6 ms·

My only grief with Windows Defender is its resource use. My Windows 10 computer booted 26 hours ago. Windows Defender is using 2186 MiB of RAM. I don’t think th

by fuzzy2 5y ago

My only grief with Windows Defender is its resource use. My Windows 10 computer booted 26 hours ago. Windows Defender is using 2186 MiB of RAM. I don’t think that’s appropriate, even if I have 32 GiB in total. With Office 365 ATP, things get even slower, too, which is not so great on my work device. Detection rate is one thing. Performance is another. Both are important.

EMM_386 5y ago
> Windows Defender is using 2186 MiB of RAM. I don’t think that’s appropriate. These memory-type debates come up time and time again. Keep in mind I'm a programmer from the DOS days, note my user name on when this was an important issue. We had to cram every byte. These programs will use idle RAM as they see necessary to be performant. If you aren't using the RAM, why not actually use it for what it's for? Are you under memory pressure? How many GB of RAM do you currently have and how often are you capping it out? Try seeing what happens when you are at your GB RAM cap. "I don't think that's appropriate" is highly subjective and it depends on what it does, and what you are currently doing.
- beagle3 5y ago
  Where’s the setting where one decides between file system cache, anti-virus, swap space, and other uses? If there was one, it would be fine.
  - TameAntelope 5y ago
    Why are you trying to manage it? Let the OS do its thing, it’s really good at memory management.
    - gruez 5y ago
      AFAIK the OS file cache doesn't get counted towards the process's memory usage, so if windows defender is showing up as using 2GB of memory, it really is using 2GB of memory for the app itself.
    - beagle3 5y ago
      I have a DBMS, a browser, and an antivirus - all of which would love to have "free ram" that's not currently in use by other programs in order to speed up its own work. How do I tell the system which of them I prefer (or some rank), instead of letting them fight it out, each of them thinking that they are the process entitled to all the perks of the currently unused memory?
      - EMM_386 5y ago
        > instead of letting them fight it out Nothing is "fighting it out", there are internal heuristics to understand what applications need that RAM. This is an internal OS feature of modern operating systems. If you are not capped out on RAM usage, this point is moot. If you are truly running at the RAM cap, to where the OS is paging out memory to disk and you have contention, you need more RAM.
        beagle3 5y ago
        Yes, but the context of this discussion was Q:"why is Windows Defender using 2GB of ram!?!?" A:"It only does that if no other process needs the memory". Which works fine only if there is only one distinguished process. My point was that there isn't one distinguished process, and that thus -- as you described -- it should be left to the OS to decide and not to Windows Defender.
      - happymellon 5y ago
        Either they need the memory or they don't. If they feel like they need to store something to save on network costs then they should store it, and the OS will page it if it isn't used often. The AV doesn't need to take "free ram" except when it tries to guess what the OS will do with disk cache. But by putting it in the AV cache it then prevents other software from using the cache. Just use the OS level disk cache.
  - omegalulw 5y ago
    He is saying that many programs are written to use "free RAM", ergo unless defender is still using 2GB ram when your PC is at your RAM limit you don't have a problem. Every OS does it, let your OS manage RAM.
    - gruez 5y ago
      >Every OS does it, let your OS manage RAM. Unlike linux[1], windows task manager correctly shows "cached" ram as "free" ram. Therefore it's highly unlikely that the memory usage is from the OS caching mechanism. As for the actual behavior of using free ram, what happens if there are two apps that try to use the same behavior? ie. you have windows defender and a DBMS installed, both of them try to use up all the free ram. In this situation, what makes you think the behavior of "using all the available free RAM" behavior of windows defender wouldn't push out the "using all the available free RAM" behavior of the DMBS", leading to worse performance? [1] https://www.linuxatemyram.com/ https://www.linuxatemyram.com/
