rg --files triggers MsMpEng.exe on Windows

[chrmarti]

Version 0.6.0.

Not sure what might cause that, but MsMpEng.exe hogs the CPU and rg.exe makes only very slow progress.

When I use an alternate implementation to list the files in node.js, MsMpEng.exe remains silent or at least doesn't jam the CPU.

[BurntSushi]

I don't understand this ticket. Please consider that I am not a Windows user. I don't understand the significance of MsMpEng.exe. On Sep 7, 2017 12:51 AM, "Christof Marti" <[email protected]> wrote: Version 0.6.0. Not sure what might cause that, but MsMpEng.exe hogs the CPU and rg.exe makes only very slow progress. When I use an alternate implementation to list the files in node.js, MsMpEng.exe remains silent or at least doesn't jam the CPU. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#600>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAb34jsA03YkjNKW713v9ciU3S6JF5NPks5sf3ZigaJpZM4PPSPa> .

[chrmarti]

MsMpEng.exe is part of an antispyware. It looks like ripgrep triggers its activity. I would kind of expect this to happen if ripgrep scanned the contents of the files, but with --files that should not be the case.

Since using node.js to list all files does not show this behavior, I guess ripgrep must be using some API that triggers it.

[BurntSushi]

But --files does need to read some files. It has to read, for example, .gitignore/.ignore files to determine which files to filter.

I don't really know what you expect me to do about this.

[chrmarti]

I'm using --no-ignore, that should skip reading of these files I assume. Interestingly the problem stopped appearing on one machine, but still does on a VM.

[chrmarti]

I have captured traces of ripgrep and the node implementation using ProcMon. One difference is how they open files, ripgrep uses 'Generic Read' while node uses 'Read Attributes'.

ripgrep:

node:

[chrmarti]

@BurntSushi I would like to modify it to use 'Read Attributes' to see if maybe 'Generic Read' triggers MsMpEng.exe's scanning, but can't figure out where that is set. (I'm new to Rust.)

[BurntSushi]

@chrmarti If you aren't searching with memory maps (force it with --no-mmap), then the File::open call is here:

ripgrep/src/worker.rs

Line 221 in beb010d

let file = match File::open(path) {

You can presumably change the open attributes using std::fs::OpenOptions. You may need to use a platform specific OpenOptionsExt trait for Windows to set Windows-specific attributes though.

You could also try forcing the issue with --mmap to open files with memory maps.

It occurs to me that this is all for opening files to search. For opening .gitignore files, I believe the File::open call is here:

ripgrep/ignore/src/gitignore.rs

Line 351 in 0668c74

let file = match File::open(path) {