You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: Drucksache
Drucksache Author
User level: Level 1
5 points

Sophos On-Access Scanner and Time Machine

Dear Community,

Time Machine performance has been flaky since I upgraded to Mac OX 10.6.1 and if the On-Access Scanner of Sophos Antivirus is on. In general, the backup is slower. But that's not the problem: Sometimes the backup works ok, sometimes time machine hangs and the backup is incomplete.

The most commonly recommended workaround for this is to switch off the On-Access Scanner. Sadly, this is not acceptable. The Mac works as a fileserver and the On-Access Scanner has proven valuable in reducing the number of viruses in our mixed PC environment.

Is there a way to temporarily shut down the Sophos On-Access Scanner during a Time Machine backup? I was thinking about a terminal script like this:

Shut Down_Sophos_On_AccessScanner
Initiate Time_MachineBackup
Turn On_Sophos_On_AccessScanner

Any help would be greatly appreciated.

MacBook Air, Mac OS X (10.6.1)

Posted on Oct 17, 2009 3:25 PM

Reply
7 replies
User profile for user: Pondini
Pondini
User level: Level 8
38,863 points

Oct 18, 2009 8:22 AM in response to Drucksache

Drucksache wrote:
Yes I can, and I did. It didn't change the behaviour.


Rats. You might try excluding your TM drive from Spotlight, at least temporarily, via System Preferences > Spotlight > Privacy.

If that doesn't help, watch your CPU usage via the +Activity Monitor+ app (in your Applications/Utilities folder).

When it starts, select either +All Processes+ or +Active Processes+ in the toolbar, and sort the list by the +% CPU+ column, so the highest numbers are on top, and select the CPU tab towards the bottom.

For this purpose, also select +View > Update Frequency > Less Often+ from the Menubar.

Various processes will "spike" up and down normally as they do things, then are idle, so you need to watch it for a while and get a feel for the processes that are using the most CPU, and the +% Idle+ at the bottom.

When the slowdown occurs, see if something changes significantly, especially if the +% idle+ goes to near zero. If that happens, see what process(es) are using the most CPU.

If the process(es) involved aren't familiar to you, post their names here (and or check this out: http://triviaware.com/macprocess/all)
Reply
User profile for user: Drucksache
Drucksache Author
User level: Level 1
5 points

Oct 18, 2009 1:54 PM in response to Pondini

Graham, Pondini, thanks a lot for your responses.

I feel a little dumb that I hadn't thought of checking the Activity Monitor. The next time, the incompatibility occurs, I will look.

At first, I thought that the on-access scanner is responsible. I had already noticed how slow TM had become after I installed Sophos.

Strangely, after completion of one backup with the on-access scanner disabled, TM did about ten flawless hourly backups with the on-access scanner switched on again. Then at about 1400h (GMT+2) TM failed again. When I noticed this a few hours later, not only did time machine hang, but also Sophos (not gracefully abortable) - the latter in the process of updating the virus signatures.

Now I am thinking that maybe the fault lies with the update process rather than the scanner. It is entirely possible that both (hourly) processes collide rather often. When I tried to test this, I only found out one small piece of information: A collision during times when the signatures are already up-to-date seems to be harmless. It's just too bad that I cannot reproduce the error reliably.

I tested TM and the on-access scanner with the EICAR test file. A test virus. Sophos reliably complained, if TM tried to backup the virus file and stated that access to the file was denied. Still, that didn't prevent time machine from making a backup. (Interesting privileges :-)) I tried this a dozen times. The backup process was not shot down.

Incidentally, this means the most reliable way to keep the backup virus free is to let Sophos copy files it deems infected to a separate directory. You may want to put that on TM's exclude list.

I am sorry to say that all this did not really help to explain the sporadic Sophos/TM error.
Reply

Sophos On-Access Scanner and Time Machine

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.
Learn more Sign up