(In reply to Jeroen Baert from comment #77) > Some new reports of this popping up: https://www.reddit.com/r/firefox/comments/zyzsk6/high_cpu_usage_from_windows_defenderantimalware/ > > I'm personally running Win10 22H2 Build 19045.2604, all latest updates and I encounter this problem too. Hello, Thank you for sharing this. I think I can reproduce the problem, so I will provide some data that describes what happens on my machine in this comment. It would be helpful if you could confirm if the data looks similar on your machine, to be sure that I can use my own machine as a basis for investigating this issue. I will describe how to collect similar data by yourself in a second comment. I recorded a session with Windows Performance Recorder, then opened it in Windows Performance Analyzer. I only had Firefox open when I did the test. What I did was launch `youtube.com` once, wait for 10 seconds, refresh it, and again (in total, 5 loads). I did the same in Chrome (after [disabling Software Reporter Tool](https://thegeekpage.com/high-cpu-usage-by-google-chromes-software-reporter-tool/) which was somehow having a lot of CPU activity on my machine, which could have affected the experiment). Attachments show the activity graph for the most active processes in each session, then the details of where `MsMpEng.exe` spent CPU time in both sessions. Firefox session is always shown at the top, and Chrome at the bottom. We can see that with both Firefox and Chrome, `MsMpEng.exe`'s activity is correlated to the activity of the other processes: it is high when Firefox or Chrome processes themselves have high CPU activity. This is explained by the fact that `MsMpEng.exe` spends most of its CPU time in `sechost.dll!ProcessTrace`, in other words it is busy processing ETW events that result from the activity of other processes. However, the CPU time used overall by `MsMpEng.exe` seems indeed much higher with Firefox compared to Chrome. By trying to list the specific ETW events which `MsMpEng.exe` is listening to, we may identify that there are some events which Firefox's current behavior generates a lot of, and in that case we could then try to reduce the amount that we generate. So, if the Firefox graph looks similar on the reporter's machine, then I will try doing that. Note: I see no disk activity from `MsMpEng.exe`, so for the moment this looks like "normal" `MsMpEng.exe` activity (although high) to me, unlike the original bug.
Bug 1441918 Comment 80 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
(In reply to Jeroen Baert from comment #77) > Some new reports of this popping up: https://www.reddit.com/r/firefox/comments/zyzsk6/high_cpu_usage_from_windows_defenderantimalware/ > > I'm personally running Win10 22H2 Build 19045.2604, all latest updates and I encounter this problem too. Hello, Thank you for sharing this. I think I can reproduce the problem, so I will provide some data that describes what happens on my machine in this comment. It would be helpful if you could confirm if the data looks similar on your machine, to be sure that I can use my own machine as a basis for investigating this issue. I will describe how to collect similar data by yourself in a second comment. I recorded a session with Windows Performance Recorder, then opened it in Windows Performance Analyzer. I only had Firefox open when I did the test. What I did was launch `youtube.com` once, wait for 10 seconds, refresh it, and again (in total, 5 loads). I did the same in Chrome (after [disabling Software Reporter Tool](https://thegeekpage.com/high-cpu-usage-by-google-chromes-software-reporter-tool/) which was somehow having a lot of CPU activity on my machine, which could have affected the experiment). Attachments show the activity graph for the most active processes in each session, then the details of where `MsMpEng.exe` spent CPU time in both sessions. Firefox session is always shown at the top, and Chrome at the bottom. `MsMpEng.exe`'s CPU activity is shown with red bars, while the useful processes are shown with other colors. We can see that with both Firefox and Chrome, `MsMpEng.exe`'s activity is correlated to the activity of the other processes: it is high when Firefox or Chrome processes themselves have high CPU activity. This is explained by the fact that `MsMpEng.exe` spends most of its CPU time in `sechost.dll!ProcessTrace`, in other words it is busy processing ETW events that result from the activity of other processes. However, the CPU time used overall by `MsMpEng.exe` seems indeed much higher with Firefox compared to Chrome. By trying to list the specific ETW events which `MsMpEng.exe` is listening to, we may identify that there are some events which Firefox's current behavior generates a lot of, and in that case we could then try to reduce the amount that we generate. So, if the Firefox graph looks similar on the reporter's machine, then I will try doing that. Note: I see no disk activity from `MsMpEng.exe`, so for the moment this looks like "normal" `MsMpEng.exe` activity (although high) to me, unlike the original bug.
