Kaseya Community

AVGCSRVX.exe spiking CPU when an Audit is running

  • Howdy all.

    We have been a Kaseya shop for a couple of years. We just recently added the KES module w/AVG. We did have McAfee and had no problems with it, just wanted the integrated virus plug in. Starting to think twice though.

    Here is the issue we are having:

    When a normal daily audit of the machines runs, it now takes between 8-42 minutes to complete. When this audit is running, the AVGCSRVX.exe process is pegging our cpu from between 45-80%. It appears that the AVG is scanning the audit process and making it take forever and making the local systems unusable at that time.

    This is getting me a lot of calls. Is anyone else having this issue? I have an ticket opened up but no solution yet.

    I have tried excluding the c:\kworking, c:\program files\kaseya and all sub folders of those two.

    We run mostly WinXP-SP3, and a few Win2k-SP4 computers and are on K2 w/AVG9(KES).

    Legacy Forum Name: AVGCSRVX.exe spiking CPU when an Audit is running,
    Legacy Posted By Username: Hunsaker
  • Yes, this is normal unfortunately. Hopefull Kaseya\AVG can up with something to help with this. This hurts several of our clients who regularly have up to a TB of data on their local machine (programmers).

    Legacy Forum Name: KES,
    Legacy Posted By Username: Coldfirex
  • Do ALL machines behave this way? Or just SOME machines? if it is just some machines, is there anything common amoung the machines that behave this way.

    I have heard from my ServiceDesk that some of the machines for some of our clients seems to slow to a crawl during audits. I have never looked into this report any further, but I wonder if it is the issue that you are reportin?

    Legacy Forum Name: KES,
    Legacy Posted By Username: lwolf
  • I have seen this same exact - and it only seems to affect certain machines.

    I have a theory about it - that on machines that get "slammed" with KES + Audit, there is something (rootkit, trojan, etc.) sitting and watching all disk accesses; when Audit is opening every file on the hard drive, the "watcher" is trying to gain access, too, and maybe, just maybe, AVG is trying to stop it from doing so. I've seen cases where machines with the same image build on the same hardware, but maybe 1yr out from having been put into service (so, "mature" operating environments, where one might have a trojan the other doesn't) had different behavior - most totally fine, but one in particular was nearly fully unresponsive during audit. It was possible to get a remote session started (kvnc, took about 3 minutes to establish) and run Task Manager (maybe another 3 minutes from right-clicking taskbar to actually having it show up). Kill the Audit, or kill the AVG executable in taskmgr, and everything goes back to normal *immediately*.

    I've been told several times by support that "this is normal, and you shouldn't schedule audit during business hours" - which is totally wrong, IMHO.

    Legacy Forum Name: KES,
    Legacy Posted By Username: Matthew Bartels
  • make sure that Windows Defender is disabled...that is exactly what it does.

    Legacy Forum Name: KES,
    Legacy Posted By Username: Jeff.Keyes