Scheduled scans are taking 8 hours, or more, to complete
Last Updated June 15, 2017
You notice that on some computers, scheduled scans can take up to 8 or more hours to complete when configured for "Best Application Performance" or "Balanced Performance". This also prevents other manual or scheduled scans from starting.
The following entries can be seen in the vpdebug logs during the scan.
11:58:50.528579[_1168][_5024]|ScanThrottling: User is not Idle. Sleeping 3000 ms for the Best Application Performance scan.
After 8 hours, you will see the following entry:
11:59:02.528579[_1168][_5024]|ScanThrottling: Past unthrottling threshold. Continue to scan.
Since 12.1 RU5 the scan job manager functions had some overly sensitive idle time detection algorithms that were causing scans to unnecessarily pause.
Symantec Endpoint Protection (SEP) minimizes the impact of scans on computer performance by throttling scans when a computer is busy. Scans are configured to use the "Best Application Performance" setting by default. This means that if a computer is busy, the scan will delay for 3 seconds (3000ms). SEP will continue to check if the computer is busy every 3 seconds. If the computer remains busy, the scan can be delayed for up to 8 hours. After 8 hours, throttling of the scan is disabled regardless of whether the computer is idle or not.