Kudos1 Stats

After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 26-Oct-2013 | 7:27AM · 36 Replies ·

My MacBook Pro is running hot with fans on high since upgrading to OS X 10.9. Checking out Activity Monitor shows that symdaemon is using 90-120% CPU constantly. I've used LiveUpdate and made sure that I have the latest versions of everything in NIS.

 

If I use Activity Monitor to quit symdaemon all is well for a little while, then symdaemon starts again. At first it uses 20-30% CPU but eventually climbs back to 90%+.

 

I have found a partial solution. It seems that disabling "Idle-Time Scan" prevents this from happening. Come to think of it since upgrading to OS X 10.9 I've never gotten the message that the scan completed.

 

Running the same OS and NIS version on my wife's iMac seems to have no problems. The only difference I can think of is that I have a BC partition and a second internal hard drive in my MacBook Pro. I have Virus Protection setting set to not scan my Windows 8 partition, I don't see any way to configure Idle-Scan to ignore the Windows 8 partition.

 

Is there a fix?

Replies

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 26-Oct-2013 | 7:27AM · Permalink

My MacBook Pro is running hot with fans on high since upgrading to OS X 10.9. Checking out Activity Monitor shows that symdaemon is using 90-120% CPU constantly. I've used LiveUpdate and made sure that I have the latest versions of everything in NIS.

 

If I use Activity Monitor to quit symdaemon all is well for a little while, then symdaemon starts again. At first it uses 20-30% CPU but eventually climbs back to 90%+.

 

I have found a partial solution. It seems that disabling "Idle-Time Scan" prevents this from happening. Come to think of it since upgrading to OS X 10.9 I've never gotten the message that the scan completed.

 

Running the same OS and NIS version on my wife's iMac seems to have no problems. The only difference I can think of is that I have a BC partition and a second internal hard drive in my MacBook Pro. I have Virus Protection setting set to not scan my Windows 8 partition, I don't see any way to configure Idle-Scan to ignore the Windows 8 partition.

 

Is there a fix?

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 26-Oct-2013 | 9:38AM · Permalink

Looks like disabling Idle-Scan was not a fix. Eventually symdaemon started using lots of CPU again.

I will attached the symdaemon sample if Activity Monitor ever finishes...

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 26-Oct-2013 | 1:16PM · Permalink

Nope, after 4 hours Activity Monitor is still sampling symdaemon. I guess I'm not going to be able to post the results...

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 28-Oct-2013 | 1:56PM · Permalink

Hm, it's odd that Activity Monitor cannot sample. Sorry for the problems.

Can you please try running the following from the command line:

sudo sample SymDaemon

You can run this by opening Terminal in Applications -> Utilities, and copying the above command into the Terminal window. You'll need your administrator password. Copy & paste the output here.

If that doesn't work we can try another command:

/usr/libexec/stackshot

That command takes a while to execute, and writes its output to a file. Please post here, or send via private message, the contents of /Library/Logs/stackshot.log

Thanks,

Ryan

Ryan McGann Technical Director Norton Business Unit, Symantec
Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 28-Oct-2013 | 6:32PM · Permalink

The output exceeds 20,000 characters so I can't paste it here. I will attach it as an RTF file. Well the web page does not like RTF files, so will try as a PFD.

File Attachment: 
PDF icon symdaemon.pdf
Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 28-Oct-2013 | 8:00PM · Permalink

Here is another sample when symdaemon had been running at 80-95% for some time

File Attachment: 
PDF icon symdaemon_2.pdf
Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 28-Oct-2013 | 9:49PM · Permalink

First thanks for the information. It's really helpful.

It does indicate that Idle Scanning is not the problem, as you noticed. It looks like AutoProtect is just continously scanning. You can verify this by turning off the Automatic Protection feature of Norton AntiVirus as a test. If that fixes the problem, that sounds like the culprit.

If that is indeed the case, make sure Automatic Protection is on, and please try running this command in Terminal (it sounds like you're rather proficient, so I am going to skip some steps).

sudo fs_usage -f file -w SymDaemon

Let it run for a good 5-10 seconds, then hit Control-C to stop it, and send us the output. Hopefully that'll give us an indication of what it's continously scanning. Thanks for the help in investigating this issue with us.

