SYMANTEC TAMPER PROTECTION ALERT

[xavierbutt]

I am seeing the following in the System event log of my 2X app server. I do not receive this error at user logon, it seems to occur at random throughout the day/night. Has anyone else seen this? Does anyone have some clue how to resolve this?

SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\SAV\Symantec AntiVirus\Rtvscan.exe
Event Info: Set Information Process
Action Taken: Blocked
Actor Process: C:\Program Files\2X\ApplicationServer\2XAgent.exe (PID 1528)
Time: Tuesday, May 13, 2008 1:03:29 AM

 

[RyanG]

I am seeing the following in the System event log of my 2X app server. I do not receive this error at user logon, it seems to occur at random throughout the day/night. Has anyone else seen this? Does anyone have some clue how to resolve this?

SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\SAV\Symantec AntiVirus\Rtvscan.exe
Event Info: Set Information Process
Action Taken: Blocked
Actor Process: C:\Program Files\2X\ApplicationServer\2XAgent.exe (PID 1528)
Time: Tuesday, May 13, 2008 1:03:29 AM

We're also having a rather large issue with this problem.

From what I've been able to gather, it's a nasty little loop... The Symantec scan starts to run a bit hot (for whatever reason), then the 2xagent attempts to throttle the process - which triggers the tamper log, which results in the Symantec process using more CPU cycles. Which in turn spirals the CPU usage out of control. Then the server essentially 'hangs', and if I'm lucky I can PSExec in to restart the Symantec service, otherwise it's a reboot and the users get a bit annoyed - as expected.

Is there any settings in the 2xagent to stop this behaviour? To prevent it from attempting to adjust the priority of tasks?

 

[nixu]

Hi there,

It could be that Symantec and "2X CPU Loadbalancer" are competing for resources....

You mentioned that Symantec scan starts to run a bit hot...
Do you mean that Symantec start scanning for viruses??
What Version of Symantec do you have??

Ian

 

[RyanG]

You mentioned that Symantec scan starts to run a bit hot...
Do you mean that Symantec start scanning for viruses??
What Version of Symantec do you have??

The systems in question don't do scans, as such, they merely run the real-time virus scanner. They don't scan network drives, so it's basically only scanning emails and web files, and any programs that may be run (Office, etc).

We're running the latest version of SAV Enterprise, 10.1.6.6010. Apparently there is a 10.1.7 available, but I have been unable to find it yet.

 

[nixu]

You can disable the 2X CPU Loadbalancer from the 2X Console -> Loadbalancer -> Advanced Settings -> "Enable CPU Loadbalancer "

Nixu

 

[RyanG]

You can disable the 2X CPU Loadbalancer from the 2X Console -> Loadbalancer -> Advanced Settings -> "Enable CPU Loadbalancer "

Nixu

Thanks for the tip, I'll give it a try and see how it goes.

 

[RyanG]

So I had a read through the docs, and had a look at what this option does. It's definitely going to be the culprit. But unfortunately I won't be disabling it, as it was one of the reasons that we are using the software.

It helps curbed the dreaded "Internet Explorer has taken all your resources" issue that we used to have. When an IE window would crash, it would take 100% of the system resources and slow our systems down - almost identical to the issue we have now.

Is it possible to have this feature enabled, but with an exclusion list? ie. throttle all processes that wish to use > 95% CPU usage, except those we specify, such as all the Symantec AV procs.

 

[rrfield]

I'm running into this as well, it's really annoying and causing the 2xagent on the TS from connecting with the 2x server.

Is there a solution, besides not running AV...which is unacceptable?

 

[zippo]

So I had a read through the docs, and had a look at what this option does. It's definitely going to be the culprit. But unfortunately I won't be disabling it, as it was one of the reasons that we are using the software.

It helps curbed the dreaded "Internet Explorer has taken all your resources" issue that we used to have. When an IE window would crash, it would take 100% of the system resources and slow our systems down - almost identical to the issue we have now.

Is it possible to have this feature enabled, but with an exclusion list? ie. throttle all processes that wish to use > 95% CPU usage, except those we specify, such as all the Symantec AV procs.

i heard it will be available soon maybe if you contact support then can give you more detail

 

[jvandenbroek]

Probably not the right topic, but I saw the "CPU Load balancer" mentioned and was wondering if that feature is also enabled for LoadBalancer only (native RDP balancing, no 2X clients involved). It seems to be an interesting feature, however we're also using Thread Master. Not sure if both can run next to each other without problems, because we once ran into a problem causing an almost fully frozen terminal server.

 

[nixu]

Probably not the right topic, but I saw the "CPU Load balancer" mentioned and was wondering if that feature is also enabled for LoadBalancer only (native RDP balancing, no 2X clients involved). It seems to be an interesting feature, however we're also using Thread Master. Not sure if both can run next to each other without problems, because we once ran into a problem causing an almost fully frozen terminal server.

Hi jvandenbroek,

If a 2X Terminal Server Agent is installed on the TS (which should be, even if you are using native RDP) CPU Load balancer is enabled.

If you are using a similar product (Thread Master, sounds like one), you might encounter some problems. I suggest that you only enable one of them.

Nixu

Nixu

 

[jvandenbroek]

Hi nixu,

Thanks, I'll check it out. Still not the correct topic, but how does 2X handle CPU usage in a multiple CPU / Core system? I.e. if a process uses 1 core for >95%, but it's overall utilization it's just about 25% (4 cores), will it get into action? Or does it have to be >95% for all CPU's together? It would be nice if this setting could be customized, this feature sounds really neat to implement and I'd probably prefer prioritizing processes above 'mastering' them down (Thread Master).

Thanks

 

[zippo]

Hi nixu,

Thanks, I'll check it out. Still not the correct topic, but how does 2X handle CPU usage in a multiple CPU / Core system? I.e. if a process uses 1 core for >95%, but it's overall utilization it's just about 25% (4 cores), will it get into action? Or does it have to be >95% for all CPU's together? It would be nice if this setting could be customized, this feature sounds really neat to implement and I'd probably prefer prioritizing processes above 'mastering' them down (Thread Master).

Thanks

it will get into action when all cpu reach the limit

 

[ClayMonk]

I am seeing the following in the System event log of my 2X app server. I do not receive this error at user logon, it seems to occur at random throughout the day/night. Has anyone else seen this? Does anyone have some clue how to resolve this?

SYMANTEC TAMPER PROTECTION ALERT

Target: C:\Program Files\SAV\Symantec AntiVirus\Rtvscan.exe
Event Info: Set Information Process
Action Taken: Blocked
Actor Process: C:\Program Files\2X\ApplicationServer\2XAgent.exe (PID 1528)
Time: Tuesday, May 13, 2008 1:03:29 AM

*Bump*

I have exactly this problem with no Load Balancer installed. Does anyone have a solution to this problem? I have added 2x to centralized exceptions and I get the same result.