4.0.3 has huge memory and CPU footprint in High Sierra

General discussions about Little Snitch
christian
Objective Development
Objective Development
Posts: 1428
Joined: Thu Nov 09, 2006 11:46 am

Re: 4.0.3 has huge memory and CPU footprint in High Sierra

Postby christian » Tue Jul 10, 2018 1:59 pm

Let me first respond to the alert loop: This happens if Little Snitch cannot determine the host name for the remote computer uniquely. If there are multiple names and applying rules to all these names does not yield the same result (allow or deny), Little Snitch shows an alert for the IP address.

Not there are two questions: (1) Why has it not been able to determine the host name from TLS SNI headers? And (2) when you create an IP address based rule, why does it not match?

The answer to (1) may be a behavior of Chrome, maybe it does not send any headers when it knows that the network is down. This is something we would have to investigate. I don't have a good answer for (2), though. The rule you created may have lower precedence than other rules which are not unique. This could result in the type of alert loop you described.

We have done some improvements in 4.1 in this respect. If no unique rule can be determined and the set of matching rules have contradicting actions, we now show the alert. The current 4.1.3 nightly logs these events into the LS Daemon log, if you want to analyze this further.

Regarding memory usage: If this happens during sleep or screen locker, it's very likely related to this other issue where Little Snitch Agent hangs in a graphics library call every two minutes. I suspect a graphics driver problem on your machine.

We better go back to the Agent hang problem because it occurs more frequently and should therefore be easier to watch. This may even be a bug in Apple's drivers with no easy way for us to fix it. Do you experience hangs in other apps, especially after wake from sleep?

durandal42
Rank 1
Rank 1
Posts: 25
Joined: Wed Aug 09, 2017 9:35 pm

Re: 4.0.3 has huge memory and CPU footprint in High Sierra

Postby durandal42 » Fri Jul 13, 2018 7:59 am

Do you experience hangs in other apps, especially after wake from sleep?


Chrome hangs while LSNM has it trapped in an alert loop, but nothing else has a noticeable delay when waking from sleep.

christian
Objective Development
Objective Development
Posts: 1428
Joined: Thu Nov 09, 2006 11:46 am

Re: 4.0.3 has huge memory and CPU footprint in High Sierra

Postby christian » Tue Jul 17, 2018 11:34 am

I think we have identified the cause for the alert loops and will fix it in one of the upcoming nightly releases.

But the other issue, the hang in the graphics driver and the lost memory blocks -- no idea. Sorry. I'm just running out of ideas...

durandal42
Rank 1
Rank 1
Posts: 25
Joined: Wed Aug 09, 2017 9:35 pm

Re: 4.0.3 has huge memory and CPU footprint in High Sierra

Postby durandal42 » Wed Jul 18, 2018 9:48 am

But the other issue, the hang in the graphics driver and the lost memory blocks -- no idea. Sorry. I'm just running out of ideas...


In desperation, I turned off LSNM's Network Filter: menu > Stop Network Filter.

... and LSNM has grown to 923MB anyway.

Does that usefully narrow the search scope?

christian
Objective Development
Objective Development
Posts: 1428
Joined: Thu Nov 09, 2006 11:46 am

Re: 4.0.3 has huge memory and CPU footprint in High Sierra

Postby christian » Wed Jul 18, 2018 10:28 am

Network Monitor is independent of the filter. The network filter is installed in the kernel and filters all data packets sent or received according to your rules. Network Monitor, on the other hand, receives connection data and visualizes it.

If you want to work without Network Monitor, turn it off in Little Snitch Configuration > Preferences > Monitor. You can still get alerts, manage rules etc without Network Monitor.

durandal42
Rank 1
Rank 1
Posts: 25
Joined: Wed Aug 09, 2017 9:35 pm

Re: 4.0.3 has huge memory and CPU footprint in High Sierra

Postby durandal42 » Wed Jul 18, 2018 10:58 pm

Network Monitor is independent of the filter. The network filter is installed in the kernel and filters all data packets sent or received according to your rules. Network Monitor, on the other hand, receives connection data and visualizes it.

If you want to work without Network Monitor, turn it off in Little Snitch Configuration > Preferences > Monitor. You can still get alerts, manage rules etc without Network Monitor.


Gotcha. Turning the filter back on puts me back in the chrome alert loop, so I'm leaving that off for now. Turning off the monitor as well terminates the LSNM process, which stops the memory growth. Looks like I've turned off LS entirely(?) at this point. :(

christian
Objective Development
Objective Development
Posts: 1428
Joined: Thu Nov 09, 2006 11:46 am

Re: 4.0.3 has huge memory and CPU footprint in High Sierra

Postby christian » Thu Jul 19, 2018 5:45 pm

Yes.

Regarding the Network Monitor memory consumption issue: The "lost memory" should not affect your system, in theory, because the memory is never used and can be swapped out completely. I know that this is not 100% true in practice and the effort of administering swap space costs a bit of performance. But you could turn off and back on Network Monitor once in a while. When it quits, the memory is freed.

Regarding the alert loop: That's pretty interesting because it obviously depends on the link status of your provider. Please keep up-to-date with our nightly builds. The current nightly has a debug log (in /Library/Logs/LittleSnitchDaemon.log) which (hopefully) explains why the alert loop occurs. If you install this, please let us know what it prints when the loop occurs. The next nightly will hopefully have a kind-of fix or workaround. At least you should have a way to escape the loop.


Return to “Little Snitch General”

Who is online

Users browsing this forum: Google [Bot] and 10 guests