Ryan McGann Technical Director Norton Business Unit, Symantec
Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 30-Oct-2013 | 8:15PM · Permalink

Turning off auto-protect decreased symdaemon to 0% CPU use. It does seem that auto-protect is the culpret. Of course without it NAV is pretty useless.

After turning it off, symdaemon acts normally for a while when I turn it back on. I'll wait a while and when it's "going crazy" again I'll run the command and see what output it reveals. Ah, here it goes up to 68% after opening a few programs and surfing the net.

File Attachment: 
PDF icon symdaemon_usage.pdf
Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 30-Oct-2013 | 11:21PM · Permalink

I am having the same problem with SymDaemon. However, mine started before 10.9 and it would seem that turning off idle scan works. According to my iStat Pro app on my iPhone, it would appear that the SymDaemon started to use the CPU right around Oct 18. Which the same day that an Update of Norton occurred. 

My problem is on at least 2 of my 3 Macs. Not entirely sure about the 3rd as I don't have access to it all the time. 

If you want me to run a scan or what not, please let me know on how to do that. I kind of understand it, but not really. 

Thank you,

KOT

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 31-Oct-2013 | 10:14AM · Permalink

I am running Mac OS X 10.9 on an early-2011 MBP 17"

The Norton Internet Security software I have installed is that which is distributed by Xfinity.

I too have found that if I disable AntiVirus, SymDaemon backs off of the CPU.

I used fs_usage and saw that network-attached drives where being scanned. I then when into the AntiVirus configuration and specified that only the SSD boot disk and the spindle data disk (in the optical drive bay) should be scanned. I then stopped and started Anti Virus protection.

My CPU usage dropped from about 200% to 80%.

I see that the output of fs_usage also included lines where something is happening with /Volumes/ReadyNAS. When I am in the terminal, there is no such directory. The two network-attached storage systems I have are ReadyNAS devices, but I see them as "nas" and "nas-v2" on my network. I don't understand why Norton is messing around with /Volumes/ReadyNAS

Norton is telling me that I have to reboot my Mac now that it has updated its data, so I'll go ahead and do that and then repeat the fs_usage to see if it still has output that is associated with /Volumes/ReadyNAS

Output of fs_usage:

