Wisconsin Endpoint Management User Group

At the last couple of Symantec Endpoint Management User Group meetings I talked about a couple of things that can be done to improve the performance of your Symantec Management Platform.  I figured it would be best to summarize them in the group itself:

1. The first one I mentioned had to do with changing the Kerberos authentication order in the IIS website from Negotiate > NTLM to NTLM > Negotiate
   http://www.symantec.com/business/support/index?page=content&id=TECH156006
    
2. The second we just ran across this week.  Our 16 core, 24gb RAM SQL server was running a constant 80-90% CPU utilization and we were experiencing frequent deadlocks.  On Sunday, a deadlock/blocking situation corrupted our PMImport and broke Patch.  Very bad things happened.
   
   In any event, we found that the SQL Tuning guide had been updated by Symantec earlier this month.  We implemented their recommendations about Maximum Degree of Parallelism (we changed from '0=unlimited' to '2').  We're theorizing that we actually have too much horsepower for the SQL server and unlimited MDOP was causing problems.  Basically, after making the recommended changes our SQL server idles by at about 10% CPU and the SMP console FLIES.  7000 computer objects, CMS, SMS, AMS, and Mobile all installed and this thing performs as well as the fake demo environments.
   
   http://www.symantec.com/business/support/index?page=content&id=HOWTO10723
   

   Settings - SQL Server Instance

   • If your SQL server has more than 4 cores, lowering the Max Degree of Parallelism (rather than leaving at the default of 0 (unlimited)) will provide better performance. To set:
     • In Server Properties, on the Advanced page, set the Max Degree of Parallelism to half the number of physical processor cores on your system, up to a maximum value of 8.⁴
       • For a client-facing server that does not do much reporting, the suggested value is 2.
       • For a reporting server, or parent server in a hierarchy, the suggested value is 4.
       • For servers that are queried by IT Analytics, the suggested value is 4.

       • Monitor CXPACKET waits on the SQL instance. The goal is that they be less than 5% of relevant waits. ⁶ If CXPACKET waits remain higher than 5%, consider lowering the Max Degree of Parallelism by half again.

   • Set the Cost Threshold for Parallelism to 10
   • Enable Arithmetic Abort in the Server/Instance Properties on the Connections page.
      
3. Finally, and this is one that we have not implemented yet but are likely to do so in January, is the approach at splitting up the IIS worker pools to no longer have all of the web apps contained in the DefaultAppPool and instead give them their own memory spaces to work in:
   
   https://www-secure.symantec.com/connect/articles/how-implement-custom-application-pools-smp-improve-web-console-performance

The first two changes made a WORLD of difference for the performance of the product and our ability to use it.  Imagine no longer taking 20-30 seconds to right-click a resource and get to the Resource Manager page!