TeaTimer CPU load after startup thoughts

[md usa spybot fan]

snrcfan:

This thread is about problems encountered with the Spybot 1.6 version of TeaTimer (TeaTimer 1.6.0.20) and the measures taken to correct those problems including the development of a beta addition of TeaTimer (TeaTimer 1.6.0.21):

• TeaTimer-beta-1.6.1.21.zip

I suggest that you upgrade to Spybot 1.6, download and install the beta version of TeaTimer and see if that has alleviated your concerns.

[Zer0 Voltage]

@wyrmrider: Perhaps you should fully familiarize yourself with the problem reports and history before making any assumptions. This is a case of obvious abnormalities, not a need for trade-offs or alternatives and most certainly not some baloney case of TeaTimer doing its normal job. This is a case of TT needing a fix for a real and verifiable problem.

First, on some systems, the TeaTimer process NEVER recovers. It jumps to 99% on start/restart and stays there. Period. Not for a few minutes. Not for a few hours. Permanently - at least until forced closed the hard way.

On other systems, it jumps to 99% usage at boot and stays there for [at least] a few minutes, but then it does recover. But such a long spike shouldn't even be needed for truly normal activity in the first place.

And unfortunately, until it recovers or is killed, an affected system is unusable because of the CPU flood.

Other programs with resident protection DO NOT take even longer. On systems where this problem exists, every other real-time solution works fine - only TT is showing spikes.

Of further significance is that these problems were introduced during the beta period. These problems were not always present. I know because I originally reported a similar (and likely related) TT crash problem here:

http://forums.spybot.info/showthread.php?t=30453#7

and it was only after that got fixed that the CPU spike issues began. In fact, as I said then, there were no similar TT problems up until RC2 (or maybe RC1). The original problem was not present in beta 1 and 2 and the spikes didn't occur until a fix was put in place for the reported TT crash.

This all seems to be of rather critical importance to any potential resolution...

So what changed in TT between beta 2, RC1, and RC2?

And perhaps since this also never occurred before 1.6, what is TT doing now that it didn't do in 1.5.x?

Once we define what changed, the logical test is to then disable whatever changed and see if the problems persists.

At the very least, a way of displaying - or preferably logging - all TT activity would also be useful (as Patrick suggested). Trying to do that with something like Process Monitor just got too out of hand (generating 50+ Megs of data every few seconds).

I am somewhat skeptical that this will come down to "normal" behavior, however, since on nearly identical systems with the same software and configuration different levels of the problem can occur - plus, like I said, the problem didn't occur with the betas.

FYI, when TT does do something it is supposed to do, it does not spike - even on affected systems. It has a brief but normal resource increase, but that's it. I can only make a permanent spike [at will] by fully exiting and then later restarting it (at least on some systems). Further FYI, I have no TEMP files (auto-scrubbers in place) and usually <40 processes running. So anything TT does should be unnoticeable and instant (which truly normal "doing its job" TT behavior is).

Anyway, thanks very much for continuing to look into this PepiMK. If you need me to help test anything or provide any other details, please just let me know. I may not be available much now though.

Sorry if I posted any redundant info here, but evidently while I was away some people decided to start multiple separate threads for the same related issue...

[nagan]

@wyrmrider: Perhaps you should fully familiarize yourself with the problem reports and history before making any assumptions. This is a case of obvious abnormalities, not a need for trade-offs or alternatives and most certainly not some baloney case of TeaTimer doing its normal job. This is a case of TT needing a fix for a real and verifiable problem..........................................

...............
I am somewhat skeptical that this will come down to "normal" behavior, however, since on nearly identical systems with the same software and configuration different levels of the problem can occur - plus, like I said, the problem didn't occur with the betas.

FYI, when TT does do something it is supposed to do, it does not spike - even on affected systems. It has a brief but normal resource increase, but that's it. I can only make a permanent spike [at will] by fully exiting and then later restarting it (at least on some systems). Further FYI, I have no TEMP files (auto-scrubbers in place) and usually <40 processes running. So anything TT does should be unnoticeable and instant (which truly normal "doing its job" TT behavior is).

Anyway, thanks very much for continuing to look into this PepiMK. If you need me to help test anything or provide any other details, please just let me know. I may not be available much now though.

Sorry if I posted any redundant info here, but evidently while I was away some people decided to start multiple separate threads for the same related issue...

It is absolutely clear that there is some terrible bug with TT that makes it spike the CPU.As Zero voltage suggests any normal working need not consume that resource.I hope the spybot team quickly put their heads into action and correct it or the reputation of the software will get affected.In fact I was among the first who posted a thread on the CPU spike but a pity no proper response from the forum.I have for the moment uninstalled Spybot ,and watching for the correction.

[PepiMK]

Please, try to keep two things separated

1. A long time for scanning each process. For this, see the discussion about SDFiles.exe before the 1.6 release. That is a trade-off between reducing the time for loading the database to a third (and using only a quarter of memory speaking of resources) while the time for scanning each file has about doubled, which, for single files, is still an improvement.
That is not a bug, just but a discussable shift of preferences.

