Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Avaster on September 04, 2007, 12:07:31 PM
-
Avast memory usage (3 main processes) is relatively high. Those 3 processes takes about 13-16MB.
-
The numbers you quoted sound quite normal to me... ;)
-
Not to mention very low compared to other AV's ...
-
13-16Mb is a drop in the ocean in today's application terms.
Firexfox is currently using 63Mb.
My firewall, outpost pro 32.7Mb.
Explorer is using 30Mb.
So avast by comparison to these is very light and compared to many other AV (apples with apples) it is extremely light. Remember your AV resource load has a direct relationship with what other applications you are running and what you are doing.
-
While working with latest Avast! beta build (1038)
TaskManager Memory Usage / Peak MU
ashDisp.exe 6625K - 28612K
ashMaiSv.exe 820K - 19568K
ashServ.exe 17496K - 49212K
ashWebSv.exe 528K - 17640K
ashUpdSv.exe 256K - 2160K
Process Explorer Private Bytes / Peak PB, Working Set, Peak WS
ashDisp.exe 3252K - 17124K , 6660K - 28612K
ashMaiSv.exe 3860K - 9736K , 2364K - 19568K
ashServ.exe 25040K - 29944K , 17816K - 49212K
ashWebSv.exe 14628K - 19372K , 528K - 17640K
ashUpdSv.exe 872K - 872K , 340K - 2160K
it may be bit higher than usual,
but this is with everything set high and active ...
only coders from Alwil may answer if there is any chance to lower memory usage w/o sacrify something elsewhere ...
btw. while working with memory hungry application (1.5GB+ memory sucked in second) all Avast! processes in memory dropped to less than 1MB each
-
Avast memory usage (3 main processes) is relatively high. Those 3 processes takes about 13-16MB.
OMG, I think it is very low and you hardly find one AV that has less resource usage
-
I think you should probably discount the Peak as that is for activity, which may differ wildly from user to user and drops back to sort of normal levels afterwards.
I think it is Vlk who suggests the VM size in Task Manager is a better gauge of memory use, that and or Mem Usage
-
btw. while working with memory hungry application (1.5GB+ memory sucked in second) all Avast! processes in memory dropped to less than 1MB each
Well, that's what the OS memory management is for, isn't it? ;) (swap out recently unused parts when more memory is needed elsewhere).
I think you should probably discount the Peak as that is for activity, which may differ wildly from user to user and drops back to sort of normal levels afterwards.
Yes, the peak values don't say much. avast! uses file-mapping to access scanned files; so, if there was a big file scanned in the past (or a big file was extracted from archive), the peak might be rather huge. But of course, the usage is so high only for the moment of the scanning.
-
Avast memory usage (3 main processes) is relatively high. Those 3 processes takes about 13-16MB.
OMG, I think it is very low and you hardly find one AV that has less resource usage
I just compared to one AVG user, whose memory usage was about 3Mb. (3 AVG processes).
-
I just compared to one AVG user, whose memory usage was about 3Mb. (3 AVG processes).
Only AVGAV, maybe. I have used AVG; I know it.
But AVGAV free cannot provide the same security as avast! does
-
hey i said nothing against Avast! :) i find it pretty fine ... i dont care if it uses some more MBs when they FREE to use :)
and there is no hope for people who don't get difference between max,avg and min usage of memory sets :)
-
I just compared to one AVG user, whose memory usage was about 3Mb. (3 AVG processes).
Ahh, AVG.
The AVG scanning engine actually runs in the kernel (in the kernel-mode driver avgcore.sys) so you won't see its memory usage in the Task Manager. Just FYI. :)
-
That is sneaky, is there any advantage in doing this or is it just masking resource usage ?
-
Ahh, AVG.
The AVG scanning engine actually runs in the kernel (in the kernel-mode driver avgcore.sys) so you won't see its memory usage in the Task Manager. Just FYI. :)
Is it a good policy?
Why don't you do the same?
How can we measure such resources usage in this situation (kernel-mode driver)?
-
Well, "policy"... it's connected with the structure of the program, how it's done (whether the scanner is in kernel mode or user mode) - which is a design decision, I'd say.
-
and i guess, "error in user mode = program crash only" but error in kernel mode = blue screen".. right?
-
That is sneaky, is there any advantage in doing this or is it just masking resource usage ?
Well, it has its pros and cons.
The advantage is that it makes the filesystem scanner (that needs to run in kernel-mode anyway) slightly faster (avoiding the need of transitions between kernel- and user- mode).
The disadvatange is that any error in the engine usually means instant computer crash (or instant reboot).
Also, porting most stuff to kernel-mode is quite hard - so e.g. unpacking support is harder to implement in this case (especially if you want/need to use 3rd party code). That's one of the reasons you cannot enable archive unpacking in AVG's on-access scanner, by the way... ;)
Also, it's worth noting that this model had been used by Norton and McAfee (roughly till their 2004 versions). It was abandoned then - I suppose they figured out that the drawbacks simply outweighted the benefits.
How can we measure such resources usage in this situation (kernel-mode driver)?
There's no easy way because the driver memory is allocated from a system-wide pool (i.e. it doesn't belong to any process, really).
A simple way to get a rough idea is:
- boot the machine with the driver active
- in the Task Manager, go to the Performance tab and note the values in the Kernel Memory section (Total, Paged and NonPaged values)
- uninstall the driver (or the software which carries the driver)
- reboot
- again, use the Task Manager to find out the Kernel memory usage
The difference should quite accurately indicate how much memory the driver allocated.
A slighly more sophisticated method of resource tracking is to use the Windows Driver Verifier (verifier.exe). This is a handy tool (ships with Win2K+), but it's not really designed for normal users (just for developers/geeks). The tool allows you to track all memory blocks allocated by a driver, and much more.
and i guess, "error in user mode = program crash only" but error in kernel mode = blue screen".. right?
Undoubtly... :)
And this includes e.g. cases of (slightly) faulty RAMs - the larger the "crash surface", the bigger the chance that the computer will keep crashing on the user. Even MS is slowly realizing that their goal for the future should be to minimize the amount of code running in the kernel - as is evident from the early specs/builds of Windows 7 (the successor of Vista/Win2K8Srv).
Cheers
Vlk
-
Thanks for the detailed explanation Vlk, very interesting.
-
Thanks for the info Vlk.
You've been in Redmond, do you know anything on Windows 7?
Is MS dropping Vista?
-
You've been in Redmond, do you know anything on Windows 7?
I know some stuff but as a matter of fact, I'm not supposed to discuss them publicly. Sorry :-[
(but it's nothing too important, really)
Is MS dropping Vista?
No way :)
-
Is MS dropping Vista?
No way :)
Thanks 8)