      - jcrawfordor 5y ago
        Task Manager does not report memory use by the OS I/O cache, but there's no general way for it to know what portion of process memory is "necessary" versus "nice to have," so many processes have some type of internal caching (web browsers for example!) that they are able to dump but will be included in their reported memory consumption. Windows has several different layers of caching which makes this a bit complicated to generalize about, but that's sort of the point... Task Manager is not clairvoyant, and so if a process has allocated memory other than specifically through an OS caching infrastructure it reports it as memory in use. The OS caching infrastructure is not so general that it covers every need to hold some memory for performance optimization. Windows has an infrastructure to prioritize memory availability by process, and to notify processes when there is physical memory pressure so that they can act accordingly. I'm not sure, but as a first-party component I would assume that Windows Defender uses these appropriately. That said, like most real-time antivirus Defender does feel that it is important to complete real-time protection scans and will sometimes do so at the cost of performance. The logic here is that it is important to complete these scans even under conditions of resource pressure, otherwise malware could just do things like cause high system load before downloading a second stage in order to avoid Defender completing a real-time scan. Unfortunately this does sometimes cause headaches, for example I saw a situation recently where someone ran a tool that opened a huge number of media files on a NAS in order to read their metadata. This resulted in Defender queuing up a real-time scan of probably over a TB over the network since it saw all of these 10GB+ files being touched, with a definite negative impact on performance. I still wouldn't give "exclude network mounts" as general advice as some people do, but that's an example of sort of a pathological case for real-time scanning where you probably want to exclude it.
- fuzzy2 5y ago
  Sure maybe the memory is freed (or paged out) as pressure rises. The former is however not guaranteed in any way and requires that Windows Defender (or whatever other application) actively monitor the memory situation, taking appropriate action as it changes. That's something I'd expect a database to do. A virus scanner? Not so much.
  - swasheck 5y ago
    every new dotnet package, powershell module, go module, container image, etc that i pull and want to start using results in about 10 minutes of complete system unavailability due to defender going off the rails with ram and cpu consumption. it used to be i’d have to wait for the compiler to build, now i have to wait for defender to defend.
    - smt88 5y ago
      Interesting. I haven't had this experience at all. Are you using non-standard settings? I think you can exclude certain directories from Defender scanning too.
      - swasheck 5y ago
        i’m using the corporate gpo-enforced settings. i’ll try to override them tomorrow.
- csmpltn 5y ago
  > "Are you under memory pressure? How many GB of RAM do you currently have and how often are you capping it out? Try seeing what happens when you are at your GB RAM cap." Where's the explicit code in Defender which ensures it only does its' thing if the system isn't under heavy load? Also, you do realize that if every program followed this pattern - it would cease to work?
jeroenhd 5y ago
I've never had RAM issues with Defender but I have noticed that I/O suffers terribly when Defender is enabled. Twenty second installs take five minutes, and don't you even dare try running a `yarn install` because Defender WILL scan each and every file of your 65535 dependencies and it WILL NOT use more than a single core it seems. Whenever I see a machine that's slow or sluggish during operation but reports that only 60% of it's resources are used, Windows Defender is usually the culprit. I've nerfed Windows Defender for performance reasons to the point that I wonder why I even bother anymore.
