Best practice for on-access scanning

Hello Jo,

older computers

how old, and which OS and SESC versions? extremely slow when doing what, which applications are run on these computers? If it's resource contention then it's not very likely that only scanning puts performance over the edge, normally you'd notice it in other situations as well. Though - how much RAM?  

From the moment we disable the on-access scanning

so the effect is immediately noticeable? If there is significant HTTP traffic - have you tried to disable Web Protection only? Detailed performance monitoring and measurement will of course give better insight but then this needs additional resources. Hm ...

Christian

Hi, it even happens with a notebook (i3, 4GB Ram, W7SP1). The SECS version is 10.3. This user's only using Office and firefox. I'll try to give more info.

Hello Jo,

none of the machines I use is younger than 5 years, none has more than 2GB, regularly using Firefox (sometimes with 30+ tabs open), OpenOffice, several RDP sessions ... no problems. So whatever the cause it must be something not yet mentioned :smileyhappy:

Christian

And do you use the default settings or have you changed something?

Hello Jo,

using the recommended (default) settings. Over time I've encountered a handful of applications with a terrible start-up performance when scanning was enabled. Haven't bothered to find out why exactly (but abysmal performance when a scanner is involved can for example be achieved with Java).

Christian 

OK, thank you for the info.But it does have an impact on the speed of the pc (like all AV soft do, I know ;) ), because when on-acces scanning is disabled, the machine is better.

Hello Jo,

actually an impact on the speed can be two things: Overall competition for resources (i.e. your application runs slower because unrelated work is done in the background) or increased cost of certain actions (e.g. the additional time and resources needed when a file is opened). [Enter perception] The latter is more noticeable as it affects only distinct and specific steps of the workflow and furthermore a linear rise in transaction time is not perceived as such. 

Christian

OK, can you give some tips on testing this? I mean on testing the consequences on speed loss?

Hello Jo,

wish it'd be that simple. I'd first try to assess the exact nature of slow - are all actions (perceived as) slow or only certain ones. From the configuration data I'd rule out memory as the bottleneck (but I might be wrong).

Using Sysinternal's Process Explorer I'd have a look at CPU usage, whether CPU is high (at certain) times and if which process is responsible. Still in ProcExp - opening the Properties of SavService.exe and tabbing to Performance Graph will show whether SavService's activity correlates with the foreground actions - if not, then "something" in the background is accessing lots of files.

Keep in mind that On-Access is kinda electronic monkey requesting a scan when a file is about to be opened - no opens and nothing to do for On-Access. Turn off On-Access and check what changes.

Next steps depend on your findings ...

Christian

OK, thank you for all your time. I'll keeping me busy testing out.