thanks guys,

would perfmon be betterfor checking this?

SCOM is not monitoring this server (wish it was)

Symantec endpoint protection is our av program there is a full scan every monday morning at 5am.