- toast0 5y ago
  > because Defender WILL scan each and every file of your 65535 dependencies and it WILL NOT use more than a single core it seems. Does yarn use more than a single core? I've seen some analysis articles that a major root cause of the slowdowns here are that the scanning API is hooked into file close and scanning takes time, so if you have a straightforward open file, write to file, close file, repeat single threaded process, your throughput gets really limited. I don't think there's a Windows API for asynchronous close, but if you send the handle to a thread (pool?), that will get you much better results.
  - jeroenhd 5y ago
    I wouldn't know, to be honest. It's not just a yarn problem, though. Anything operating on lots of tiny files (from IDEs to git to setup executables) gets bogged down to Windows Defender in strange ways. None of the resources in task manager (or the resource manager thing) will show anything being capped so it's hard to troubleshoot what system Defender stresses so much.
    - toast0 5y ago
      > None of the resources in task manager (or the resource manager thing) will show anything being capped so it's hard to troubleshoot what system Defender stresses so much. Yeah, task manger is missing the most useful feature of FreeBSD top, the state column that lets you know what the process was doing at the sample time. If you saw your installer was always in state close handle, you'd have a good guess. But it's a straight forward throughput problem; if it takes 1 ms to scan a file, and there's no concurrency or pipelining, then you're limited to 1000 files per second. If you can thread pool closing, you get a lot more throughput. Unfortunately, everything that runs on windows and expects to close lots of files needs to manage a threadpool to close, but usually developers don't get to pick their platform, their users pick.
hnick 5y ago
We setup a new lower-end AWS server for dev only and had to disable it because it was impossible to login or run SQL Server queries due to hitting quotas. Probably a bug in the implementation, but couldn't find a better fix. We do have IP whitelists on it but it still made me uneasy turning it off. Maybe this is normal though, I don't AWS much.
thot_experiment 5y ago
I ripped out all of Windows' security features before even booting up the first time using the recovery console. It's blissful. Opening the windows security window just shows a blank white rectangle. My computer idles at 0% CPU. I never get annoying security popups, I never have to worry about Windows deciding to delete something to "protect" me. It truly makes my life much better. I wish there was just a button for it so I didn't have to go digging deep into the internals to do it. Too bad it's the norm to tell people how to run their computers these days. I've got Windows Sandbox to try anything shady in and a decent firewall on the edge between me and the rest of the world, I generally don't worry too much.
h0ek 5y ago
TBH in one company we worked on Windows laptops. I was rebooting my laptop on every Friday and my friend once a month. His everyday task took much longer and laptop was slower, after reboot both was fast and fresh. That small dumb experiment made me sure windows machines needed a regular restart. Same with Android phones. When I set scheduled phone reboot on every Saturday evening it started to work without any issues. (https://i1.sndcdn.com/artworks-000462382710-ibx95g-t500x500.jpg https://i1.sndcdn.com/artworks-000462382710-ibx95g-t500x500....) :D
GordonS 5y ago
That sounds like something is wrong. I checked on 5 different machines, one of which is a corporate laptop, and every one showed Defender using 100-150MB memory. 3 of those machines have 64GB memory. My desktop (which has 48GB memory) has been on for a week, and is currently showing 135MB. In my experience, Defender's resource usage is actually low by comparison to others. McAfee is the worst, by a long shot - fans spin constantly, it uses up to gigabytes or memory, and is a ludicrous CPU hog.

