Strong interaction with Win10 Antimalware Service Executable - Windows Defender Antivirus Service

[bobbyconnolly]

I noticed a very strong interaction between Daedalus and Antimalware Service Executable - Windows Defender Antivirus Service on my freshly installed / fully updated instance of Windows 10 Pro x64. I had let the computer "settle" for a 3 hours before installing and running Daedalus for the first time.

The interaction is especially strong (and possibly of great nuisance causing slowness) when restoring wallet from backup (using the 12 word recovery phrase).

It may be that disabling Real-time protection in "Virus & threat protection settings" during heavy cpu/io-bound tasks greatly improves task completion times.

The attached screenshot does not represent the worst case of the interaction, which was during the "restore wallet from backup". The attached screenshot was taken during the sync when launching Daedalus merely to provide context to this issue.

[neongreen]

We're not sure but we suspect that this is a side-effect of our block storage mechanism (lots and lots of small files). I'm currently writing a proposal on an alternative way to store blocks, so there's a good chance that this issue will be fixed in one of the next releases, if your problem is indeed caused by that.

Can you look at the Windows Defender process in Process Monitor and check what it does when it eats 30% of CPU? (If it accesses blocks, you'll see lots of accesses to files with hashes as names)

[bobbyconnolly]

This was also my initial feeling re lots of small files.

I will get you the process monitor results next week.

[bobbyconnolly]

I had some time today and obtained some results using Process Monitor

There are two (2) traces :1) with Defender ON, and 2) with Defender OFF. For each test, I restored using the same 12 word recovery phrase. Refer to the screenshot to see where I changed this setting.

The wallet restore took 35 minutes with Defender ON and only 12 minutes with Defender OFF. That's a 65% reduction in time to complete the wallet restore task with Defender OFF. The difference in block time/height between the two trials is less than an hour apart or less than 1%. I restarted Daedalus between trials. I did not restart the computer however.

For each test, I ran process monitor with /NoConnect and the moment I started the restore function in Daedalus I did Ctrl+E in process monitor to begin recording. When the wallet restore task finished in Daedalus, I let process monitor run for 20 additional seconds before I stopped recording.

The Windows Defender / antimalware service executable corresponds to MsMpEng.exe

1) Defender ON trace results :

Process Name Count "Value","Count" "cardano-node.exe","171964" <------- "csrss.exe","12" "Daedalus.exe","9927" "Explorer.EXE","52" "lsass.exe","100" "MsMpEng.exe","40010" <------- "NVDisplay.Container.exe","2105" "OfficeClickToRun.exe","8" "OneDrive.exe","8" "RuntimeBroker.exe","2" "SearchFilterHost.exe","3" "SearchIndexer.exe","95" "SearchProtocolHost.exe","3" "services.exe","1" "svchost.exe","4017" "wmiprvse.exe","1559"

Stack Summary

Process Activity Summary

Random Screenshot 1

Random Screenshot 2

Random Screenshot 3

Random Screenshot 4

Random Screenshot 5

2) Defender OFF trace results :

Process Name Count "Value","Count" "cardano-node.exe","8930032" <------- (not sure why the count is much higher during this trial) "Daedalus.exe","136699" (not sure why the count is much higher during this trial) "svchost.exe","47812" (not sure why the count is much higher during this trial) "NVDisplay.Container.exe","11043" "wmiprvse.exe","3157" "taskhostw.exe","1872" "SearchIndexer.exe","1274" "sihclient.exe","1117" "smartscreen.exe","969" "services.exe","714" "conhost.exe","572" "SecurityHealthService.exe","545" "Explorer.EXE","420" "MsMpEng.exe","306" <------- (much less count!!!) "lsass.exe","286" "OfficeClickToRun.exe","124" "dwm.exe","105" "OneDrive.exe","104" "winlogon.exe","93" "csrss.exe","62" "sihost.exe","62" "DllHost.exe","61" "AUDIODG.EXE","56" "RuntimeBroker.exe","21" "ApplicationFrameHost.exe","8" "cardano-launcher.exe","2" "smss.exe","1"

Stack Summary

Process Activity Summary

Random Screenshot 1

Random Screenshot 2

Random Screenshot 3

Random Screenshot 4

Random Screenshot 5

I find it strange that there is a much higher count during the Defender OFF trial for cardano-node.exe, Daedalus.exe, and svchost.exe

If you want, I can reboot the machine and do another Defender OFF trial.

[bobbyconnolly]

FYI, my system details. As I mentioned already, this is a fresh instance of Windows. I have only installed Daedalus, Chrome, Office 2013, and Visual Studio Community 2017 (desktop, mobile, and azure development components). All updates were done and made sure that computer was settled.

Also, here are the Defender Settings. Trial 1 was all three (3) highlighted switches ON and Trial 2 was all three (3) highlighted switches OFF.

[nikolaglumac]

These issues are resolved with the introduction of the blockchain storage consolidation which was released in Daedalus v0.12.0. Find out more about this process on the Support portal: https://iohk.zendesk.com/hc/en-us/articles/360016060314-Blockchain-storage-consolidation

[galki]

I'm on 0.15.1 and getting the same symptoms.

Solved by adding cardano-node.exe process to list of Defender's exclusions.

[nikolaglumac]

Thanks for reporting this @galki!

@DmitriiGaico can we please have this checked?

cc @alan-mcnicholas

[nikolaglumac]

@galki this is a known issue and indeed adding cardano-node.exe to an exclusion list and\or the state directory helps. The issue is most apparent when syncing Daedalus as the large numbers of disk I/O get scanned by Defender which slows things down as we are syncing the original chain and at the same time consolidating the blocks. Once consolidation happens the overhead of Windows Defender is much less.