10:03:06.277895 lstat64 /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017285.tok 0.000009 SymDaemon.1287739
10:03:06.277993 unlink /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017285.tok 0.000098 SymDaemon.1287739
10:03:06.278030 open [ 2] (R_____) 0.000005 SymDaemon.1287739
10:03:06.278081 close F=204 0.000045 SymDaemon.1287739
10:03:06.278091 unlink [ 2] 0.000001 SymDaemon.1287739
10:03:06.278247 HFS_update (___c__) 0.000010 SymDaemon.1287739
10:03:06.278257 chflags <CLEAR_ALL_FLAGS> Users/jeraldjosephs/Applications (Parallels)/{d1f9647b-a8db-45c2-892e-e8cb76c48818} Applications.localized/Accessibility On-Screen Keyboard.app/Contents/Info.plist 0.000164 W SymDaemon.1287739
10:03:06.278285 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.278303 lstat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000033 SymDaemon.1287739
10:03:06.278325 getattrlist /Volumes 0.000009 SymDaemon.1287739
10:03:06.278332 getattrlist /Volumes/SATA 750 - Data 0.000007 SymDaemon.1287739
10:03:06.278336 statfs64 /Volumes/SATA 750 - Data 0.000004 SymDaemon.1287739
10:03:06.278340 lstat64 /Volumes/SATA 750 - Data 0.000003 SymDaemon.1287739
10:03:06.278343 lstat64 /Volumes 0.000003 SymDaemon.1287739
10:03:06.278348 getattrlist /Volumes/SATA 750 - Data/Users 0.000005 SymDaemon.1287739
10:03:06.278354 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs 0.000005 SymDaemon.1287739
10:03:06.278372 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library 0.000018 SymDaemon.1287739
10:03:06.278388 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers 0.000016 SymDaemon.1287739
10:03:06.278394 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote 0.000005 SymDaemon.1287739
10:03:06.278399 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data 0.000005 SymDaemon.1287739
10:03:06.278404 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library 0.000005 SymDaemon.1287739
10:03:06.278410 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support 0.000005 SymDaemon.1287739
10:03:06.278428 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote 0.000018 SymDaemon.1287739
10:03:06.278433 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts 0.000006 SymDaemon.1287739
10:03:06.278439 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote 0.000005 SymDaemon.1287739
10:03:06.278445 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad 0.000006 SymDaemon.1287739
10:03:06.278451 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content 0.000006 SymDaemon.1287739
10:03:06.278458 getattrlist olumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86 0.000007 SymDaemon.1287739
10:03:06.278478 getattrlist 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000019 SymDaemon.1287739
10:03:06.278484 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000006 SymDaemon.1287739
10:03:06.278492 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000005 SymDaemon.1287739
10:03:06.278502 statfs64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000005 SymDaemon.1287739
10:03:06.278559 open F=204 (R_____) 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000035 SymDaemon.1287739
10:03:06.278560 fcntl F=204 <CACHING OFF> 0.000001 SymDaemon.1287739
10:03:06.278562 lseek F=204 O=0x00000000 <UNKNOWN> 0.000002 SymDaemon.1287739
10:03:06.278564 lseek F=204 O=0x00000165 <UNKNOWN> 0.000002 SymDaemon.1287739
10:03:06.278564 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278565 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278611 read F=204 B=0x20 0.000008 SymDaemon.1287739
10:03:06.278631 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278634 read F=204 B=0x100 0.000003 SymDaemon.1287739
10:03:06.278659 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278661 read F=204 B=0x165 0.000002 SymDaemon.1287739
10:03:06.278682 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.278688 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278691 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278723 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278726 read F=204 B=0x2 0.000003 SymDaemon.1287739
10:03:06.278760 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278763 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278794 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278796 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278797 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278799 read F=204 B=0x165 0.000002 SymDaemon.1287739
10:03:06.278853 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278856 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278857 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278859 read F=204 B=0x40 0.000002 SymDaemon.1287739
10:03:06.278875 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278878 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278908 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278911 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278929 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278932 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279050 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279054 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279066 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279070 read F=204 B=0x20 0.000004 SymDaemon.1287739
10:03:06.279080 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279083 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279128 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279131 read F=204 B=0x4 0.000003 SymDaemon.1287739
10:03:06.279205 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279208 read F=204 B=0x165 0.000004 SymDaemon.1287739
10:03:06.279214 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279216 read F=204 B=0x4 0.000003 SymDaemon.1287739
10:03:06.279284 close F=204 0.000026 SymDaemon.1287739
10:03:06.279318 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000027 SymDaemon.1287739
10:03:06.279464 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.279464 HFS_update (___c__) 0.000011 SymDaemon.1287739
10:03:06.279472 chflags <CLEAR_ALL_FLAGS> 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000154 W SymDaemon.1287739
10:03:06.279507 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000021 SymDaemon.1287739
10:03:06.279519 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000006 SymDaemon.1287739
10:03:06.279554 open F=204 (R_____) 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000030 SymDaemon.1287739
10:03:06.279558 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279561 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279566 read F=204 B=0x165 0.000004 SymDaemon.1287739
10:03:06.279569 lseek F=204 O=0x00000165 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279575 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279595 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279596 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279599 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279636 open F=207 (R_____) 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000024 SymDaemon.1287739
10:03:06.279644 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000007 SymDaemon.1287739
10:03:06.279660 fstat64 F=207 0.000002 SymDaemon.1287739
10:03:06.279662 lseek F=207 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279663 lseek F=207 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279666 read F=207 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279668 read F=207 B=0x0 0.000001 SymDaemon.1287739
10:03:06.279686 close F=207 0.000012 SymDaemon.1287739
10:03:06.279700 read F=204 B=0x0 0.000002 SymDaemon.1287739
10:03:06.279704 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279740 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000023 SymDaemon.1287739
10:03:06.279745 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279749 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279750 read F=204 B=0x0 0.000001 SymDaemon.1287739
10:03:06.279758 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279759 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279760 lseek F=204 O=0x00000165 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279762 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279765 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279767 read F=204 B=0x0 0.000001 SymDaemon.1287739
10:03:06.279784 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.279824 access [ 2] (___F) /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017286.tok 0.000014 SymDaemon.1287739
10:03:06.279949 open F=207 (RWC_T_) /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017286.tok 0.000123 SymDaemon.1287739
10:03:06.279960 close F=207 0.000010 SymDaemon.1287739
10:03:06.279987 HFS_update (FM____) 0.000005 SymDaemon.1287739
10:03:06.279992 HFS_update (___c_m) 0.000003 SymDaemon.1287739
10:03:06.279997 open F=207 (RWC_T_) /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017286.tok 0.000034 SymDaemon.1287739
10:03:06.279999 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.280028 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.280032 read F=204 B=0x165 0.000004 SymDaemon.1287739
10:03:06.280034 read F=204 B=0x0 0.000001 SymDaemon.1287739
10:03:06.280053 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.280055 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.280057 read F=204 B=0x0 0.000001 SymDaemon.1287739
10:03:06.280071 fstat64 F=207 0.000002 SymDaemon.1287739
10:03:06.280080 HFS_update (FM____) 0.000006 SymDaemon.1287739
10:03:06.280090 write F=207 B=0x80 0.000018 SymDaemon.1287739
10:03:06.280420 HFS_update (FM_c_m) 0.000005 SymDaemon.1287739
10:03:06.282264 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.282393 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.282535 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.282819 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.283421 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.283492 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.283858 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.283969 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.284240 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.284359 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.284797 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.285031 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.285091 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.285183 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.285359 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.285435 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.286018 THROTTLED