(In reply to Jeroen Baert from comment #77) > Some new reports of this popping up: https://www.reddit.com/r/firefox/comments/zyzsk6/high_cpu_usage_from_windows_defenderantimalware/ > > I'm personally running Win10 22H2 Build 19045.2604, all latest updates and I encounter this problem too. Hello, Thank you for sharing this. I think I can reproduce the problem, so I will provide some data that describes what happens on my machine in this comment. It would be helpful if you could confirm if the data looks similar on your machine, to be sure that I can use my own machine as a basis for investigating this issue. I will describe how to collect similar data by yourself in a second comment. I recorded a session with Windows Performance Recorder, then opened it in Windows Performance Analyzer. I only had Firefox open when I did the test. What I did was launch `youtube.com` once, wait for 10 seconds, refresh it, and again (in total, 5 loads). I did the same in Chrome (after [disabling Software Reporter Tool](https://thegeekpage.com/high-cpu-usage-by-google-chromes-software-reporter-tool/) which was somehow having a lot of CPU activity on my machine, which could have affected the experiment). Attachments show the activity graph for the most active processes in each session, then the details of where `MsMpEng.exe` spent CPU time in both sessions. Firefox session is always shown at the top, and Chrome at the bottom. `MsMpEng.exe`'s CPU activity is shown with red bars, while the useful processes are shown with other colors. We can see that with both Firefox and Chrome, `MsMpEng.exe`'s activity is correlated to the activity of the other processes: it is high when Firefox or Chrome processes themselves have high CPU activity. This is explained by the fact that `MsMpEng.exe` spends most of its CPU time in `sechost.dll!ProcessTrace`, in other words it is busy processing ETW events that result from the activity of other processes. However, the CPU time used overall by `MsMpEng.exe` seems indeed much higher with Firefox compared to Chrome. By trying to list the specific ETW events which `MsMpEng.exe` is listening to, we may identify that there are some events which Firefox's current behavior generates a lot of, and in that case we could then try to reduce the amount that we generate. So, if the Firefox graph looks similar on the reporter's machine, then I can try doing that. Note: I see no disk activity from `MsMpEng.exe`, so for the moment this looks like "normal" `MsMpEng.exe` activity (although high) to me, unlike the original bug.
(In reply to Jeroen Baert from comment #77) > Some new reports of this popping up: https://www.reddit.com/r/firefox/comments/zyzsk6/high_cpu_usage_from_windows_defenderantimalware/ > > I'm personally running Win10 22H2 Build 19045.2604, all latest updates and I encounter this problem too. Hello, Thank you for sharing this. I think I can reproduce the problem, so I will provide some data that describes what happens on my machine in this comment. It would be helpful if you could confirm if the data looks similar on your machine, to be sure that I can use my own machine as a basis for investigating this issue. I will describe how to collect similar data by yourself in a second comment. I recorded a session with Windows Performance Recorder, then opened it in Windows Performance Analyzer. I only had Firefox open when I did the test. What I did was launch `youtube.com` once, wait for 10 seconds, refresh it, and again (in total, 5 loads). I did the same in Chrome (after [disabling Software Reporter Tool](https://thegeekpage.com/high-cpu-usage-by-google-chromes-software-reporter-tool/) which was somehow having a lot of CPU activity on my machine, which could have affected the experiment). Attachments show the activity graph for the most active processes in each session, then the details of where `MsMpEng.exe` spent CPU time in both sessions. Firefox session is always shown at the top, and Chrome at the bottom. `MsMpEng.exe`'s CPU activity is shown with red bars, while the useful processes are shown with other colors. We can see that with both Firefox and Chrome, `MsMpEng.exe`'s activity is correlated to the activity of the other processes: it is high when Firefox or Chrome processes themselves have high CPU activity. This is explained by the fact that `MsMpEng.exe` spends most of its CPU time in `sechost.dll!ProcessTrace`, in other words it is busy processing ETW events that result from the activity of other processes. However, the CPU time used overall by `MsMpEng.exe` seems indeed much higher with Firefox compared to Chrome. By trying to list the specific ETW events which `MsMpEng.exe` is listening to, we may identify that there are some events which Firefox's current behavior generates a lot of, and in that case we could then try to reduce the amount that we generate. So, if the Firefox graph looks similar on the reporter's machine, then I can try doing that. Note: I see no disk activity from `MsMpEng.exe`, so for the moment this looks like "normal" `MsMpEng.exe` activity (although high) to me, unlike (my understanding of) the original bug.