by fuzzy2 5y ago

EMM_386 5y ago

> Windows Defender is using 2186 MiB of RAM. I don’t think that’s appropriate. These memory-type debates come up time and time again. Keep in mind I'm a programmer from the DOS days, note my user name on when this was an important issue. We had to cram every byte. These programs will use idle RAM as they see necessary to be performant. If you aren't using the RAM, why not actually use it for what it's for? Are you under memory pressure? How many GB of RAM do you currently have and how often are you capping it out? Try seeing what happens when you are at your GB RAM cap. "I don't think that's appropriate" is highly subjective and it depends on what it does, and what you are currently doing.

beagle3 5y ago
Where’s the setting where one decides between file system cache, anti-virus, swap space, and other uses? If there was one, it would be fine.
- TameAntelope 5y ago
  Why are you trying to manage it? Let the OS do its thing, it’s really good at memory management.
  - gruez 5y ago
    AFAIK the OS file cache doesn't get counted towards the process's memory usage, so if windows defender is showing up as using 2GB of memory, it really is using 2GB of memory for the app itself.
  - beagle3 5y ago
    I have a DBMS, a browser, and an antivirus - all of which would love to have "free ram" that's not currently in use by other programs in order to speed up its own work. How do I tell the system which of them I prefer (or some rank), instead of letting them fight it out, each of them thinking that they are the process entitled to all the perks of the currently unused memory?
    - EMM_386 5y ago
      > instead of letting them fight it out Nothing is "fighting it out", there are internal heuristics to understand what applications need that RAM. This is an internal OS feature of modern operating systems. If you are not capped out on RAM usage, this point is moot. If you are truly running at the RAM cap, to where the OS is paging out memory to disk and you have contention, you need more RAM.
      - beagle3 5y ago
        Yes, but the context of this discussion was Q:"why is Windows Defender using 2GB of ram!?!?" A:"It only does that if no other process needs the memory". Which works fine only if there is only one distinguished process. My point was that there isn't one distinguished process, and that thus -- as you described -- it should be left to the OS to decide and not to Windows Defender.
    - happymellon 5y ago
      Either they need the memory or they don't. If they feel like they need to store something to save on network costs then they should store it, and the OS will page it if it isn't used often. The AV doesn't need to take "free ram" except when it tries to guess what the OS will do with disk cache. But by putting it in the AV cache it then prevents other software from using the cache. Just use the OS level disk cache.
- omegalulw 5y ago
  He is saying that many programs are written to use "free RAM", ergo unless defender is still using 2GB ram when your PC is at your RAM limit you don't have a problem. Every OS does it, let your OS manage RAM.
  - gruez 5y ago
    >Every OS does it, let your OS manage RAM. Unlike linux[1], windows task manager correctly shows "cached" ram as "free" ram. Therefore it's highly unlikely that the memory usage is from the OS caching mechanism. As for the actual behavior of using free ram, what happens if there are two apps that try to use the same behavior? ie. you have windows defender and a DBMS installed, both of them try to use up all the free ram. In this situation, what makes you think the behavior of "using all the available free RAM" behavior of windows defender wouldn't push out the "using all the available free RAM" behavior of the DMBS", leading to worse performance? [1] https://www.linuxatemyram.com/ https://www.linuxatemyram.com/
    - jcrawfordor 5y ago
      Task Manager does not report memory use by the OS I/O cache, but there's no general way for it to know what portion of process memory is "necessary" versus "nice to have," so many processes have some type of internal caching (web browsers for example!) that they are able to dump but will be included in their reported memory consumption. Windows has several different layers of caching which makes this a bit complicated to generalize about, but that's sort of the point... Task Manager is not clairvoyant, and so if a process has allocated memory other than specifically through an OS caching infrastructure it reports it as memory in use. The OS caching infrastructure is not so general that it covers every need to hold some memory for performance optimization. Windows has an infrastructure to prioritize memory availability by process, and to notify processes when there is physical memory pressure so that they can act accordingly. I'm not sure, but as a first-party component I would assume that Windows Defender uses these appropriately. That said, like most real-time antivirus Defender does feel that it is important to complete real-time protection scans and will sometimes do so at the cost of performance. The logic here is that it is important to complete these scans even under conditions of resource pressure, otherwise malware could just do things like cause high system load before downloading a second stage in order to avoid Defender completing a real-time scan. Unfortunately this does sometimes cause headaches, for example I saw a situation recently where someone ran a tool that opened a huge number of media files on a NAS in order to read their metadata. This resulted in Defender queuing up a real-time scan of probably over a TB over the network since it saw all of these 10GB+ files being touched, with a definite negative impact on performance. I still wouldn't give "exclude network mounts" as general advice as some people do, but that's an example of sort of a pathological case for real-time scanning where you probably want to exclude it.
fuzzy2 5y ago
Sure maybe the memory is freed (or paged out) as pressure rises. The former is however not guaranteed in any way and requires that Windows Defender (or whatever other application) actively monitor the memory situation, taking appropriate action as it changes. That's something I'd expect a database to do. A virus scanner? Not so much.
- swasheck 5y ago
  every new dotnet package, powershell module, go module, container image, etc that i pull and want to start using results in about 10 minutes of complete system unavailability due to defender going off the rails with ram and cpu consumption. it used to be i’d have to wait for the compiler to build, now i have to wait for defender to defend.
  - smt88 5y ago
    Interesting. I haven't had this experience at all. Are you using non-standard settings? I think you can exclude certain directories from Defender scanning too.
    - swasheck 5y ago
      i’m using the corporate gpo-enforced settings. i’ll try to override them tomorrow.
csmpltn 5y ago
> "Are you under memory pressure? How many GB of RAM do you currently have and how often are you capping it out? Try seeing what happens when you are at your GB RAM cap." Where's the explicit code in Defender which ensures it only does its' thing if the system isn't under heavy load? Also, you do realize that if every program followed this pattern - it would cease to work?

