Which files go into the persistent cache ?

[davexnet]

I noticed opening an application such as Sony Vegas, the "files scanned" increases by about 100 or so.
Opening the program later during the day (same boot) it's indeterminate whether the files are
rescanned or not.

However, if I boot the machine and open Vegas, the files are always rescanned.
Do only certain files go into the persistent cache ?

Is the transient/persistent cache actually working ?

[igor]

Yes, only specific files go into the persistent cache. The transient cache should get all scanned files I believe (but I'm not 100% sure) - but only till reboot or virus definition update.

[davexnet]

Thanks igor.  One of the things I noticed,
opening the application within a few minutes of closing it, it seemed no files were rescanned.
However, opening it about 30 minutes later, (same boot) rescanned the files.

This would be a fantastic feature if it were working properly.

[DavidR]

I don't believe that the files in the transient cache are actually scanned, provided you haven't rebooted or had a VPS update since the last scan. But I don't believe the scanned totals are decreased for any listed in the transient cache as there isn't any third option in the reporting files not scanned as they were in any cache.

[davexnet]

HI DavidR,
May be not very scientific, but what I was doing was opening the GUI at the main shield
and taking note of the "files scanned".  I opened my app. and saw the total increase by about 100.

Did the same thing a little later (one or two minutes),
the app. startup was noticeably quicker and it appeared no new
scanning was done.  Could it be partly because the files are still in memory?

Then 20 minutes later, the app. startup was slow again, and the GUI shows the "files scanned"
once again increased by 90-100, the same as it did the first time.

Is it working or not?

[DavidR]

I can't say as I'm just an avast user like yourself, so that would have to fall to one of the avast developers and would almost certainly require some additional analysis tool to get more details.

You could try a test to see what exactly is being scanned, by changing the report settings in the File System Shield, Expert Settings, Report File and include OK items. This would massively increase the file system shield report file and not something you would want on all the time.

However, as I said before I don't know is the fact that they pass through the scanning process, where they would be compared with the persistent/transient caches and let through unmolested, but at that point they may already have been included in the basic stats count.

So it really needs one of the developers who knows much more about the physical process of how the two functions relate, the exclusion of files in the two caches against what is recorded in the basic stats display.

[davexnet]

Thanks DavidR.
I see that you can set the program to record to the persistent cache for on-demand and real-time
scanning.  I did an on-demand scan of a directory containing about 6,000 small files
(a mix of exe, zip, rar, 7z, dll, etc,etc) and checked off save to persistent cache.

The size of the db*.dat file increased from about 40KB to about 400KB.  Only some reboots and further
testing will show if there is a benefit when rescanning that folder.

If I create the persistent cache from on-demand scanning, (for a particular drive or folder)
does it benefit real-time scanning from the same drive or folder?  I guess it should if it were
working properly.  As you said it would be nice if one of the Avast techs or developers could
provide some further details.

Am I right in thinking there may be another build today/tomorrow ?

[DavidR]

Yes, but weren't we talking about the transient cache from Reply #2 onwards ?

If zip, rar, 7z files are being added to the, then presumably you are having avast scan them in the first place, these files also wouldn't be included in the 'persistent' cache as they would be unlikely to qualify.

Archive files are inert by their nature and aren't scanned by default, so if you change the default settings then you are going to be scanning these files unnecessarily.

The Persistent and Transient caches should also improve the real-time scanning speed, but any increase would be marginal in real-time scanning as you aren't scanning masses of files, only those you actually access, so would only be skipping one file at a time.

I think we are in danger of getting totally mixed up about the two different caches.
avast 5 - Scan Transient and Persistent caching to speed scanning.

Use transient caching - if transient caching is used, a file that has been scanned, and in which no infection was detected, will not be scanned again the next time it is accessed. However, this is only valid until the next virus definitions update, as the file may contain an infection that was not previously detected but which may be detected based on the new virus definitions. Also, information that the file is clean will only be stored in the computer's operating (temporary) memory. This means that when the system is restarted the information will be lost, therefore the file will also be scanned again the next time it is accessed after a system restart. This box is checked by default; if you want files to be scanned every time they are accessed. this box should be unchecked.

Use persistent caching - if persistent caching is used, the information about the scanned file is stored in the permanent memory. This means it is not lost after a system restart and it is also not affected by virus definition updates. Consequently, persistent caching is suitable only for files which are guaranteed not to contain any virus infection e.g. operating system files, files signed by trusted publishers, or other files covered by the avast! whitelist. This box is checked by default; if you want all files to be scanned regardless of their trust status, this box should be unchecked.

[davexnet]

Alright, good enough for now. Yes we were talking about the transient cache,
but since I'm not seeing predictable results with either, I got them mixed up.

Thanks for your help.

[DavidR]

You're welcome.

[reesd]

Use persistent caching - if persistent caching is used, the information about the scanned file is stored in the permanent memory. This means it is not lost after a system restart and it is also not affected by virus definition updates. Consequently, persistent caching is suitable only for files which are guaranteed not to contain any virus infection e.g. operating system files, files signed by trusted publishers, or other files covered by the avast! whitelist. This box is checked by default; if you want all files to be scanned regardless of their trust status, this box should be unchecked.

Going back to the original subject line for this thread, what files exactly do go into the persistent cache? Is that a secret for security reasons?

And while I am asking, how do objects get out of the persistent cache? Date/size change?

Also, I thought I saw somewhere that I could change/augment that list, but now I can't find it. Did I imagine it or did it go away in an update?

Thanks,
d

[reesd]

Use transient caching - if transient caching is used, a file that has been scanned, and in which no infection was detected, will not be scanned again the next time it is accessed. However, this is only valid until the next virus definitions update, as the file may contain an infection that was not previously detected but which may be detected based on the new virus definitions. Also, information that the file is clean will only be stored in the computer's operating (temporary) memory. This means that when the system is restarted the information will be lost, therefore the file will also be scanned again the next time it is accessed after a system restart. This box is checked by default; if you want files to be scanned every time they are accessed. this box should be unchecked.

And heck, while I am at it, I'll ask about transient threading also since that is what most of this thread was actually about.

I seem to see files showing up multiple times in the GUI and in my FileSystemShield.txt report (which I have set to log everything right now). Some show up every 30 minutes (when an app called Launchy I am using does a scan). I would have thought that the transient cache functionality would void that. Are there cases where hings are not put in the transient cache? Maybe for smaller files (one the main ones I am seeing is .lnk files)?

Or maybe it is using the caches, but still lists the file in the GUI/report just to let me know it thought about it?

Thanks,
d

[DavidR]

First I'm an avast user not an avast developer or employee so I can't say what is or isn't included in either cache.

I don't believe they would be any more detailed in what goes into the persistent cache (after first being scanned) than the description implies. If files change, then they obviously don't meet the original description so would be scabbed again and only included if still considered "guaranteed not to contain any virus infection e.g. operating system files, files signed by trusted publishers, or other files covered by the avast! whitelist. "

I can't say anything about that as I have zero information on what is being scanned nor what your settings are in the file system shield (re caching, see image) or the on-demand scans in relation to the use and population of the caches, etc...

As far as reported or counted files goes, the file would have to be checked against the various caches to see if it was in it and that activity may be counted, though not physically scanned, but that is speculation on my part.

The transient cache might well contain the launchy but it wouldn't necessarily include what it is scanning.