objective-see / BlockBlock

BlockBlock provides continual protection by monitoring persistence locations.
GNU General Public License v3.0
618 stars 38 forks source link

Huge CPU usage generated by BlockBlock - conflict or interaction ? #10

Open luckman212 opened 4 years ago

luckman212 commented 4 years ago

I don't know how to track this down, but another app on my system: BackupLoupe (which offers advanced functions for working with Time Machine backups) causes very high CPU usage from BlockBlock while it's indexing TimeMachine data.

I submitted a report to the developer of BackupLoupe already, but I also wanted to post some detail here in case the issue turns out to be with BlockBlock instead. BackupLoupe spawns a subprocess that does the indexing, called com.soma-zone.BackupLoupe.Scanner - this may be a LaunchDaemon (?) which is why I assume BlockBlock is getting "involved". But no alerts or anything pop up from BlockBlock, just seeing high CPU spikes during the scans, to the point that the scans are not able to complete their work.

I dumped out 2 "samples" from Activity monitor (attached) - and some screenshots are posted below. Not sure what else can be done to track down this problem.

Sample of BlockBlock.txt Sample of com.soma-zone.BackupLoupe.Scanner.txt

image

image

luckman212 commented 4 years ago

@objective-see Came back to post an update: Today I noticed that in fact any heavy network traffic stream seems to trigger this high CPU usage in BlockBlock. Even a simple curl some-large-file.dmg will cause CPU usage to near 100%: image image I had a bleary-eyed look through the source code to see if I could find any reason for this and (surprise) I couldn't. I'm guessing that somehow just invoking the Endpoint Security Framework automatically enables ALL of the event traps that come along with that (file, process, socket, etc) even though BlockBlock is only alerting against file activity. Is this reasonable to assume?

For now I had to disable BB, but I hope maybe a solution can be found.

tiennou commented 3 years ago

I'm seeing the same thing, while running Xcode (I think), consistent 90+% CPU usage. Here's a few captured stack traces in case this helps… BlockBlock-2.txt BlockBlock.txt

kswope commented 2 years ago

I'm seeing this problem when benchmarking backend APIs. When I originally ran blockblock a few years ago I don't think I had this problem, so maybe its a change in OSX or blockblock itself.

Here's the issue https://github.com/kemalcr/kemal/issues/625

kswope commented 2 years ago

Found a simple confirmation of the problem. Compiling a simple "hello world" golang program, which is usually instant on my MBA M1, takes about 4 seconds when BlockBlock is enabled in the menu.

Running the compilation in a loop like this

watch -n0 go build main.go

spikes and holds BlockBlock at about 20% CPU

I should add that this is OSX Big Sur 11.6.4

I might upgrade to Monty soon, I'll give it another try then.

GeorgFleig commented 4 months ago

I noticed heavy impact on some operations on my M2 Macbook Pro running MacOS Sonoma 14.3.1. Especially some docker/rosetta related commands become a lot slower. Getting the ssh configuration of a vagrant Docker machine (vagrant ssh-config).

While executing this command, I watched BlockBlock in the activity monitor. It reads about 750MB of data during this 24s execution time. Something is clearly broken.. Happy to provide more details/debug information, if you let me know what is needed. BlockBlock version 2.2.1.