@Olsen
High CPU during ODS is expected behavior and is by design in order to get scans completed as quickly as possible and lessen the window at which the system is at higher duress due to full system scanning alongside the continuous On-Access Scanning. Windows process prioritization will provide the scanner with all of the available resources for this reason, until a process with higher priority requests use where it will temporarily hand it off to the requesting process before handing it back to the scanner. For this reason, we advise that your ODS be scheduled at a non-peak business hour, or on weekends, in order to limit the impact to the end user.
The first configuration change that can assist in making significant changes to scan duration and performance is disabling scanning of archives during ODS. This is considered to be a very minor to non-existent security risk because all files inside an archive are scanned when the archive is opened or extracted, making scanning these files redundant, because OAS will scan the archive if it is accessed or opened at any time and scanning them during an ODS can take some time. This extended time to scan the large archive files prevents Microsoft's priority allocation for resources from handing the processing power to other processes that request it until the entire archive is scanned or the default 45 second timeout is reached. If there is a large number of archives on a system, this scenario is more frequent and can create significant impact to performance and scan duration.
The second change is to change system utilization from normal to low in order to set us at the lowest priority for resource allocation. Please keep in mind that this will not eliminate increased CPU consumption by ODS, but can increase the frequency and speed at which resources are handed off to other processes via priority leveling of the OS.
Third, you can look to implement the option of "scan only when idle" in order to only allow the ODS to run when the OS has signified the system is in an idle state and will allow the ODS to run. If the system comes out of idle, the scan will pause until next idle.
We recommend that you look towards these config changes to assist in lessening the impact of the ODS. However, as described, high CPU during ODS is expected by design, and there is not much that can be done to make a dramatic difference in scanning. Please review the following article that go further in depth in regards to these concepts: KB55145
You can also review the best practices documentation for optimum ODS configuration: KB74059
Please be advised as well, with the future release of ENS 10.7, there will also be the release of a feature which will allow for enhanced control and administrator limits against CPU consumption by ENS. It sounds like this could be a feature that you would be very interested in, and I recommend that you look to future release information regarding this product release 🙂
Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
You Deserve an Award
