After updating to OS X 10.9 symdaemon using 90%+ CPU

My MacBook Pro is running hot with fans on high since upgrading to OS X 10.9. Checking out Activity Monitor shows that symdaemon is using 90-120% CPU constantly. I've used LiveUpdate and made sure that I have the latest versions of everything in NIS.

 

If I use Activity Monitor to quit symdaemon all is well for a little while, then symdaemon starts again. At first it uses 20-30% CPU but eventually climbs back to 90%+.

 

I have found a partial solution. It seems that disabling "Idle-Time Scan" prevents this from happening. Come to think of it since upgrading to OS X 10.9 I've never gotten the message that the scan completed.

 

Running the same OS and NIS version on my wife's iMac seems to have no problems. The only difference I can think of is that I have a BC partition and a second internal hard drive in my MacBook Pro. I have Virus Protection setting set to not scan my Windows 8 partition, I don't see any way to configure Idle-Scan to ignore the Windows 8 partition.

 

Is there a fix?

Nope, after 4 hours Activity Monitor is still sampling symdaemon. I guess I'm not going to be able to post the results...

Hm, it's odd that Activity Monitor cannot sample. Sorry for the problems.

 

Can you please try running the following from the command line:

sudo sample SymDaemon

 

You can run this by opening Terminal in Applications -> Utilities, and copying the above command into the Terminal window. You'll need your administrator password. Copy & paste the output here.

 

If that doesn't work we can try another command:

/usr/libexec/stackshot

 

That command takes a while to execute, and writes its output to a file. Please post here, or send via private message, the contents of /Library/Logs/stackshot.log

 

Thanks,

Ryan

The output exceeds 20,000 characters so I can't paste it here. I will attach it as an RTF file. Well the web page does not like RTF files, so will try as a PFD.

Here is another sample when symdaemon had been running at 80-95% for some time

My MacBook Pro is running hot with fans on high since upgrading to OS X 10.9. Checking out Activity Monitor shows that symdaemon is using 90-120% CPU constantly. I've used LiveUpdate and made sure that I have the latest versions of everything in NIS.

 

If I use Activity Monitor to quit symdaemon all is well for a little while, then symdaemon starts again. At first it uses 20-30% CPU but eventually climbs back to 90%+.

 

I have found a partial solution. It seems that disabling "Idle-Time Scan" prevents this from happening. Come to think of it since upgrading to OS X 10.9 I've never gotten the message that the scan completed.

 

Running the same OS and NIS version on my wife's iMac seems to have no problems. The only difference I can think of is that I have a BC partition and a second internal hard drive in my MacBook Pro. I have Virus Protection setting set to not scan my Windows 8 partition, I don't see any way to configure Idle-Scan to ignore the Windows 8 partition.

 

Is there a fix?

First thanks for the information. It's really helpful.

 

It does indicate that Idle Scanning is not the problem, as you noticed. It looks like AutoProtect is just continously scanning. You can verify this by turning off the Automatic Protection feature of Norton AntiVirus as a test. If that fixes the problem, that sounds like the culprit.

 

If that is indeed the case, make sure Automatic Protection is on, and please try running this command in Terminal (it sounds like you're rather proficient, so I am going to skip some steps).

 

sudo fs_usage -f file -w SymDaemon

 

Let it run for a good 5-10 seconds, then hit Control-C to stop it, and send us the output. Hopefully that'll give us an indication of what it's continously scanning. Thanks for the help in investigating this issue with us.

 

Turning off auto-protect decreased symdaemon to 0% CPU use. It does seem that auto-protect is the culpret. Of course without it NAV is pretty useless.

 

After turning it off, symdaemon acts normally for a while when I turn it back on. I'll wait a while and when it's "going crazy" again I'll run the command and see what output it reveals. Ah, here it goes up to 68% after opening a few programs and surfing the net.

 

 

I am having the same problem with SymDaemon. However, mine started before 10.9 and it would seem that turning off idle scan works. According to my iStat Pro app on my iPhone, it would appear that the SymDaemon started to use the CPU right around Oct 18. Which the same day that an Update of Norton occurred. 

 

My problem is on at least 2 of my 3 Macs. Not entirely sure about the 3rd as I don't have access to it all the time. 

 

If you want me to run a scan or what not, please let me know on how to do that. I kind of understand it, but not really. 

