The purpose of this document is to provide additional information about lmhost.exe CPU and Memory usage when the Antivirus module is installed.
Lmhost.exe is a component of the EMSS Agent. It is normal for lmhost.exe to use available CPU and Memory. Normal levels of Memory usage can be up to 1GB or more, during normal operations.
Fluctuations in CPU and Memory utilization are normal and can occur on the endpoint during the following operations:
1. Antivirus Real time monitoring (aka RTM scanning)
2. Antivirus reoccurring scheduled scans
3. Updating Antivirus definition
4. Performing manual or scheduled DAU scans (Discover Applicable Updates)
Additional tuning steps can be found in the Antivirus User Guide to help minimize the impact on performance.
Ivanti Antivirus uses a signature-based approach to detect known malware. Ivanti Antivirus uses a conventional signature-matching technique to search for and identify known viruses and malware. This technique uses signature files which are constantly updated to take account of the latest malware threats. Up-to-date versions of these files are regularly downloaded to the Ivanti Endpoint Security Server and distributed to the network’s endpoints where they are used in different types of scans to protect the network from attack.