Sophos 9.01 Memory Usage out of Control

Hi mikedvzo,

Thanks for the feedback. "Out of control" might be a little extreme. Its not out of control, but its definitely bigger than it used to be in version 8. Part of this is due to additional features (for example, one of the largest in your list is SophosScanD, its new in v9). Part of this is due to moving to 64-bit compilation. Part of it is due to architecture (more daemons in general e.g. SophosSXLD, SophosConfigD are new in v9).

You will continue to see the product evolve, and overall memory consumption will change. Getting back to the v8 levels is not achievable, but there are improvements we have planned for upcoming major releases.

Thanks for the reply.  I do know that McAfee uses a similar amount of memory not quite as much.  I am baffled by memory usage of both.  I personally have a machine with 16G RAM but let's suppose you have a base with 4G RAM.  That means 17% of your memory is allocated to an antivirus program.  That really is a hard sell.  

Hi mikedvzo,

Not able to give you any insight for other vendors (security products or otherwise) but for our product the significant memory consumption is actually detection data. To speed scanning all the detection data is in memory. The more types of threats we detect, the more detection data is needed. The more complicated detections require more memory, because it takes more complex code to differentiate malicious software vs. clean software. Its a never ending situation. The team in SophosLabs (who maintain the detection data) do take memory consumption seriously, but its a hard problem.

Today we have several scanning processes, each using a copy of the detection. The "easy win" in the future will be to reduce the number of copies of the detection data needed. I say "easy" because its easy to say that. Its more effort to actually rework the product architecture, but we know what to do and its on the roadmap for this year.

Hi

I keep on getting out of memory during AutoUpdate.. and have nothing running during that time !

I have a MacBook Pro with 8Gb and Mavericks installed.

-Amit.

Hi Bob,

I would like to follow-up on this report. I've recently upgraded to SAV 9.0.8 (under OS X 10.8.5) and the memory usage does seem excessive in comparision to v8. Luckily I have 10MB installed in my Mac Pro but, even so, after 8 hours of use (I shutdown and restart everyday) Sophos it utilising:

Intercheck 160.4 MB

SophosScanD 145.6 MB

SophosAntiVirus 122.6 MB

SophosAutoUpdate 21.7MB

SophosUIServer 16.6 MB

SophosSXLD 5.9 MB

SophosWebIntelligence 5.3 MB

SophosConfigD 5.3MB

That's 483.4 MB in total and two of the top five processes by memory utilisation are Sophos processes. Is there anything more that can be done to improve (reduce) Sophos' memory utilisation? I also find it strange that I have so many different Sophos background processes running, especially when I have the Live Protection and two Web Protection functions disabled - so surely those two functions' processes shouldn't even be loaded?

Cheers,

Stuart

Hi Amit,

Where do you see this message? Are you sure its memory, or is it disk space?

Hi Stuart,

The improvement to "turn off" the processes related to unused features will only be available in version 9.2. That version goes to beta for our Sophos Cloud product line in the next four to six weeks, and will make its way to our Home Edition around June or July (depending on how stable it proves to be). In your example, switching off the two Web Protection features would shut down the following processes: ScanD, WebIntelligence, SXLD. Note that until version 9.3 (see below) ScanD is only used for web content scanning, which is why it can be safely shut down even if you leave the on-access scanning running.

Folding the scanning functionality together (combining Intercheck and ScanD) to eliminate the extra copy of the largest memory consumer happens in version 9.3, and that won't be ready until after the summer (in the northern hemisphere). Its a seriously large project as it involves a complete rewrite of large portions of the on-access scanning code. This should also reduce the size of the "SophosAntiVirus" process a the same time, due to other changes in scanning code. We'd hoped to do this sooner but other work has kept us busy.

I have no ability to guarantee the dates I mentioned above. Software engineering can be a somewhat unpredictable process, and we may need to rearrange schedules based on ever-changing events. But this same memory consumption issue affects all of our business customers too, so its a priority. Stay tuned.

Many thanks for the comprehensive update Bob. The new 9.2 and 9.3 updates sound like they will really help with memory utilisation and I look forward to trying them out in the future.

Incidentally I tried quitting the 'SophosScanD' process through Activity Monitor and it is immediately restarted. So it doesn't seem like it is possible to safely shutdown that process under 9.0.8?

Kind regards,

Stuart

---

stukey wrote:

Incidentally I tried quitting the 'SophosScanD' process through Activity Monitor and it is immediately restarted. So it doesn't seem like it is possible to safely shutdown that process under 9.0.8?

---

Nope, not possible (generally). We register the process with the system (launchd) and ask it to automatically restart the service if it stops.

You can tell the system to stop it. Can't guarantee our software will be happy about it, we don't generally test with that scenario, but since its your computer you can do whatever you want. I can't say that I recommend it, and the "user beware" warning applies.

Still want to do it? Run this command:

sudo launchctl remove com.sophos.scan

Note that it will still start up automatically when you reboot.

The changes that I describe for version 9.2 are things that we are testing, and we have a very controlled way to know when its correct to shut down particular daemons.

Thanks again Bob. I think I'll leave well enough alone for now and wait for the 9.2 and 9.3 updates.

Thanks you for the great support.

Stuart