Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 12 subscribers
  • Views 6186 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

High write percentage on automactic scan

Songour

Following the installation of Sophos Cloud on our system, we've noticed a very high disk write rate to the C:\ drive on the active directory server; however this only happens during a scheduled scan. I've attached a report from the performance counters on the server which shows the reads and writes on both the C: and D: drives during both a manual and automactic scan.

The writes on the C: reached 11700 iop/s during the automactic scan which maxes out the iops for the disk drives; i don't believe this is normal. However the manual scan seems normal.

Thanks for any help on this matter,

Emre

:53021


This thread was automatically locked due to age.
server report.pdf
Parents
  • 0

    Hi,

    The differences I can think of are that scheduled scans run as local system, and "Scan my computer" runs as the logged on user.  I would expect the scheduled scan to therefore be able to scan more files due to what it can access.

    Is the scheduled scan configured to scan inside archives?  If the service has to unpack files to its temp location then this would increase the number of write operations performed.

    Would you be able to run Process Monitor (filtered to File operations and SavService.exe) during the scheduled scan to see the locations of the files being written?  The file summary "By Path", "By Folder" could then be interesting.

    Regards,

    Jak

    :53047
Reply
  • 0

    Hi,

    The differences I can think of are that scheduled scans run as local system, and "Scan my computer" runs as the logged on user.  I would expect the scheduled scan to therefore be able to scan more files due to what it can access.

    Is the scheduled scan configured to scan inside archives?  If the service has to unpack files to its temp location then this would increase the number of write operations performed.

    Would you be able to run Process Monitor (filtered to File operations and SavService.exe) during the scheduled scan to see the locations of the files being written?  The file summary "By Path", "By Folder" could then be interesting.

    Regards,

    Jak

    :53047
Children
No Data
Unfiltered HTML