 

Thank you,

KOT

 

 

I am running Mac OS X 10.9 on an early-2011 MBP 17"

The Norton Internet Security software I have installed is that which is distributed by Xfinity.

 

I too have found that if I disable AntiVirus, SymDaemon backs off of the CPU.

 

I used fs_usage and saw that network-attached drives where being scanned. I then when into the AntiVirus configuration and specified that only the SSD boot disk and the spindle data disk (in the optical drive bay) should be scanned. I then stopped and started Anti Virus protection.

 

My CPU usage dropped from about 200% to 80%.

 

I see that the output of fs_usage also included lines where something is happening with /Volumes/ReadyNAS. When I am in the terminal, there is no such directory. The two network-attached storage systems I have are ReadyNAS devices, but I see them as "nas" and "nas-v2" on my network. I don't understand why Norton is messing around with /Volumes/ReadyNAS

 

Norton is telling me that I have to reboot my Mac now that it has updated its data, so I'll go ahead and do that and then repeat the fs_usage to see if it still has output that is associated with /Volumes/ReadyNAS

 

Output of fs_usage:

 

10:03:06.277895 lstat64 /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017285.tok 0.000009 SymDaemon.1287739
10:03:06.277993 unlink /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017285.tok 0.000098 SymDaemon.1287739
10:03:06.278030 open [ 2] (R_____) 0.000005 SymDaemon.1287739
10:03:06.278081 close F=204 0.000045 SymDaemon.1287739
10:03:06.278091 unlink [ 2] 0.000001 SymDaemon.1287739
10:03:06.278247 HFS_update (___c__) 0.000010 SymDaemon.1287739
10:03:06.278257 chflags <CLEAR_ALL_FLAGS> Users/jeraldjosephs/Applications (Parallels)/{d1f9647b-a8db-45c2-892e-e8cb76c48818} Applications.localized/Accessibility On-Screen Keyboard.app/Contents/Info.plist 0.000164 W SymDaemon.1287739
10:03:06.278285 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.278303 lstat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000033 SymDaemon.1287739
10:03:06.278325 getattrlist /Volumes 0.000009 SymDaemon.1287739
10:03:06.278332 getattrlist /Volumes/SATA 750 - Data 0.000007 SymDaemon.1287739
10:03:06.278336 statfs64 /Volumes/SATA 750 - Data 0.000004 SymDaemon.1287739
10:03:06.278340 lstat64 /Volumes/SATA 750 - Data 0.000003 SymDaemon.1287739
10:03:06.278343 lstat64 /Volumes 0.000003 SymDaemon.1287739
10:03:06.278348 getattrlist /Volumes/SATA 750 - Data/Users 0.000005 SymDaemon.1287739
10:03:06.278354 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs 0.000005 SymDaemon.1287739
10:03:06.278372 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library 0.000018 SymDaemon.1287739
10:03:06.278388 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers 0.000016 SymDaemon.1287739
10:03:06.278394 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote 0.000005 SymDaemon.1287739
10:03:06.278399 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data 0.000005 SymDaemon.1287739
10:03:06.278404 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library 0.000005 SymDaemon.1287739
10:03:06.278410 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support 0.000005 SymDaemon.1287739
10:03:06.278428 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote 0.000018 SymDaemon.1287739
10:03:06.278433 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts 0.000006 SymDaemon.1287739
10:03:06.278439 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote 0.000005 SymDaemon.1287739
10:03:06.278445 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad 0.000006 SymDaemon.1287739
10:03:06.278451 getattrlist /Volumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content 0.000006 SymDaemon.1287739
10:03:06.278458 getattrlist olumes/SATA 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86 0.000007 SymDaemon.1287739
10:03:06.278478 getattrlist 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000019 SymDaemon.1287739
10:03:06.278484 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000006 SymDaemon.1287739
10:03:06.278492 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000005 SymDaemon.1287739
10:03:06.278502 statfs64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000005 SymDaemon.1287739
10:03:06.278559 open F=204 (R_____) 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000035 SymDaemon.1287739
10:03:06.278560 fcntl F=204 <CACHING OFF> 0.000001 SymDaemon.1287739
10:03:06.278562 lseek F=204 O=0x00000000 <UNKNOWN> 0.000002 SymDaemon.1287739
10:03:06.278564 lseek F=204 O=0x00000165 <UNKNOWN> 0.000002 SymDaemon.1287739
10:03:06.278564 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278565 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278611 read F=204 B=0x20 0.000008 SymDaemon.1287739
10:03:06.278631 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278634 read F=204 B=0x100 0.000003 SymDaemon.1287739
10:03:06.278659 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278661 read F=204 B=0x165 0.000002 SymDaemon.1287739
10:03:06.278682 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.278688 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278691 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278723 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278726 read F=204 B=0x2 0.000003 SymDaemon.1287739
10:03:06.278760 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278763 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278794 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278796 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278797 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278799 read F=204 B=0x165 0.000002 SymDaemon.1287739
10:03:06.278853 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278856 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278857 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278859 read F=204 B=0x40 0.000002 SymDaemon.1287739
10:03:06.278875 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278878 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278908 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278911 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.278929 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.278932 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279050 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279054 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279066 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279070 read F=204 B=0x20 0.000004 SymDaemon.1287739
10:03:06.279080 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279083 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279128 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279131 read F=204 B=0x4 0.000003 SymDaemon.1287739
10:03:06.279205 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279208 read F=204 B=0x165 0.000004 SymDaemon.1287739
10:03:06.279214 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279216 read F=204 B=0x4 0.000003 SymDaemon.1287739
10:03:06.279284 close F=204 0.000026 SymDaemon.1287739
10:03:06.279318 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000027 SymDaemon.1287739
10:03:06.279464 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.279464 HFS_update (___c__) 0.000011 SymDaemon.1287739
10:03:06.279472 chflags <CLEAR_ALL_FLAGS> 750 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000154 W SymDaemon.1287739
10:03:06.279507 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000021 SymDaemon.1287739
10:03:06.279519 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000006 SymDaemon.1287739
10:03:06.279554 open F=204 (R_____) 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000030 SymDaemon.1287739
10:03:06.279558 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279561 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279566 read F=204 B=0x165 0.000004 SymDaemon.1287739
10:03:06.279569 lseek F=204 O=0x00000165 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279575 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279595 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279596 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279599 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279636 open F=207 (R_____) 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000024 SymDaemon.1287739
10:03:06.279644 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000007 SymDaemon.1287739
10:03:06.279660 fstat64 F=207 0.000002 SymDaemon.1287739
10:03:06.279662 lseek F=207 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279663 lseek F=207 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279666 read F=207 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279668 read F=207 B=0x0 0.000001 SymDaemon.1287739
10:03:06.279686 close F=207 0.000012 SymDaemon.1287739
10:03:06.279700 read F=204 B=0x0 0.000002 SymDaemon.1287739
10:03:06.279704 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279740 stat64 50 - Data/Users/jeraldjosephs/Library/Containers/com.evernote.Evernote/Data/Library/Application Support/Evernote/accounts/Evernote/jerlad/content/p86/content.html 0.000023 SymDaemon.1287739
10:03:06.279745 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279749 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279750 read F=204 B=0x0 0.000001 SymDaemon.1287739
10:03:06.279758 fstat64 F=204 0.000002 SymDaemon.1287739
10:03:06.279759 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279760 lseek F=204 O=0x00000165 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279762 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.279765 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.279767 read F=204 B=0x0 0.000001 SymDaemon.1287739
10:03:06.279784 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.279824 access [ 2] (___F) /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017286.tok 0.000014 SymDaemon.1287739
10:03:06.279949 open F=207 (RWC_T_) /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017286.tok 0.000123 SymDaemon.1287739
10:03:06.279960 close F=207 0.000010 SymDaemon.1287739
10:03:06.279987 HFS_update (FM____) 0.000005 SymDaemon.1287739
10:03:06.279992 HFS_update (___c_m) 0.000003 SymDaemon.1287739
10:03:06.279997 open F=207 (RWC_T_) /private/tmp/7b-13-10-31-Thu-09-55-33-s4/10017286.tok 0.000034 SymDaemon.1287739
10:03:06.279999 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.280028 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.280032 read F=204 B=0x165 0.000004 SymDaemon.1287739
10:03:06.280034 read F=204 B=0x0 0.000001 SymDaemon.1287739
10:03:06.280053 lseek F=204 O=0x00000000 <UNKNOWN> 0.000001 SymDaemon.1287739
10:03:06.280055 read F=204 B=0x165 0.000003 SymDaemon.1287739
10:03:06.280057 read F=204 B=0x0 0.000001 SymDaemon.1287739
10:03:06.280071 fstat64 F=207 0.000002 SymDaemon.1287739
10:03:06.280080 HFS_update (FM____) 0.000006 SymDaemon.1287739
10:03:06.280090 write F=207 B=0x80 0.000018 SymDaemon.1287739
10:03:06.280420 HFS_update (FM_c_m) 0.000005 SymDaemon.1287739
10:03:06.282264 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.282393 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.282535 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.282819 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.283421 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.283492 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.283858 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.283969 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.284240 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.284359 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.284797 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.285031 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.285091 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.285183 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.285359 stat64 [ 2] /Volumes/ReadyNAS 0.000004 SymDaemon.1307670
10:03:06.285435 stat64 [ 2] /Volumes/ReadyNAS 0.000003 SymDaemon.1307670
10:03:06.286018 THROTTLED

