0

On a Windows 10 machine, I seem to be running into substantially increased write times on our cache files.

Below I have included timing operations for our writes with/without Defender's intervention. For this test, we are writing 32KB blocks to a 1GB, pre-allocated cache file, 36000 times.

Here are file write times with Windows Defender enabled (default behavior on machines):

@@@ Manager: [CacheFile]   --> 123.524 secs
@@@ Count: 36784. Time: 123524(ms). Average: 3(ms). Max Finished: 218(ms).
@@@ Unfinished: 0. Max Unfinished: 0(ms). Min Unfinished: 0(ms).
@@@ Max Finished Item: [Name: [DirectFileWrite:4294967293]. Pid: 0x00000000000002E8. Tid: 0x00000000000010A0. Data: 0x0000000000000000.].
@@@ Max Unfinished Item: [].
@@@ Min Unfinished Item: [].
@@@ Reporting Time: 0(ms).

And here's the same operations performed when our cache file is added to Windows Defender's exclusion list:

@@@ Manager: [CacheFile]   --> 9.194 secs
@@@ Count: 36784. Time: 9194(ms). Average: 0(ms). Max Finished: 126(ms).
@@@ Unfinished: 0. Max Unfinished: 0(ms). Min Unfinished: 0(ms).
@@@ Max Finished Item: [Name: [DirectFileWrite:4294967293]. Pid: 0x00000000000006F4. Tid: 0x000000000000130C. Data: 0x0000000000000000.].
@@@ Max Unfinished Item: [].
@@@ Min Unfinished Item: [].
@@@ Reporting Time: 0(ms).
@@@@@@@@@

I'm thinking that Windows Defender is running some sort of check on the entire file (opening and checking the entire data of the 1GB file), every time we write to the file.

Adding the cache files to the exclusion list would be the last option, so I'm wondering if anyone run in to any issues of similar nature?

I'm using Windows C++ API for all I/O operations.

LeoVannini
  • 95
  • 1
  • 10
  • 5
    Antivirus software killing io is nothing new. – user7860670 Sep 20 '17 at 20:49
  • @VTT Particularly if more than one piece of active scanning software is running. – David Schwartz Sep 20 '17 at 20:50
  • 1
    Why would you be surprised that a program intercepting and analyzing all your IO has a negative impact on performance? – Jesper Juhl Sep 20 '17 at 20:51
  • @JesperJuhl the surprising part is that anybody puts up with it. Although I have to admit that a virus infection can be worse. – Mark Ransom Sep 20 '17 at 20:51
  • I'm not necessarily surprised that the I/O is being negatively impacted, I'm surprised the time jumps from 9 seconds to 120 seconds. – LeoVannini Sep 20 '17 at 20:52
  • @Mark Ransom I don't use Windows personally (nor any kind of "anti-virus" software), but I think the general population has just been suckered into the belief that you need this necessary evil to be safe, so this is just how you should expect things to perform.. and nobody (or close to) pays it any second thought.. it's just "how computers are".. Sad really. – Jesper Juhl Sep 20 '17 at 20:55
  • @LeoVannini "I'm surprised the time jumps from 9 seconds to 120 seconds" - welcome to the crappy world of commercial software in general and "anti virus" software in particular... – Jesper Juhl Sep 20 '17 at 20:58
  • @JesperJuhl You are really missing out, man. In Windows 10 we even have a calculator app that ignores operator precedence! – user4581301 Sep 20 '17 at 21:45
  • @user4581301 have fun with that. – Jesper Juhl Sep 20 '17 at 21:46
  • @JesperJuhl It's because those 9 seconds aren't really measuring I/O speed. You're writing to the same location in the same file over and over. The I/O only takes place once. But the security software has no idea that another write is coming, so it security checks each one. – David Schwartz Sep 20 '17 at 22:40

0 Answers0