Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 8 subscribers
  • Views 5381 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

High CPU usage with Sophos-AV for Linux on RHEL7 server with tomcat

Travis Zimmerman

We're running Sophos-AV for Linux on a RHEL7 server that is also running tomcat and splunk. After installing and letting it run for a few days Sophos-AV CPU usage didn't drop. We have ScanArchives disabled, which I understand is needed so it shouldn't scan java related files (.jar). This isn't a spike in usage, this is one or two savscand processes showing up in top as the main users of CPU consistently for days.

We would rather not shutdown on-access scanning but if we can't get the CPU usage down it's not much help to use.

RHEL 7.6
VM
CPU (dev) 2     (qna) 6
RAM (dev) 4GB    (qna) 8GB

Any help would be great! Thanks.



This thread was automatically locked due to age.
Parents
  • 0

    Hi  

    It is great that you have disabled scanning inside archives. Just to reiterate, it can be done by running the following commands: (I hope you have restarted the sav-protect process)

    • /opt/sophos-av/bin/savconfig set ScanArchives false
    • /etc/init.d/sav-protect restart

    It is not usually necessary to perform on-demand or scheduled scans of archive files, because files within the archive will be scanned the moment they are extracted or opened. 

    Alternatively, you may be able to improve performance by excluding common .JAR files associated with the JRE or your application.

    Thanks,
    Yashraj Singha
    Manager | Global Community Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
Reply
  • 0

    Hi  

    It is great that you have disabled scanning inside archives. Just to reiterate, it can be done by running the following commands: (I hope you have restarted the sav-protect process)

    • /opt/sophos-av/bin/savconfig set ScanArchives false
    • /etc/init.d/sav-protect restart

    It is not usually necessary to perform on-demand or scheduled scans of archive files, because files within the archive will be scanned the moment they are extracted or opened. 

    Alternatively, you may be able to improve performance by excluding common .JAR files associated with the JRE or your application.

    Thanks,
    Yashraj Singha
    Manager | Global Community Support
    Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
Children
No Data
Unfiltered HTML