2. If TeaTimer never recovers as Zer0 Voltage described, that is a bug.

@129260: a Windows standard notification balloon is indeed what I tried this morning While the advantage here is that it is a system standard, it's downside is that the time it is shown has to be specified before showing it; hiding it when the file scanning has finished is not possible right now, so the timeout the balloon will have has to be guessed.

@Zer0 Voltage: the change at RC 2 was the shifting between database loading and scanning time.
I think I'll make that toggleable by a registry tweak to allow easier testing of both methods.

@md usa spybot fan: a proper binary lookup only works with a clear set of data. If we would check every file by MD5 or some other hash that we would have for each file, that would do. But if you take a look at the wiki, there are dozens of methods; most time-consuming are cached using hash lists, but they still need to be calculated.

@topic: what we do have now:

• balloon hint on each scanned process, shown for average scanning time of last scanned file.
• registry tweak ("ConserveMemory") to toggle between both modes for easier debugging.
• registry tweak ("WriteProcessLog") and command line switch ("/verbose") to enable more detailed process scanning logging.
• improved the low-memory profile structure to speed up that scan, even though it will never reach the speed up the full structure.

what we need to still do:

• possibly port all TeaTimer messages to new balloon method.
• cache scan results between seasons (except for scan after update).
• improve the low-memory-usage data structure some more.

I even tend to get the more memory consuming variant back into place and keep the slow-but-conservative method as a more or less undocumented feature for users of very old systems that would prefer it, will have to discuss that with the team tomorrow.

One file per second doesn't sound too much or much slower than two files per second, but summed up for 50 files...

(btw, this is why we didn't put 1.6 into the updates today, in case anyone wonders )

[HotFuse]

Not just an XP problem. I'm running Vista Home Premium on AMD Turion X2 with 4Gig RAM and have had to disable TT in startup because after a re-boot it takes about 10miniutes for TT to settle down from using 50% of CPU. Not to mention the Hard Drive time it's hogging (not helped being a 5400rpm laptop hard drive).

Although, I have found disabling the start-up of un-necessary 'Audio controller, Adobe Reader-Quick-starter....etc etc.....and all the other un-used crap that loads into the task bar significantly reduces the lengh of time of the TT resource hog after boot up. Takes it down to about 3 miniutes. I suppose it's got less to scan then.

I going to re-enable them one by one to see if any in particular causes the TT to hog for so long.

[etmax]

Well I've been using SBS&D/teatimer for about 5 years. This whole time it has consumed a little time during startup but the system settled down to about 1% utilization which was always the systemidletask. This is on an 8-core machine (i7) Last week I did a format and reinstall of winxpsp3 and all apps and find that for the first 10 minutes 1 core has 98% utilization and a second core around 15%. If I wait for around 20 minutes it cycles back and forth between 4% and 60% on one core and 2 and 10% on one of the other cores. This occurs at the refresh rate which is about 1sec and no other activity, ie. an idle machine. The CPU usage overall shows as being 4-14% allocated to teatimer and about 1% to the systemidletask. If I kill teatimer the load almost immediately drops to 1% from systemidletask with an occasional blip from my antivirus (CA) I only have the antivirus from CA, none of the functionality that might compete with SPS&D. It announces itself as V1.6.2.46.

Some of this info has been given before by others, but I have provided it all in one go in one place to make it easier to use in search of the problem. On the view functionality, I've had nothing to complain about so far, so if it stayed the same I'd be happy. Just need to get on top of this issue.

[kdd53]

hello,
i'm new to the forum and i've been doing some upgrading to a friend's computer. it's a p2 350 with 1 gb ram and xp pro. i have noticed that tt in sb v160 runs the cpu at 100%. the system goes back to "normal" when i turn tt off.

i have v160 installed on a celeron 2.4ghz 2gb ram and a hp laptop with a 2ghz athlon 64 and 2gb ram both with xp pro and have no problem with the cpu sticking at 100%.

i have read the replies on this thread and have not found a solution. my friend is not very computer savy and i am beginning to think that disabling tt wouldn't be such a bad idea.

i certainly want them to have a good computering experience without having them making decisions about registry changes that they would know nothing about.

am i wrong in my thinking and is there a cure for this malady?

[Yodama]

129260,

thanks for your feedback. I think we have to watch this behavior to see if it occurs again.
Did you disable the balloon tool tips within Windows? You can check this in the registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advacned
"EnableBalloonTips"=dword:00000000

This would have the tool tips disabled completely, setting the dword to 1 will reenable the balloon tips (restart of the explorer is required). By default this value is not set.


kdd53,

once the teatimer starts it will scan the running processes, this will cause a cpu load depending on how many processes are present, on an older computer like the p2@350 and WinXP this will take a while.
The current beta of the teatimer will show that it scans with a balloon tip and it will improve on scanning time through caching. This way there will be one long scan for processes but subsequent scans will be quicker.
Download:
TeaTimer-beta-1.6.1.21.zip

[wyrmrider]

A beta t-teimer 1.6.1 is included in today's update

[129260]

Because other programs are able to give me notification balloons. such as windows defender. It doesn't do any notification balloons on my laptop ether. Same thing applies. This is weird.......cause i have never seen teatimer give me a notification balloon so far, and other programs are able to give me the notification balloons.......

Thanks for the help yodama, feel free to ask more questions. Hopefully we can figure this out!