[MBAM Running Scans on E-Cores Only and causing system to lock during scan]

On 2/9/2023 at 10:09 PM, AdvancedSetup said:

Current scan time for a manual Threat Scan on my system

 

For scheduled scans we added a new feature called Smart Scan that can also help improve performance for some customers.

 

Malwarebytes for Windows 4.5.21 Release Notes
https://support.malwarebytes.com/hc/en-us/articles/13535349106963-Malwarebytes-for-Windows-4-5-21-Release-Notes

 

• Smart Scan: We just changed the game for scheduled scans with Smart Scan! The Smart Scan option now allows a scheduled scan to start only if the computer is in an idle state.
  Limiting scheduled scans to start only idle time will provide a significant performance improvement as the default nightly scheduled scan (that is typically skipped because the device is usually powered off at night)
  will no longer kickoff when the computer is first started and hog resources that are needed for the task at hand.
  • Smart Scan is automatically enabled for the default scheduled scan.

  • Smart Scan is on by default for all new scheduled scans.

 

 

 

 

This is a false assumption. I NEVER turn off my devices at night. Repeatedly restarting hardware, especially physical hard drives reduces the LIFE of the product. Electrical devices should be started and at slow times, go to a reduced state when not active, but not fully turned off. The surge of a restart is hard on devices. This is an "energy saving" approach, not a professional computer user behavior.

Besides night time is when I am RUNNING overnight housekeeping. Basing assumptions on non-technical consumers of computer technology is never going to work. That level of user should stick to a tablet or other web browser based product. Better yet, MWB developers should code in intelligence to determine the USERS pattern and ADAPT the scanning as proper, instead of ASSUMING one method. it is not that much extra code IF you know how to do it.

Specific to this question/issue, the way MBAM decides "Idle" is incorrect. I am running a system back up utilizing 90% CPU and MBAM THINKS this is a "idle time" so lets SCAN. It sends my laptop into thermal throttling or triggers a power off because of thermal limits. MBAM is using 71 THREADS and adding 65% CPU usage (on a 6 REAL core, 12 hyper thread, Coffee Lake, i7 9850H at 4.4Ghz) usage along with 20 DISK IO links to mess with the Shadow copy being used for the BACKUP process.

How do we control this "feature" or TELL it when to scan? The current "Idle" mode does not work.
 

[MBAM Running Scans on E-Cores Only and causing system to lock during scan]

On 2/8/2023 at 10:36 PM, SPDIF said:

What makes Windows 11 better than Windows 10 in this regard is that Windows 10 focuses more on the power of certain cores, whereas Windows 11 expands that to efficiency as well. While Windows 10 considers the E-cores as lower performance than P-cores, it doesn’t know how well each core does at a given frequency with a workload, whereas Windows 11 does. Combine that with an instruction prioritization model, and Intel states that under Windows 11, users should expect a lot better consistency in performance when it comes to hybrid CPU designs.

Alder Lake and Raptor Lake has two sets of cores (P-cores and E-cores), but it actually has three levels of performance and efficiency: P-cores, E-Cores, and hyper-threads on P-cores. In order to ensure that the cores are used to their maximum, Intel had to work with Microsoft to implement a new hybrid-aware scheduler, and this one interacts with an on-board micro-controller on the CPU for more information about what is actually going on.

LOL! Wow! You have eaten up that MS marketing BS hook, line, and sinker! You actually are believing the new Intel marketing strategy. THe strategy is to APPEAR (smoke and mirrors, the processor, thread counts are not understood to most users) to provide lots of cores, charge MORE money for it because it is BETTER, but truly just give inferior cores that cannot handle any REAL processing tasks. As with other INTEL Boondoggles time will tell if these E-cores (actually subsets of P-Cores that FAILED P-Core standards on the die) really add any benefit, or were just a way to use up silicon in the manufacturing process.

So if you lack enough P-Cores for your process what happens??? If all the P-Cores are busy, what happens? Think about that. You WAIT and wait and wait in a queue or ERROR off. This concept while academically novel, is not practical. You end up with LESS cores and MS tries to do more with less, all to save power for the EU standards. It sacrifices performance for power savings. Ask yourself why do server level CPUs ONLY have P-Cores? Because it is NEEDED for the REAL work.

As to MS ability to actually produce an OS that truly works with this complicated level of functionality is still to be determined. Instead of ALL cores being available it LIMITS processes to certain cores and you WAIT until they are available. Do NOT dare use the available P-Cores because that would consume more power. Getting this nuanced and parsed in an OS is nonsense. Just throw the bare metal hardware at the OS and run it all out (Linux/UNIX approach, it runs at 100% all the time) That is the PROVEN experience record over the last 50 years of my computer experience. Reserving processors or throttling processing NEVER helps in the big picture. Remember MS's GOAL is all about certain metrics that make their OS appear to perform at a certain level. When you know all the background BLOATWARE MS runs under the scheduler or as sub-processes, hidden from you, you figure out why they added these cores, to handle their bloatware which was HOGGING the cores.

As learned in the past, letting an OS take control of the hardware to the performance level is nonsense. It is just another KLUGE of MS's to get certain results they want to tout. As with MANY MS products, TIME will tell if this really works.

Once MS moved to a .net underlying layer for the OS, they defeated most efficiencies with their .net BLOATWARE.