Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 3283 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Client performance issues

Igor22

We're running Enterprise Console 4.5 and Endpoint Security and Data Protection 9.5.  What I'v been noticed is that SavService.exe usually shows that it is using approximately 100MB of memory in the Task Manager.  Below are some more details:

Windows XP SP3 w/2GB Ram

SavService.exe

  Working Set = 106,000 K

  Working Set Private = 94,000 K

When the computer is idle there is barely any CPU resources being used, however during a scan, CPU utilization is consistently between 30% and 60% for SavService.exe; the memory utilization stays at about 100MB - 115MB whether idle or scanning. 

I've tried to disable the Write for On-Access scanning but that didn't seem to do anything.  My other On-Access scanning settings align with the BK article here - http://www.sophos.com/support/knowledgebase/article/27213.html

Is it normal for SavService to use around 100MB when idle and 50% CPU when scanning?  I've looked at several machines and they all tell the same story, some are not even usable during the full scan, which takes over an hour. 

:9645


This thread was automatically locked due to age.
Parents
  • 0

    Hi All,

    The short term fluctuation in memory usage is typically brought about by scanning I would think.  This could be on-access scanning, scheduled scanning or both.  Complex files might need to be unpacked, if scan inside archives are enabled this will also contribute to memory usage for this reason.

    The main other consideration is the virus data, this really needs to be held in memory to be accessible as quickly as possible, plus the virus data is always growing. Data can't really be removed just because a threat hasn't been seen for a few years :) If you take the supplemental .ide files for example, at the beginning of the month and the end of the month the savservice.exe is loading a different number.  Checking my machine now I have 386 files which is about 5MB.   If you add to this to all the detection data that is added in a minor version update each month it starts to add up.  Once in a while the data is re-ordered but doing so makes for a larger download as doing this can touch multiple files.

    So taking a look on my machine at the other files that make up the savservice memory total we have:

    50MB is virus data (vdb files)  + the 5MB of ide files + ~20MB of Sophos Dlls  + System dlls + configuration.  (Just looking at the list of dlls loaded by the process in Process Explorer for example will display this sort of thing).

    So I would say 100MB is about right for 9.5 at this time and this will fluctuate to some degree for different reasons: in the short term for scanning and in the slightly longer term virus data.

    Also of note as you touched on CPU usage, SAV 9.7 will have a low priority scanning mode for scheduled scans which will cause savservice to back off as required. So the CPU should be given back to processes that require it.

    Regards,

    Jak

    :9651
Reply
  • 0

    Hi All,

    The short term fluctuation in memory usage is typically brought about by scanning I would think.  This could be on-access scanning, scheduled scanning or both.  Complex files might need to be unpacked, if scan inside archives are enabled this will also contribute to memory usage for this reason.

    The main other consideration is the virus data, this really needs to be held in memory to be accessible as quickly as possible, plus the virus data is always growing. Data can't really be removed just because a threat hasn't been seen for a few years :) If you take the supplemental .ide files for example, at the beginning of the month and the end of the month the savservice.exe is loading a different number.  Checking my machine now I have 386 files which is about 5MB.   If you add to this to all the detection data that is added in a minor version update each month it starts to add up.  Once in a while the data is re-ordered but doing so makes for a larger download as doing this can touch multiple files.

    So taking a look on my machine at the other files that make up the savservice memory total we have:

    50MB is virus data (vdb files)  + the 5MB of ide files + ~20MB of Sophos Dlls  + System dlls + configuration.  (Just looking at the list of dlls loaded by the process in Process Explorer for example will display this sort of thing).

    So I would say 100MB is about right for 9.5 at this time and this will fluctuate to some degree for different reasons: in the short term for scanning and in the slightly longer term virus data.

    Also of note as you touched on CPU usage, SAV 9.7 will have a low priority scanning mode for scheduled scans which will cause savservice to back off as required. So the CPU should be given back to processes that require it.

    Regards,

    Jak

    :9651
Children
No Data
Unfiltered HTML