DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 5938E384AB45
Message-ID: <cab76864-77d6-48d1-85cb-ceda3e8b1e4e@gmx.com>
Date: Wed, 10 Apr 2024 17:43:05 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Cygwin a bit slow
To: cygwin@cygwin.com
References: <CAL8MddUVziE5+10=dANw_H8ySJRvhj-wZ857YqkcudmTZbJe+w@mail.gmail.com>
 <CA+kUOakQhTnCLdkhBCtiRn+G+0K4nQ-UCYN65044+D_OMsqfGg@mail.gmail.com>
 <CAL8MddWSvE8JHMSLzosREvWvzrJGGEEDi0cCQprL05SMGSsPqg@mail.gmail.com>
 <df9abc70-6135-2871-c78f-aa87bc12f25b@t-online.de>
Content-Language: en-GB
In-Reply-To: <df9abc70-6135-2871-c78f-aa87bc12f25b@t-online.de>
UI-OutboundReport: notjunk:1;M01:P0:GtNt5eWpsIo=;FWUH26HJ+PGfXTgXQbbo/Li6HiE
 1Xidu+Z5/n/0NrvhxP7H1k9UaPbLCQf4LcbJ5f0ED85VQ2UNOHqPXJOrBEyVfIOggusePvkHV
 FqdvDexUXXO9a/yIJrMqXG/m++Ew4eCOngWZxqXOVgu+d0Ty74gtcbREmTjskN1byOLsfQwRi
 9FK4i+LY8QYNwRsk85HofmTRPW83iJdZAGk1WbZHJRahzZNTkHwtuKmKRpjTf2PZz7F9YGE43
 T5mh/xv5Y7EuO/kIwk5FqlqZKH/EgSMeejxL9RFIHPlPf21fuJSVzL8zwc69ur1tcjM5Ym1Xa
 MMGWLy4yhhTmXqRzuW/Rt3n/wXzAYtEB1u+RT7fhIGGWiaH82hp/S5lj7p7og99dDxsAUZaFZ
 Nxqu+XL4/FKTVNDSF7SuV9nrkFe03cKgUlwuDAIM0vKp/XJl5o+cSnOxwd9qS/1uiYKYdHJpi
 GZnDl3p4bc3MJ3yhQv9+94rQdlYCU66SA1A3xP2GwJmgUykVKLL0eG3LW0Q3/u2qhVE4iOSD2
 WZJyYanPRf6zO8DL6897P9vzxssF2DqFktIoBRn9BgiPKVLJUJYrNR50sRzgFQnWnsyQoeSAo
 vZ/tpTvDsZiDUUlZAGwxLtdqmuBqSdMj5wEWGrFDTRZVN5lx1bUUiWRHecn1T3LdwoIr/DnUH
 hn2eCcLPaVrboe1q9w7lOqYytV/vUa8XylxKQH0DwzTCXV4p2BbhleFoqIo7ZkH1vj4JFhKb3
 AhUe4nz5zyEBDaNVWM5Bc3qLaWjOyyeHCCsIpv11F19DUApTjJO7bvGYYqRNs4Svzf89sbhQu
 lWsDn5CVFbFsx53YUl5+qd/uE/gyW3T+MgtvGR5TDTFHY=
Precedence: list
From: Sam Edge via Cygwin <cygwin@cygwin.com>
Reply-To: cygwin@cygwin.com
Cc: Sam Edge <sam.edge.cygwin@gmx.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>

On 10/04/2024 11:34, Christian Franke via Cygwin wrote:
> J M via Cygwin wrote:
>> ...
>>
>> Specifically for this problem, I have investigated the problem and can be
>> related to pipes and antivirus.
>>
>> Specifically
>> while true
>> do
>> echo ABC | grep AAA
>> done
>>
>> It makes the cpu of that antivirus go up.
>
> This is as expected because malware scanners hook into Win32 API's
> CreateProcess*() calls which are also used by the fork()/exec()
> emulation of Cygwin. Each run of 'grep' above uses at least two
> CreateProcess*() calls.

This is very true and depends greatly on the AV being used. I find Trend
is particularly bad, even if you exclude all the Cygwin directories and
directories of files being accessed. Somehow, the way the hooks are
implemented stalls process creation and file open in ways that Windows
Defender does not. This is particularly noticeable when using
Cygwin-based build tools - build times generally increase at least
10-fold after installing Trend.

On one job, I wasted a lot of time and client's money collecting logs
for Trend to analyse to no avail. I think the product is basically very
badly written. The fact that it creates dozens of processes with
hundreds of threads just to do AV scanning does not fill me with confidence!

Wherever possible, I remove third-party AV from Windows machines and
install group policy to enforce Windows Defender and malware detection
in the browser and/or a proxy & the email server instead. Saves a lot of
CPU cycles. :-)


--
Sam Edge


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple