Antivirus Essential scan hanging - cpu & memory issue

Currently reading
Antivirus Essential scan hanging - cpu & memory issue

976
221
NAS
RS820+, DS718+
Operating system
  1. Windows
Mobile operating system
  1. iOS
I am using Synology's Antivirus Essential, scheduled scans are completed Monday thru Sat. This has been the second time where I noticed my cpu and memory usage has been high. When looking at the resource manager, I notice the task scheduler "Synoavscan" has been running for almost 17 hours. I open Antivirus Essential and its still scanning at 83% complete. Scans start at about 4am, and last time this happened was exactly a week ago; so every week this is reoccurring. The scans between last week and now have at least completed usually taking around 4 hours to complete. Anyone else experiencing the same. Screenshots attached.
 

Attachments

  • Annotation 2019-08-22 210415.png
    Annotation 2019-08-22 210415.png
    36.7 KB · Views: 374
  • Annotation 2019-08-22 210511.png
    Annotation 2019-08-22 210511.png
    127.7 KB · Views: 288
What type of scan are you doing? With my NAS usage profile (i.e. how I use the NAS) I do a system scan each day and a custom scan weekly. I'm hosting media files that have come from my Mac and scanned there and so I exclude their folders from the scan since they are effectively read-only locations.
 
What type of scan are you doing? With my NAS usage profile (i.e. how I use the NAS) I do a system scan each day and a custom scan weekly. I'm hosting media files that have come from my Mac and scanned there and so I exclude their folders from the scan since they are effectively read-only locations.

System scan Monday - Friday, about 500gb worth of data
 
i also started to encounter this strange behaviour last month. my full scan runs once a week and stops at 45% scanned and 83% of memory. nothing helps except stopping package. it is very unpleasant. any ideas?
 
AV Essentials on my DS215j (500MB RAM, dual 800MHz ARM CPU) takes an unreasonable amount of time to scan my NAS. It started earlier in the year when it used to be a few hours and then jumped to be 14-16hrs. I've got it down to 11hrs or so by enabling smart scan.

Given that this NAS only has 0.5TB of data in the scan and most of it doesn't change then AV Essentials must've got something bugged up.

Since it's used as archive storage then I switched off AV Essentials. Will give it a try to see if something's improved since February.
 
Apparently it will still scan, it’s just crazy slow,
for me it usually takes 24 hours. Initially I thought it was hanging or freezing, but I would just leave it alone to see what it actually does and sure enough it had scanned about 19-24 hours later
 
It may be worth going into the package archives and getting an earlier version, ISTR this started January/February time. If the release notes aren't saying newer versions address serious bugs or drop support for Clam AV updates then it may be a way to return to better running.



From the release notes I see v1.4.6-2780 addressed a CVE reported vulnerability but the latest v1.4.7 versions are feature updates. ClamAV engine being updated doesn't mean that the previous package no longer works, it means that at some time in the future the virus patterns will stop being updated sooner but not right away (unless Synology has been running right up to the wire).

It might be worthwhile uninstalling the current v1.4.7 package and manually installing v1.4.6. I've re-enabled v1.4.7 and started a scan (yesterday forgot I disabled the nightly schedule), if it's still hugely slow then I will rollback the version.
 
OK I uninstalled AV v1.4.7 from the DS215j and manually installed AV v1.4.6.

It needed to update the AV data from 2018 to now and took 1.5 hrs (but that was normal for v1.4.7 for every update).

The system scan then took considerably less time 2.5hrs (exc. AV update) but it generated ~40k warnings about unable to scan individual files in /var.defaults.

I'll check how long it'll take for tonight's scan, inc. update, and see what logs it produces. If it's the same then I'll reboot the NAS.
 
Last edited:
Didn't complete so have rebooted the NAS and started a new system scan.

Update: 7 hours later and it's completed the scan, with 1 hour being the AV update, and it looks to be finished without any funny quirks. That still seems excessively long for a system scan. Plus this time it didn't throw up lots of warnings for /var.defaults files. Next is tonight's scheduled scan.

To put into context: v1.4.6 completed around the same time in the day as some times v1.4.7 did, and that started 6.5 hours earlier.
 
I have a DS118 with far less data than anyone else and did not manage to have it update even the bloody definitions. Killed the process after two days. System unusable while it was running. I don't think it is VE though, there is something more fundamental going on with that system lately. I only installed VE because I got suspicious over periodic excessive activity on the system that had nothing to do for me, it should be idling. I got rid of everything I do not need, it is a mail server. It often gets busy to a point at which incoming mail does not get handled and just bounces with 550. No traces of abuse though, mail setup is good, no open relay or such, it has been like this for weeks now and I am not blacklisted, mxtools reports nothing wrong with my configuration. I do not get any mail out myself though, getting connection refused from other mail servers, which started around the same time. ISP insists they do not block anything for me. I am not sure the problems are related or not, timing is suspiciously coincidential though.
 
It does depend on how files are being accessed. If files are access by mobile devices and sent to customers, business partners, family, or friends then you’re potentially exposing them and identifying yourself as a propagator of malware.

For an archive store, you’d hope it would’ve been scanned before storage.
 
But for limited home use, I still think it’s not necessary.
Indeed. But usage varies and each should judge what's right for them.

In your case it's not needed; For me I do use AV scanning but omit archived folders (a.k.a. stuff I keep but haven't used for ages) because they hold stuff that has been zipped and moved off Macs that already scanned them.
 
I’m not running virus scanners on any of my DiskStations. I believe it’s redundant and kills performance. Should be ran where files are consumed (PC).
LOL. I thought I was the only one doing this. Besides, the Symantec app is pretty lame overall, providing primarily "signature" protection. Basically a placebo.
 
i also started to encounter this strange behaviour last month. my full scan runs once a week and stops at 45% scanned and 83% of memory. nothing helps except stopping package. it is very unpleasant. any ideas?

this issue seems to have been resolved. Scans are now completed within an hour or two
 

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Similar threads

A google reveals you have to use cvdupdate to do this the official route. Not investigated but here's...
Replies
10
Views
12,284
Thank you. Weirdly, after another reboot and trying the "Repair" option in Package Manager, the package...
Replies
2
Views
1,545
I can see the synoavscan process running but I had uninstalled Antivirus Essentials so I can't understand...
Replies
0
Views
2,253

Welcome to SynoForum.com!

SynoForum.com is an unofficial Synology forum for NAS owners and enthusiasts.

Registration is free, easy and fast!

Back
Top