(In reply to Jeroen Baert from comment #77) > Some new reports of this popping up: https://www.reddit.com/r/firefox/comments/zyzsk6/high_cpu_usage_from_windows_defenderantimalware/ > > I'm personally running Win10 22H2 Build 19045.2604, all latest updates and I encounter this problem too. Hello, Thank you for sharing this. I think I can reproduce the problem, so I will provide some data that describes what happens on my machine in this comment. It would be helpful if you could confirm if the data looks similar on your machine, to be sure that I can use my own machine as a basis for investigating this issue. I will describe how to collect similar data by yourself in a second comment. I recorded a session with Windows Performance Recorder, then opened it in Windows Performance Analyzer. I only had Firefox open when I did the test. What I did was launch `youtube.com` once, wait for 10 seconds, refresh it, and again (in total, 5 loads). I did the same in Chrome (after [disabling Software Reporter Tool](https://thegeekpage.com/high-cpu-usage-by-google-chromes-software-reporter-tool/) which was somehow having a lot of CPU activity on my machine, which could have affected the experiment). Attachments show the activity graph for the most active processes in each session, then the details of where `MsMpEng.exe` spent CPU time in both sessions. Firefox session is always shown at the top, and Chrome at the bottom. `MsMpEng.exe`'s CPU activity is shown with red bars, while the useful processes are shown with other colors. We can see that with both Firefox and Chrome, `MsMpEng.exe`'s activity is correlated to the activity of the other processes: it is high when Firefox or Chrome processes themselves have high CPU activity. This is explained by the fact that `MsMpEng.exe` spends most of its CPU time in `sechost.dll!ProcessTrace`, in other words it is busy processing ETW events that result from the activity of other processes. However, the CPU time used overall by `MsMpEng.exe` seems indeed much higher (x5) with Firefox compared to Chrome. By trying to list the specific ETW events which `MsMpEng.exe` is listening to, we may identify that there are some events which Firefox's current behavior generates a lot of, and in that case we could then try to reduce the amount that we generate. So, if the Firefox graph looks similar on the reporter's machine, then I can try doing that. Note: I see no disk activity from `MsMpEng.exe`, so for the moment this looks like "normal" `MsMpEng.exe` activity (although high) to me, unlike (my understanding of) the original bug.
