High CPU usage by PL itself

sciensum · February 26, 2018, 10:05:14 AM

Hello,

Recently I've been noticing an occasional abnormally high CPU usage by Process Lasso itself, and often it happens when seemingly no activity is performed by it (i.e. nothing printed to the PL log at the times of high utilization)

No dramatic changes have been applied to the OS (with exception of official MS "Meltdown" patches), no new software has been deployed. The behavior is similar on several machines.

Few details:
After 48h of system uptime, 5 hours of CPU time are credited to Process Lasso, making it's the 4th top offender in terms of CPU use. PL CPU usage fluctuates between 1% to 25%, often staying at 20% for quite a while. The system CPU is 2C/4T, so this has quite a noticeable negative effect.

Do you have any recommendations? Is this a known issue?

(P.S: I've been using PL for many years now quite happily. Thanks for the great SW!)

edkiefer · February 26, 2018, 11:03:07 AM

Quote from: sciensum on February 26, 2018, 10:05:14 AM
Hello,

Recently I've been noticing an occasional abnormally high CPU usage by Process Lasso itself, and often it happens when seemingly no activity is performed by it (i.e. nothing printed to the PL log at the times of high utilization)

No dramatic changes have been applied to the OS (with exception of official MS "Meltdown" patches), no new software has been deployed. The behavior is similar on several machines.

Few details:
After 48h of system uptime, 5 hours of CPU time are credited to Process Lasso, making it's the 4th top offender in terms of CPU use. PL CPU usage fluctuates between 1% to 25%, often staying at 20% for quite a while. The system CPU is 2C/4T, so this has quite a noticeable negative effect.

Do you have any recommendations? Is this a known issue?

(P.S: I've been using PL for many years now quite happily. Thanks for the great SW!)

Hi, First see if this applies to you.
https://forum.bitsum.com/forum/index.php/topic,5919.0.html

If above is of no help here are some things you can try.
This assumes the Processlasso.exe is the issue your seeing and not Processgovernor.exe

1) you can toggle off logging to see if it affects at all, if there is a lot of activity (I never seen this but might depend on HW).
2) change GUI refresh to lower rate 1sec default> 2 or 5sec
3)You can setup GUI to not run at auto-login, so you can run when you need it only.

See if any of that helps

sciensum · February 26, 2018, 04:18:01 PM

Thanks for the reply.

No, I don't use MalwareBytes' software.

I tried setting GUI refres rate to 10s, but my impression that it doesn't change much, I still observe ProcesLasso.exe staying at 20% CPU usage for as long as 20-30s very often.

edkiefer · February 26, 2018, 04:58:21 PM

Are you using any AV suite other than Windows defender ?

Maybe try an disable it to see if any improvement, just for test.

sciensum · April 12, 2018, 11:05:13 AM

Well, it feels like things got worse.

I set Process Lasso GUI refresh interval to "pause", and in that state, processlasso.exe is constantly 2nd most offensive process in terms of CPU time (1st place being the system idle process) this is getting to the unusable territory.

In terms of antivirus SW, I have Avast AV running and Comodo Firewall. The usage does seem to go down with avast off, but I haven't tested it for a long enough time to have a conclusive opinion on that.

I do suspect, however that there's something similar to the MalwareByte's saga going on here as well.

Is there a way to obtain more logging from ProcessLasso.exe? I tried to monitor it with Process Monitor, but wasn't able to observe what can cause the excessive CPU usage

edkiefer · April 12, 2018, 12:07:15 PM

Quote from: sciensum on April 12, 2018, 11:05:13 AM
Well, it feels like things got worse.

I set Process Lasso GUI refresh interval to "pause", and in that state, processlasso.exe is constantly 2nd most offensive process in terms of CPU time (1st place being the system idle process) this is getting to the unusable territory.

In terms of antivirus SW, I have Avast AV running and Comodo Firewall. The usage does seem to go down with avast off, but I haven't tested it for a long enough time to have a conclusive opinion on that.

I do suspect, however that there's something similar to the MalwareByte's saga going on here as well.