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 31-Oct-2013 | 12:08PM · Permalink

I'm observing the same  behaviour after updating to OSX 10.9 -->  Symdaemon is taking more the 100% of the CPU, wich causing fans running constantly.... 

Because I'm new to this forum... Is Symantec working on the issue? Is any information from my machine may help to resolve the issue?  

Thanks, 

Michael.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 31-Oct-2013 | 5:23PM · Permalink

I know that Symantec representatives monitor this traffic, and I've uploaded captured files they have asked for. Likely this will take several days or weeks to work out. The reps report to the programmers, but they have no way to know how long it will take for them to fix the problem

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 31-Oct-2013 | 5:28PM · Permalink

If this helps find a solution, I'm still running 10.8.5 and observe that opening any new web page with Chrome triggers triggers ~100% SymDaemon for 10 to 60 seconds.  Opening the same pages in Safari or Firefox does not trigger this behavior.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 02-Nov-2013 | 2:10PM · Permalink

Anyone else noticing their Macs crashing with Norton Internet Security installed? My MacBook Pro has been crashing 2-3 times a day, even if it's just sitting and doing nothing. I've uninstalled Norton Internet Security for now - so far not a single crash (knock on wood). I think I'll wait for an update to NIS and then try it again.

Norton had been pretty trouble free until I upgraded to Mavericks, of course as pointed out by others there also was a recent patch for Norton Antivirus so it could be that and not Mavericks causing the problem.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 02-Nov-2013 | 6:37PM · Permalink

Nope, it's not NIS that makes Mavericks crash far more ofetn then Mountain Lion. At least my fans are quiet for now.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 03-Nov-2013 | 11:52AM · Permalink

I am not experiencing any crashing at all in OS X 10.9 with Norton installed and running. Is there anything in Console that might shed some light on what is happening with your MBP?

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 03-Nov-2013 | 9:31PM · Permalink

Probably, but there are so many messages there that without more knowledge than I have it makes little sense. I've looked at the logs the computer sends to Apple about the crash and don't see any drivers or programs that are anything other than standard Apple files/programs. Of course it could be some program or driver that is conflicting with an Apple driver or program, which makes it harder to sort out.

Activity Monitor helped find the program using all my CPU, but of course does not identify the cause or a crash. At least now I'm reasonably sure that NIS is not to blame for the crashes.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 08-Nov-2013 | 7:12PM · Permalink

Just to add a 'me too' to this thread. I have the same problem on my iMac i7 and I'm pretty sure I had it before I went to 10.9 but I didn't actually check Activity Monitor until after that.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 09-Nov-2013 | 9:28AM · Permalink

I tried the latest build of Norton Interned Security, same problem.

I used the Symantec installer and this time only installed Norton Antivirus. It seems that Norton firewall and the Norton identity cause no problems. There are only problems if Norton Antivirus is installed and active.

Whenever symdaemon is "going crazy" it also seems that mdworker (multiple copies) is active, sometimes ocspd too. They too are using a lot of CPU resources. Removing Norton Antivirus seems to resolve this issue. Must be some sort of conflict between symdaemon and mdworker (and possibly ocspd).

