-quit the SymAVScanDaemon which immediately resolved the CPU issues (but undoubtedly leaves me unprotected for the nonce).  

I'll let you know if it recurs.

Kudos0

Re: SymAVScanDaemon pegging my CPU

I am very unsatisfied with this product. 

There are definitely two problems, possibly related, one more serious than the other.

The more serious problem is that every time SymAVDaemon runs it pegs my CPU (100+%).  This occurs primarily when I connect my external hard drives, though it has happened once on startup.  I am forced each time to kill the daemon by hand, which undoubtedly obviates much of the benefit your product offers in the first place.

I have had situations where my CPU has unusually high load (70-80%) while the console shows the issue with com.symantec.uiagent.application  having a bus error every several seconds.  I do not know what triggers this, nor how to stop it.

I have been unable to uninstall/reinstall.  When I run the Symantec Uninstaller it reports that "The Symantec Uninstaller did not find any Symantec products to uninstall.  The Symantec Uninstaller removes Symantec products from the current startup disk only."

Also, in an unrelated but perhaps symptomatic issue, I just asked your forums to resend my login/password and you sent my password in an email IN PLAINTEXT.  You're a security company?

Kudos0

Re: SymAVScanDaemon pegging my CPU

Sorry to hear about the problems. It sounds like you could just disable Auto Disk Scan which would fix the problem. I don't know what is causing the error, but disabling Auto Disk Scan should fix it if this issue occurs whenever you connect an external hard drive.

Auto Disk Scan is more of a convience feature than a security feature. AutoProtect will still catch any viruses on the external drive when they are accessed. 

I am not sure why you're having problems with the Uninstaller. I can send you a script we have that will delete files from your machine if you send me a PM with your email address in it.

Ryan 

Ryan McGannPrincipal Software EngineerMacintosh Products & SolutionsSymantec
Kudos0

Re: SymAVScanDaemon pegging my CPU

Your product does not work.  I want to uninstall it.

Your uninstaller doesn't work.

You did not respond to the PM I sent a couple weeks ago.  

I'll try again.  Please send me the scripts so I can stop your product from degrading my system's performance.

Kudos0

Re: SymAVScanDaemon pegging my CPU

You never explained what problems you have with the uninstaller. Did you try using the Uninstaller to remove the product, and if so, what problems did you experience?

Ryan 

Ryan McGannPrincipal Software EngineerMacintosh Products & SolutionsSymantec
Kudos0

Re: SymAVScanDaemon pegging my CPU

Per the post above dated 07-20-2009 01:56 PM:

<blockquote> 

I have been unable to uninstall/reinstall.  When I run the Symantec Uninstaller it reports that "The Symantec Uninstaller did not find any Symantec products to uninstall.  The Symantec Uninstaller removes Symantec products from the current startup disk only."

</blockquote>

Kudos0

Re: SymAVScanDaemon pegging my CPU

Sorry, didn't see that. Too many things going on these days. Did you simply try re-installing as I suggested?

The uninstaller is pretty simple; it simply looks in /Library/Receipts to determine what you have installed. It sounds like something got corrupted on your computer because if no Symantec products are in /Library/Receipts, then a lot of things could be missing. It could be that your Receipts folder was removed by some other product, or Apple's installer itself. This could be the reason for your other problems as well. I'd try re-installing. Apple's installer is a little brain dead on Leopard as well--it'll just look in /Library/Receipts, see that Norton AntiVirus isn't installed already (since it's not there in your receipts) and re-install.

If that doesn't work we'll have to manually remove some parts of it. That's where the script I referenced comes into play, but it's rather brute force. It actually relies on /Library/Receipts in part, so it's best to have those there even when removing. (Apple has acknowledged problems with the Receipts mechanism, which is why in Snow Leopard they are gone.)

Ryan McGannPrincipal Software EngineerMacintosh Products &amp; SolutionsSymantec
Kudos0

Re: SymAVScanDaemon pegging my CPU

Sorry, I misread your earlier message -- you had said to "uninstall and then reinstall", and when I couldn't uninstall it iddn't occur to me to try the second part of it.

Anyway, I have now successfully reinstalled.  I would still like to uninstall the product, as the issue with a periodic crash in the console persists.

8/10/2009 10:54:02 AM com.apple.launchd[349] (com.symantec.uiagent.application[32105]) Exited abnormally: Segmentation fault 
8/10/2009 10:54:02 AM com.apple.launchd[349] (com.symantec.uiagent.application) Throttling respawn: Will start in 8 seconds 
8/10/2009 10:54:02 AM com.apple.launchd[1] (com.symantec.symdaemon[32107]) Exited abnormally: Bus error  
 

When I run the uninstaller it can now find the application, but it leaves the "uninstall" button dimmed.  Suggestions?

Kudos0

Re: SymAVScanDaemon pegging my CPU

Wow, you seem to have hit the jackpot of problems. If re-installing still doesn't let you uninstall, then there is definitely some sort of problem with the Apple Installer. I'll contact you offline.

Ryan 

Ryan McGannPrincipal Software EngineerMacintosh Products &amp; SolutionsSymantec
Kudos0

Re: SymAVScanDaemon pegging my CPU

Not meaning to appear rude, but -- when?  how?  Did you need me to do something to make that private contact happen?  I'm still seeing periodic CPU spikes every six seconds due to your unremovable product.
Kudos0

Re: SymAVScanDaemon pegging my CPU

I sent you a private message two weeks ago, on 8/10. According to the forum software you have not read it.

