- Flexera Community
- :
- Software Vulnerability Management
- :
- Software Vulnerability Manager Knowledge Base
- :
- SVM Windows OS Scanning Benchmarks
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
SVM Windows OS Scanning Benchmarks
SVM Windows OS Scanning Benchmarks
Synopsis
This article provides general information on the scanning performance of the various scanning methods available in the Software Vulnerability Manager solution, and it provides more detailed and concrete information on the performance of SVM Agents for Windows OS (Windows executable) as measured with the SVM On-Prem Agent for Windows.
While the tests used for benchmarking the performance of SVM scans, and in particular Agent scans, have been tested with the SVM On-Prem edition, the performance should be perceived widely to be the same with the SVM Cloud Edition, as the core code functionality and execution of both solutions is identical, and the only difference may come from the larger amounts of data processing and delays in network traffic outside the control of SVM or its Agents.
SVM Scan Benchmarks w/ SVM 7.6.1.4
The following benchmark results have been produced with SVM On-Prem RPM build 7.6.1.4and measured against a Client system with 4GB RAM and around 100 installed applications.
Scan Methods Performance
1. Local Host Agent (installation: csia.exe -i - L) - Microsoft Official Update Server
Type 1 scan : |
14 sec |
Type 2 scan : |
81 sec |
Type 3 scan : |
1220 sec |
2. Network Appliance Agent (installation: csia.exe -i - L -A) - [WU = Microsoft Official Update Server]
Type 1 scan : |
13 sec |
Type 2 scan : |
97 sec |
Type 3 scan : |
1320 sec |
3. Localhost Scan with SVM Plugin for Internet Explorer - Microsoft Official Update Server
Type 2 scan : |
38 sec |
4. Remote Scan with SVM Plugin for Internet Explorer - Microsoft Official Update Server
Type 1 scan: |
30 sec |
Type 2 scan: |
224 sec |
SVM Agent [7.6.1.4] CPU Performance:
The CPU utilization is seen to remain below the 20% threshold for all tested scan types.
Max CPU utilization at some point during the active test scan has reached the following:
SCAN TYPE |
SVM Scan time |
SVM version |
CPU (Max Peaked) |
1 |
14 sec |
7.6.1.4 |
17% |
2 |
81 sec |
7.6.1.4 |
17% |
3 |
1220 sec |
7.6.1.4 |
17% |
Agent Benchmarks w/ SVM 7.6.1.7
Agent version: 7.6.1.7
Tool Used: Process Explorer
Date of Testing: 31-05-2019
1. Local Host Agent - (Installation: csia.exe -i - L) - Microsoft Official Update Server
Type 2 Scan |
4 min 25 sec |
Type 2 scan(without windows update) : |
1 min 9 sec |
CPU utilization (Max peaked): 22%
Average CPU utilization: 5-10%
1.a) I/O information for Local Host Agent for Windows:
Tools used: Wireshark Network analyzer
Test Client: 192.168.10.10 [70 applications installed on it]
SVM Server: 192.168.10.2
Client |
Client Port |
Server |
Server Port |
Packets |
Packets |
Packets |
Bytes |
Bytes |
Bytes |
Bits |
Bits |
Duration |
API Calls |
192.168.10.10 |
65305 |
192.168.10.2 |
443 |
39 |
485 |
725860 |
3396 |
722464 |
2375 |
505298 |
11.27 |
rules |
|
192.168.10.10 |
65305 |
192.168.10.2 |
443 |
28 |
15 |
12 |
15598 |
14469 |
1129 |
11505 |
897 |
10.053 |
data |
192.168.10.10 |
65305 |
192.168.10.2 |
443 |
24 |
6 |
16 |
20939 |
799 |
20140 |
22634 |
817937 |
4.09 |
status |
2. Network Appliance Agent (NAA) - (Installation: csia.exe -i - L -A) - Microsoft Official Update Server
Type 2 scan : |
4 min 50 sec |
- NAA CPU utilization (Max peaked): 40%
- NAA Average CPU utilization: 5-10%
3. I/O information for Agent scans with enabled "Stop Agent Polling" setting in SVM:
Test Client |
Client Port |
Server |
Server Port |
Packets |
Packets |
Packets |
Bytes |
Bytes |
Bytes |
Bits |
Bits |
API calls |
Duration |
192.168.10.10 |
60806 |
192.168.10.2 |
443 |
708 |
225 |
483 |
736k |
13k |
722k |
9142 |
492k |
rules |
11.74 |
192.168.10.10 |
60908 |
192.168.10.2 |
443 |
96 |
51 |
45 |
71k |
68k |
2979 |
54k |
2370 |
data |
10.05 |
192.168.10.10 |
60914 |
192.168.10.2 |
443 |
8 |
5 |
3 |
1382 |
722 |
660 |
1576 |
1141 |
status |
3.66 |
Additional Considerations
There are few things you need to take into additional account when considering the benchmark results:
- The more applications are installed on a system, the longer a scan can take to analyze all files
- For instance, Win 10 scanning takes a little longer because these builds contain twice as many system files by default than a Windows 8.1 build.
- Content inspection filters, Proxies, Firewall analysis, and other security solutions can delay scans.
- SVM On-Prem server configuration for load balancing can have a direct effect on scanning times.