I'm observing the same  behaviour after updating to OSX 10.9 -->  Symdaemon is taking more the 100% of the CPU, wich causing fans running constantly.... 

Because I'm new to this forum... Is Symantec working on the issue? Is any information from my machine may help to resolve the issue?  

Thanks, 

Michael.

I know that Symantec representatives monitor this traffic, and I've uploaded captured files they have asked for. Likely this will take several days or weeks to work out. The reps report to the programmers, but they have no way to know how long it will take for them to fix the problem

If this helps find a solution, I'm still running 10.8.5 and observe that opening any new web page with Chrome triggers triggers ~100% SymDaemon for 10 to 60 seconds.  Opening the same pages in Safari or Firefox does not trigger this behavior.

Anyone else noticing their Macs crashing with Norton Internet Security installed? My MacBook Pro has been crashing 2-3 times a day, even if it's just sitting and doing nothing. I've uninstalled Norton Internet Security for now - so far not a single crash (knock on wood). I think I'll wait for an update to NIS and then try it again.

 

Norton had been pretty trouble free until I upgraded to Mavericks, of course as pointed out by others there also was a recent patch for Norton Antivirus so it could be that and not Mavericks causing the problem.

Nope, it's not NIS that makes Mavericks crash far more ofetn then Mountain Lion. At least my fans are quiet for now.

I am not experiencing any crashing at all in OS X 10.9 with Norton installed and running. Is there anything in Console that might shed some light on what is happening with your MBP?

 

Probably, but there are so many messages there that without more knowledge than I have it makes little sense. I've looked at the logs the computer sends to Apple about the crash and don't see any drivers or programs that are anything other than standard Apple files/programs. Of course it could be some program or driver that is conflicting with an Apple driver or program, which makes it harder to sort out.

 

Activity Monitor helped find the program using all my CPU, but of course does not identify the cause or a crash. At least now I'm reasonably sure that NIS is not to blame for the crashes.

Just to add a 'me too' to this thread. I have the same problem on my iMac i7 and I'm pretty sure I had it before I went to 10.9 but I didn't actually check Activity Monitor until after that.

 

 

I tried the latest build of Norton Interned Security, same problem.

 

I used the Symantec installer and this time only installed Norton Antivirus. It seems that Norton firewall and the Norton identity cause no problems. There are only problems if Norton Antivirus is installed and active.

 

Whenever symdaemon is "going crazy" it also seems that mdworker (multiple copies) is active, sometimes ocspd too. They too are using a lot of CPU resources. Removing Norton Antivirus seems to resolve this issue. Must be some sort of conflict between symdaemon and mdworker (and possibly ocspd).

 

I guess I'm back to using ClamXav. I wonder if Norton will give us a credit for the time that we are unable to use Norton Antivirus...

OK, I MIGHT have found a solution/workaround.

 

It seems that symdaemon is trying to scan the timemachine files, and since they keep changing during a backup it never finishes. To stop symdaemon from scanning backed up files do this.

 

If using Time Capsule mount your data disk (,you will need to know the password you used to set it up). Once that is mounted, you will see the icon for it on your desktop (mine is called Data). Now open Norton Antivirus, click the "Automatic Protection" tab. To the right of "Virus Protection" click the "configure' button. Now click the "Don't Scan" button. Then drag your backup disk to the window to the right of the button. Leave the "Don't Scan" button selected.

 

Oddly specifying to only scan certain files/places does not seem to work. Only by telling NAV what NOT to scan was I able to prevent Symdaemon from using 100% of 1 CPU. Hope this helps.