jeroenhd 5y ago

I've never had RAM issues with Defender but I have noticed that I/O suffers terribly when Defender is enabled. Twenty second installs take five minutes, and don't you even dare try running a `yarn install` because Defender WILL scan each and every file of your 65535 dependencies and it WILL NOT use more than a single core it seems. Whenever I see a machine that's slow or sluggish during operation but reports that only 60% of it's resources are used, Windows Defender is usually the culprit. I've nerfed Windows Defender for performance reasons to the point that I wonder why I even bother anymore.

toast0 5y ago
> because Defender WILL scan each and every file of your 65535 dependencies and it WILL NOT use more than a single core it seems. Does yarn use more than a single core? I've seen some analysis articles that a major root cause of the slowdowns here are that the scanning API is hooked into file close and scanning takes time, so if you have a straightforward open file, write to file, close file, repeat single threaded process, your throughput gets really limited. I don't think there's a Windows API for asynchronous close, but if you send the handle to a thread (pool?), that will get you much better results.
- jeroenhd 5y ago
  I wouldn't know, to be honest. It's not just a yarn problem, though. Anything operating on lots of tiny files (from IDEs to git to setup executables) gets bogged down to Windows Defender in strange ways. None of the resources in task manager (or the resource manager thing) will show anything being capped so it's hard to troubleshoot what system Defender stresses so much.
  - toast0 5y ago
    > None of the resources in task manager (or the resource manager thing) will show anything being capped so it's hard to troubleshoot what system Defender stresses so much. Yeah, task manger is missing the most useful feature of FreeBSD top, the state column that lets you know what the process was doing at the sample time. If you saw your installer was always in state close handle, you'd have a good guess. But it's a straight forward throughput problem; if it takes 1 ms to scan a file, and there's no concurrency or pipelining, then you're limited to 1000 files per second. If you can thread pool closing, you get a lot more throughput. Unfortunately, everything that runs on windows and expects to close lots of files needs to manage a threadpool to close, but usually developers don't get to pick their platform, their users pick.

hnick 5y ago

We setup a new lower-end AWS server for dev only and had to disable it because it was impossible to login or run SQL Server queries due to hitting quotas. Probably a bug in the implementation, but couldn't find a better fix. We do have IP whitelists on it but it still made me uneasy turning it off. Maybe this is normal though, I don't AWS much.

thot_experiment 5y ago

I ripped out all of Windows' security features before even booting up the first time using the recovery console. It's blissful. Opening the windows security window just shows a blank white rectangle. My computer idles at 0% CPU. I never get annoying security popups, I never have to worry about Windows deciding to delete something to "protect" me. It truly makes my life much better. I wish there was just a button for it so I didn't have to go digging deep into the internals to do it. Too bad it's the norm to tell people how to run their computers these days. I've got Windows Sandbox to try anything shady in and a decent firewall on the edge between me and the rest of the world, I generally don't worry too much.

h0ek 5y ago

TBH in one company we worked on Windows laptops. I was rebooting my laptop on every Friday and my friend once a month. His everyday task took much longer and laptop was slower, after reboot both was fast and fresh. That small dumb experiment made me sure windows machines needed a regular restart. Same with Android phones. When I set scheduled phone reboot on every Saturday evening it started to work without any issues. (https://i1.sndcdn.com/artworks-000462382710-ibx95g-t500x500.jpg https://i1.sndcdn.com/artworks-000462382710-ibx95g-t500x500....) :D

GordonS 5y ago

That sounds like something is wrong. I checked on 5 different machines, one of which is a corporate laptop, and every one showed Defender using 100-150MB memory. 3 of those machines have 64GB memory. My desktop (which has 48GB memory) has been on for a week, and is currently showing 135MB. In my experience, Defender's resource usage is actually low by comparison to others. McAfee is the worst, by a long shot - fans spin constantly, it uses up to gigabytes or memory, and is a ludicrous CPU hog.