(In reply to Jeroen Baert from comment #77) > Some new reports of this popping up: https://www.reddit.com/r/firefox/comments/zyzsk6/high_cpu_usage_from_windows_defenderantimalware/ > > I'm personally running Win10 22H2 Build 19045.2604, all latest updates and I encounter this problem too. Hello, Thank you for sharing this. I think I can reproduce the problem, so I will provide some data that describes what happens on my machine in this comment. It would be helpful if you could confirm if the data looks similar on your machine, to be sure that I can use my own machine as a basis for investigating this issue. I will describe how to collect similar data by yourself in a second comment. I recorded a session with Windows Performance Recorder, then opened it in Windows Performance Analyzer. I only had Firefox open when I did the test. What I did was launch `youtube.com` once, wait for 10 seconds, refresh it, and again (in total, 5 loads). I did the same in Chrome (after [disabling Software Reporter Tool](https://thegeekpage.com/high-cpu-usage-by-google-chromes-software-reporter-tool/) which was somehow having a lot of CPU activity on my machine, which could have affected the experiment). Attachments show the activity graph for the most active processes in each session, then the details of where `MsMpEng.exe` spent CPU time in both sessions. Firefox session is always shown at the top, and Chrome at the bottom. `MsMpEng.exe`'s CPU activity is shown with red bars, while the useful processes are shown with other colors. We can see that with both Firefox and Chrome, `MsMpEng.exe`'s activity is correlated to the activity of the other processes: it is high when Firefox or Chrome processes themselves have high CPU activity. This is explained by the fact that `MsMpEng.exe` spends most of its CPU time in `sechost.dll!ProcessTrace`, in other words it is busy processing ETW events that result from the activity of other processes. However, the CPU time used overall by `MsMpEng.exe` seems indeed much higher (5x) with Firefox compared to Chrome. By trying to list the specific ETW events which `MsMpEng.exe` is listening to, we may identify that there are some events which Firefox's current behavior generates a lot of, and in that case we could then try to reduce the amount that we generate. So, if the Firefox graph looks similar on the reporter's machine, then I can try doing that. Note: I see no disk activity from `MsMpEng.exe`, so for the moment this looks like "normal" `MsMpEng.exe` activity (although high) to me, unlike (my understanding of) the original bug.
(In reply to Jeroen Baert from comment #77) > Some new reports of this popping up: https://www.reddit.com/r/firefox/comments/zyzsk6/high_cpu_usage_from_windows_defenderantimalware/ > > I'm personally running Win10 22H2 Build 19045.2604, all latest updates and I encounter this problem too. Hello, Thank you for sharing this. I think I can reproduce the problem, so I will provide some data that describes what happens on my machine in this comment. It would be helpful if you could confirm if the data looks similar on your machine, to be sure that I can use my own machine as a basis for investigating this issue. I will describe how to collect similar data by yourself in a second comment. I recorded a session with Windows Performance Recorder, then opened it in Windows Performance Analyzer. I only had Firefox open when I did the test. What I did was launch `youtube.com` once, wait for 10 seconds, refresh it, and again (in total, 5 loads). I did the same in Chrome (after [disabling Software Reporter Tool](https://thegeekpage.com/high-cpu-usage-by-google-chromes-software-reporter-tool/) which was somehow having a lot of CPU activity on my machine, which could have affected the experiment). Attachments show the activity graph for the most active processes in each session, then the details of where `MsMpEng.exe` spent CPU time in both sessions. Firefox session is always shown at the top, and Chrome at the bottom. `MsMpEng.exe`'s CPU activity is shown with red bars, while the useful processes are shown with other colors. We can see that with both Firefox and Chrome, `MsMpEng.exe`'s activity is correlated to the activity of the other processes: it is high when Firefox or Chrome processes themselves have high CPU activity. This is explained by the fact that `MsMpEng.exe` spends most of its CPU time in `sechost.dll!ProcessTrace`, in other words it is busy processing ETW events that result from the activity of other processes. However, the CPU time used overall by `MsMpEng.exe` seems indeed much higher (5x) with Firefox compared to Chrome. By trying to list the specific ETW events which `MsMpEng.exe` is listening to, we may identify that there are some events which Firefox's current behavior generates a lot of, and in that case we could then try to reduce the amount that we generate. So, if the Firefox graph looks similar on the reporter's machine, then I can try doing that. Note: I see no disk activity from `MsMpEng.exe`, so for the moment this looks like legitimate `MsMpEng.exe` activity (although high) to me, unlike (my understanding of) the original bug.