I guess I'm back to using ClamXav. I wonder if Norton will give us a credit for the time that we are unable to use Norton Antivirus...

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 16-Nov-2013 | 12:20PM · Permalink

OK, I MIGHT have found a solution/workaround.

It seems that symdaemon is trying to scan the timemachine files, and since they keep changing during a backup it never finishes. To stop symdaemon from scanning backed up files do this.

If using Time Capsule mount your data disk (,you will need to know the password you used to set it up). Once that is mounted, you will see the icon for it on your desktop (mine is called Data). Now open Norton Antivirus, click the "Automatic Protection" tab. To the right of "Virus Protection" click the "configure' button. Now click the "Don't Scan" button. Then drag your backup disk to the window to the right of the button. Leave the "Don't Scan" button selected.

Oddly specifying to only scan certain files/places does not seem to work. Only by telling NAV what NOT to scan was I able to prevent Symdaemon from using 100% of 1 CPU. Hope this helps.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 18-Nov-2013 | 4:27PM · Permalink

Nope, scratch that. Came home to a computer that was not sleeping, fans full tilt, 130% CPU is use by symdaemon. No idea how to stop it from doing this.

Back to using ClamXav. It is hard for me to believe that free/shareware is more stable than a commercial product. 

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 20-Nov-2013 | 8:45PM · Permalink

Any fix yet?

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 22-Nov-2013 | 4:53PM · Permalink

JFRASER98 said:

> Any fix yet?

It seems that the solution posted by the Symantec Employee on 10/28/13 is to turn off the Automatic Protection feature of Norton AntiVirus.  There was no further advice provided by Symantec.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 22-Nov-2013 | 4:58PM · Permalink

I think I have suggested in private messages turning off Idle Scan protection to see if that had helped, in order to rule out that feature as the culprit. That feature should only kick in when the Mac is idle but on 10.9 things changed a lot in that area.

Ryan McGann Technical Director Norton Business Unit, Symantec
Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 22-Nov-2013 | 5:12PM · Permalink

I saw your earlier messages and I immediately turned it off. I noticed when I have "Virus Protection" on it goes the Symdaemon increases from 0.2 - 90%+ or higher. When I turn it off, no issue.  I'm using Norton 360 Multi Device for my mac..

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 22-Nov-2013 | 5:31PM · Permalink

Can you clarify what you mean by Virus Protection? There are two features in Norton AntiVirus' Virus Protection category (three if you are using just Norton AntiVirus and not Norton Internet Security) ."Automatic Virus Scanning and "Idle-Time Virus Scanning". I suggested turning of Idle-Time Virus Scanning.

 
To give some background, Idle Scan does a full system scan of your Mac when it is idle (theoretically). It can catch some viruses that may have already been running on your Mac when you installed. It is basically like going into Norton AntiVirus and scanning your Mac whenever you leave your computer for a couple of hours.

Automatic Virus Scanning will protect your Mac whenever you download or create a new file. That is the most important feature to have enabled since most threats come via email or on the Web, and Automatic Virus Scanning will catch them whenever they are downloaded to your Mac. I am pretty confident leaving that feature enabled should not affect your performance like is described in the forums here.I think that problem is with Idle Scan, which should only enable when your Mac is idle, but unfortunately in 10.9 is kicking when while you are still using your Mac.

Ryan McGann Technical Director Norton Business Unit, Symantec
Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 22-Nov-2013 | 7:32PM · Permalink

Thanks for the update. I will try turning the idle-time scan feature off and enabling the virus protection to see if that helps.

When it's been taking 90% CPU turning off the virus protection, then turning it back on has at least temporarily restored symdaemon to normal.

Come to think of it on my MacBook Pro I don't get the message that the scan completed, on my wife's iMac I get the message whenever the computer has been idle for a time. Will post an update if your suggestion helps or does not.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 30-Nov-2013 | 9:22AM · Permalink

Hello Ryan, 

I, as well as others, are wondering what is the update for the Symdaemon eating up our Mac's CPU? 

As I stated before, it started for me a week or so before Mavericks 10.9 came out. So I don't think it's specifically affecting just Mavericks. As on both of my Mac Minis that were running Mt Lion was being affected by the CPU usage. 