Ryan

Ryan McGannPrincipal Software EngineerMacintosh Products &amp; SolutionsSymantec
Kudos0

Re: SymAVScanDaemon pegging my CPU

Also according ot the title of this thread, SymAVScanDaemon is what's pegging your CPU. However it seems as if you have the same issue that was described here

 SymUIAgent.app Constantly Crashing

So I think the problem is definitely with the corrupted settings files, as I stated earlier. The easiest way to solve this is to simply copy & paste

  sudo rm -f /Library/Application\ Support/Symantec/Settings/1

 into the Terminal application. This will delete the settings file. Immediately restart your computer, and that should fix the problem.

However you still must have some sort of installer corruption if you can't uninstall, unless some other software has corrupted /Library/Receipts. We have no reports of problems with the Uninstaller, so it sounds like some other 3rd party software has deleted the Receipts. Unfortunately Apple's installer has no record of what actually gets installed and how to remove it without those receipts so if another application deletes the Receipts, you cannot uninstall a lot of software.

Ryan McGannPrincipal Software EngineerMacintosh Products &amp; SolutionsSymantec
Kudos0

Re: SymAVScanDaemon pegging my CPU

I had both problems; the SymAVScanDaemon problem was more severe and masked the SymUIAgent.app crashing problem.

Thank you for the script.  I've now run it and my system is blissfully idle when it should be.

I know that I've been condescending to you on this thread, Ryan.  Please accept my apology for it.  You're clearly going above and beyond, and you deserved better from me. 

Kudos0

Re: SymAVScanDaemon pegging my CPU

Hi,

Having a similar problem - i.e. SymAV.... is currently using 95.30% of my CPU (Macbook).  This has been a common feature since I started using Antivirus for Mac.  I'm having trouble extracting a solution from the discussion on this thread.  Is there any way of reducing CPU utilization without disabling the auto-scanning feature? If not, is it disk scanning that I should disable?

Cheers.

Message Edited by gk56 on 09-11-2009 12:36 AM
Kudos0

Re: SymAVScanDaemon pegging my CPU

First, please open the Console application (in Applications -> Utilities). Look at the system.log file. Please copy & paste some of it here. The people who have experienced this problem in the past had a problem with their installation, which caused SymAV* to crash repeatedly. If that is the case, you will see a lot of messages in your syslog about SymAVScan crashing, and being re-launched by launchd. Usually this is solved by uninstalling & reinstalling, because something went wrong during installation. It looks to be a bug in Apple's installer.

If that is not the case, please launch Activity Monitor (also in Applications -> Utilities). Find the SymAV* process that is taking up all your CPU. Double click on it, and when the new window opens, press the "Sample" button. This will take a snapshot of the SymAV* process and tell us what it is doing. Please save that file and attach it here so I can look at it.

Thanks, and sorry for the problems. 

 Ryan

Ryan McGannPrincipal Software EngineerMacintosh Products &amp; SolutionsSymantec
Kudos0

Re: SymAVScanDaemon pegging my CPU

The log looks clean (entries that include "Sym"):

Sep 12 12:00:01 george-ks-computer -u[4927]: /Users/gk56/Library/Preferences/com.symantec.symsched\n
Sep 12 12:00:02 george-ks-computer SymSecondaryLaunch[475]: launch for id = 1      event = oapp result = 0\n
Sep 12 16:14:28 localhost SymSharedSettingsd[76]: Settings server starting up.

The sampling feature in Activity Monitor is not available (even when run as root - i.e. sudo open ...).

What do you suggest?

Kudos0

Re: SymAVScanDaemon pegging my CPU

Using "sudo sample <pid> -subst": I get nothing either (output below):

---

Analysis of sampling pid 436 every 10.000000 milliseconds
Call graph:

Total number in stack (recursive counted multiple, when >=5):

Sort by top of stack, same collapsed (when >= 5): 

---

Any ideas?

Kudos0

Re: SymAVScanDaemon pegging my CPU

Try just running "sudo sample SymAVScanDaemon". That is all that should be required. It should write out a file to /tmp, which you can attach here. 

If that does not work, we'll need to know why AVScanDaemon is being launched. Does it do this every time you start your machine? If so, do you have FileVault enabled on your MacBook?

Ryan

Ryan McGannPrincipal Software EngineerMacintosh Products &amp; SolutionsSymantec
Kudos0

Re: SymAVScanDaemon pegging my CPU

I get some kind of "syntax" error when running the sample command without the "-subst" option: "Note that the program must have been started using a full path, rather than a relative path, for analysis to work, or that the -subst option must be specified".

Same output as before (i.e. that was from the file you indicated).

Yes. SymAVScanDaemon is launched every time I start the machine, and FileVault is enabled.

Thanks for your quick responses.

Kudos1

Re: SymAVScanDaemon pegging my CPU

We have a known issue where FileVault volumes cause a spike in CPU usage when you log into your computer. The Norton AntiVirus 11.0.3 update we just posted should fix this issue. Please run LiveUpdate, and download the Norton AntiVirus 11.0.3 update. Let me know if it fixes this issue.

Ryan 

Ryan McGannPrincipal Software EngineerMacintosh Products &amp; SolutionsSymantec

Replies are locked for this thread.