Is there a way to obtain more logging from ProcessLasso.exe? I tried to monitor it with Process Monitor, but wasn't able to observe what can cause the excessive CPU usage

Process Explorer/Monitor would work for an external monitor, much better than task manager.
On Avast, you can try to add PL GUI exe to there exclude list.

How much % are we talking about, with GUI closed to the system tray in Process monitoring?
Things that would affect GUI are refresh rate, graph open and how much logging you enable, but all of these shouldn't amount to a lot even with GUI open an running I see about avg of 1.5-2.0%

sciensum · April 12, 2018, 02:31:21 PM

As I mentioned before, the processlasso.exe usage is 20-25% on a quad-core CPU, i.e full single core is occupied by it. All that when the UI is closed (only tray icon is shown), moreover the GUI refresh interval is set to "paused". Other UI-related settings are default.

I'll try adding the exclusions.

sciensum · April 14, 2018, 06:39:01 AM

So excluding didn't help really.

It does seem related to security software though - once I'll toggle every security suite off, PL usage goes gown to a legitimate 1-2% instead of using full core. The turning security back on doesn't seem to trigger abnormal PL CPU usage immediately, but after a while PL is back using 25% CPU, even after I listed PL processed to be excluded in every possible way

edkiefer · April 14, 2018, 07:59:46 AM

Yes, sometimes AV software becomes too intrusive, which then ends up using CPU%.
You could report it to them and hopefully, it will get fixed, a quick look shows others have similar problems.

https://forum.avast.com/index.php?topic=218050.0

Only thing I can think of if you want to keep that version of Avast is to set PL GUI to not run at startup.

sciensum · April 14, 2018, 08:07:07 AM

But avast isn't using the resources, PL is. The high CPU usage is by ProcessLasso.exe

edkiefer · April 14, 2018, 08:18:43 AM

Quote from: sciensum on April 14, 2018, 08:07:07 AM
But avast isn't using the resources, PL is. The high CPU usage is by ProcessLasso.exe

That is the results of Avast being too intrusive, closing Avast is the proof of that.
I will report this post to the Dev's but IMO it will fall into Avast hands.

sciensum · April 14, 2018, 02:01:45 PM

I agree that there is some interoperability issue with PL and either Avast or Comodo.
And yes, the easiest way is always to just blame the other part.

But the fact that in the end PL is misbehaving remains. And it doesn't produce any reasonable log/data to point on the issue being on the other side either.

Jeremy Collake · April 15, 2018, 05:00:15 AM

I am going to run some tests and see if I can reproduce the issue.

Although I haven't seen such things in quite some time, the usual cause are hooks on the process management APIs by security software. In a problematic scenario:

1.) if these hooks aren't processed efficiently then that inefficiency is compounded in Process Lasso's frequent calling of these APIs, showing up as CPU use in Process Lasso since the API hooks are running in its process space.
2.) Tamper-resistant mechanism in the security suites start logging every time Process Lasso touches their processes. If this is the issue you can often see log events in the security software.

Using security products from two vendors definitely makes it more likely you will have issues. I want suggest to just drop these superfluous security suites, but that is a matter of your preference and doesn't address the issue.

I'll let you know what I find in testing. Thanks for the report!

sciensum · April 15, 2018, 05:23:22 AM

Thanks for looking into it!

I checked security suites' logs - there's nothing of interest there in regards to PL at all. I guess it's to be expected however, since PL is set to be excluded by those programs.

I'm aware that running overlapping security SW is a bad idea, and that's not really what's happening. Avast is the only thing doing real-time AV monitoring, and Comodo is the only Firewall doing internet access filtering. Other components that are likely to interfere are disabled. Moreover this setup is running without issues for several years now, and that includes running Process Lasso for most of the time as well.

I started noticing issues with PL around January, in the same period of the release of Meltdown/Spectre patches/workarounds. Now, I don't know if those are related, it is possible that the overall system slowdown just made the PL issue more notable and the actual time of appearance of this issue may be slightly earlier.