Below is a picture of an app on my iPhone that monitors my Mac Mini from afar. iStat Pro by bjango is the name of it. I had to crop it down little by little in order to achieve the forums picture size, so forgive the choppiness. I took this picture on Oct 29, As you can see in the 30 day window into the 7 day window. The CPU was higher than normal. And Well before Mavericks came out. I do recall a major update of the Norton AV on Friday the 18th. Which appears to be when the CPU usage started to go up. It wasn't until Monday or Tuesday that I noticed the usage. I then figured that upgrading to Mavericks would help. Well as you can see, it did not help.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 30-Nov-2013 | 12:00PM · Permalink

As suggested by ryan_mcgann from Symantec, I turned on Automatic Virus Scanning and turned off Idle-Time Virus Scanning.  Since then, the symdaemon has not been a noticeable CPU hog. Thanks!

I agree that "Automatic Virus Scanning" is more important than "Idle-Time Virus Scanning," yet, Idle Time scanning provides significant additional protection and should be made fully functional by Symantec as soon as possible.

Kudos1 Stats

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 30-Nov-2013 | 6:25PM · Permalink

Turning off "idle-time scanning" seems to have fixed the symdaemon issue. At times it goes up to 65-70% CPU use but then settles right back down to 1-3%.

Any time frame on a fix to the idle scan issue? It was a nice feature when it used to work.

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 08-Dec-2013 | 3:00PM · Permalink

Am having the same issue on 10.8.5 even with idle scans disabled.  TOTALLY frustrating.  NAV 12.6. Latest updates.

Kudos1 Stats

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 12-Dec-2013 | 9:52AM · Permalink

I'm running OS X 10.8.5 and with Norton Internet Security 12.6 (26) I'm also seeing this.  I'm attaching the output from the sample command in case it helps anyone.  I have Idle Scan disabled and still have the problem.  I tried the recommendation of disabling Virus Protection,  but isn't that the same as not having it running at all?  If so, then what's the point of having the product installed?

File Attachment: 
Plain text icon SymDaemon_2013-12-12_124529_qvFy.sample.txt
Kudos1 Stats

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 10-Jan-2014 | 7:31AM · Permalink

I too am experiencing temporary system hang-ups (same high CPU with symdaemon), running OS X 10.7.5 on a MacBook Pro with Internet Security product. After much trouble-shooting, it seems to be tied to Anti-Virus. When I disable Anti-Virus, system runs fine. When I turn it back on, the system hangs occur every couple of minutes and last for 10-15 seconds. Product/Liveupdates are current. I can't say for sure when this started occurring but it's been a few months. 

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 28-Feb-2014 | 6:28PM · Permalink

megavolt17 wrote on 10-26-2013 07:27 AM:
    My MacBook Pro is running hot with fans on high since upgrading to OS X 10.9. Checking out Activity Monitor shows that symdaemon is using 90-120% CPU constantly...

bmcneely0 wrote on 12-12-2013:
...  I have Idle Scan disabled and still have the problem.  I tried the recommendation of disabling Virus Protection,  but isn't that the same as not having it running at all?  If so, then what's the point of having the product installed?
 
jcosta wrote on 01-10-2014:
... When I disable Anti-Virus, system runs fine. When I turn it back on, the system hangs occur every couple of minutes and last for 10-15 seconds. Product/Liveupdates are current. I can't say for sure when this started occurring but it's been a few months.


I agree with bmcneely0 and jcosta.  The lack of progress in resolving this issue is mysterious, at least as seen in this forum.  Has there been any progress?

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 07-Apr-2014 | 8:13PM · Permalink

Does anybody know if the latest update fixes this issue? A Norton update required a computer restart so something more than just the virus definitions was updated. I don't see any update history or information on the web site.

I have Norton Antivirus version 12.6 (26).

Kudos0

Re: After updating to OS X 10.9 symdaemon using 90%+ CPU

Posted: 01-Jun-2014 | 12:13PM · Permalink

I sure hope so... I just installed it...

For me... it only happens when I'm idle for a few minutes... Then symdaemon goes nuts... and the fans go on full speed... So annoying while I'm in class.

Luckily, a quick touch of the trackpad makes it stop..

And I agree it seems like it must be the idle scan.  But disabling it doesn't seem to make a difference.

Hopefully this update fixes it... if not... :(

This thread is closed from further comment. Please visit the forum to start a new thread.