Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Our company virus scanner (Sophos) was auto updating itself yesterday with a large monthly update. We have the network bandwidth throttled to 100k reduce the overall load on our network but as the process was updating, all the computers hung because they couldn't access the network shares etc. The system idle process was running at 98% so to me it looked like the virus scanning process was hogging the Ethernet card. Shouldn't windows process scheduling prevent a single process hogging the network card or and is there another explanation for this behaviour?

Many thanks, Richard

share|improve this question

3 Answers 3

Windows process scheduling is umm... less than perfect. The problem caused by Sophos (we use it also) to me appears very similar to what happens when you insert a CD or DVD in the drive and Windows starts to access it. i.e. The system pretty much hangs until that task is over. I haven't looked into it too much, as I will be ditching Sophos when the current contract is up, but I suspect Sophos is setting the task priority as high as it will go. That effectively leaves the rest of the processes waiting, even though none of the resources are being pushed hard.

To my way of thinking Windows should recognise that the updating task is not really doing much of anything and allow other processes at least a little more more access to resources, such as CPU cycles, regardless of priority settings. Kind of a "use it or lose it" philosophy. There will of course be those with different views. ;)

share|improve this answer

Some virus scanners will prevent ANY access when not fully functional. I've seen many systems appear hung while AV is updating or initializing.

The worst was a flaky Norton AV setup. It would hang for 10 minutes on each startup. After switching to something else, the problem went away.

share|improve this answer

If this happens again, in Task Manager look at the networking tab. It shows utilization of the NIC.

I would schedule updates to occur at like 1am or something though to avoid this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.