Thunderbird 3: Is It Really All Yours?

I'm reading: Thunderbird 3: Is It Really All Yours?Tweet this!

.

During the last few weeks we get more and more alerts from our beta tester regarding the Thunderbird e-mail client. The problems are not OS specific. Some testers described them as "like having a virus in the system that occupies ALL the resources - CPU, memory, disk and network".
Indeed, PerfProtector detected Thunderbird as the source for this problem. Turns out that almost all of its statistics were significantly deviated from the known profiles of Thunderbird behavior.
It looks as someone replaced Thunderbird with another application that has a completely different behavior.
However, this new behavior doesn't look right at all. It dramatically affects the performance of the clients while having many negative side effects. The machines are hogged for hours - the CPU utilization is very high, the memory consumption increases continuously, the hard disk constantly performs many read/write operations and gigs of data are transferred from the network side. And on top of that, it is impossible to use Thunderbird at all - can't read e-mails, can't send e-mails, can't reclaim the inbox...
It sounds like a very aggressive virus/Trojan that took control over the machine and then went completely out of control.

What was common between the infected machines? Thunderbird 3.
Users, which used for years previous versions of Thunderbird, said that once it was upgraded (automatically) to version 3, their machines were stuck for days. Fresh installs of Thunderbird 3 produced the same behavior.

What went wrong from version 2 to 3? How bad it is?
To understand the exact problem we reproduced it in our lab. We set up Linux (Ubuntu) and Windows (XP, Vista and 7) machines and tested them first with Thunderbird 2 (version 2.0.0.24) and then with Thunderbird 3 (versions 3.0 and 3.1.1). On each machine we configured a GMAIL IMAP account with a real mailbox that has about 9,000 e-mails from the last 4 years where the total size of the mailbox was less than 5 GB. This mailbox reflects an activity of about 5 e-mails per day with an average size of about 500KB per e-mail.
Then, the machines were monitored by PerfProtector.

The following graphs compare the behavior of Thunderbird 2 to Thunderbird 3 during the first 48 hours after their fresh installation. In each graph, the blue line represents the behavior of Thunderbird 2 the red line represents the behavior of Thunderbird 3.

CPU Utilization:

While CPU utilization of Thunderbird 2 is usually between 0% to 10% with an average of 0.3%, Thunderbird 3 CPU utilization is between 5% to 80% with an average of 30% - 100 times more than Thunderbird 2. In addition, during long periods of time, Thunderbird 3 used more than 50% of the overall CPU resources. This behavior slows dramatically the whole machine.

 Memory Consumption:

Thunderbird 3 memory consumption is twice as Thunderbird 2 consumption.

Read Operations from Hard Disk:

While Thunderbird 2 performs minor read operations from the hard disk, Thunderbird 3 performs thousands of read operations during long periods of time.

Thunderbird 3 reads gigs of data from the hard disk during long periods of time. Thunderbird 2 reads almost none. This behavior affects the response time of the hard disk and the behavior of other applications that read from the hard disk.

Write Operations to Hard Disk:

While Thunderbird 2 performs minor write operations to the hard disk, Thunderbird 3 performs thousands of write operations during long periods of time.

Thunderbird 3 writes gigs of data to the hard disk during long periods of time. Thunderbird 2 writes almost none. Similar to the read behavior, it affects the response time of the hard disk and the behavior of other applications that write to the hard disk. In addition, it occupies gigs of free space from the hard disk.

Network Activity:

While Thunderbird 2 performs minor download operations from the Internet, Thunderbird 3 performs thousands of download operations during long periods of time.

Thunderbird 3 downloads gigs of data from the Internet during long periods of time. Thunderbird 2 downloads almost none. This behavior affects the response time of the Internet connection. It hogs the connection and slows dramatically the Internet activities. In case your Internet is paid according to the bandwidth that you use, your bill will increase significantly.

We can see that Thunderbird 3 has a completely different behavior than Thunderbird 2. While Thunderbird 2 behaves like a normal balanced application, Thunderbird 3 has a sure anomalous behavior - its deviations from normal behavior are crystal clear. Thunderbird 3 reclaimed the CPU, reclaimed the memory, reclaimed the hard disk and reclaimed the network.

What is the source of these problems?
These problems are due to a combination of two features:

1. The first feature is the Global Search and Indexer. This feature is new in Thunderbird 3. It enables fast search of e-mails in the mailbox. However, Thunderbird has first to index all the e-mails and this process is time and resource consuming. It took Thunderbird 3 days to index our mailbox. During this time, its CPU utilization was between 5% to 80%,  its memory consumption was between 100 to 150MB and it made thousands of read operations from the hard disk. In addition, even after the indexing was completed, we still noticed that Thunderbird 3 continue to index and re-index from time to time thus consuming more resources from the machine. Moreover, according to Thunderbird's official site, "if you enable Global Search/Indexing it normally uses about 3.5 KB per message in the SQLite database". So our 9,000 e-mails database should theoretically consume about 30MB. However, in reality it consumed 150MB and it keeps growing and growing.
   The worrisome thing about this new feature is that it is turned on by default. It happens either when you migrate from Thunderbird 2 to 3 or when you install Thunderbird 3 from scratch. This feature has a huge impact on the behavior of the client: for at least couple of days, the machine is hogged from all directions and the user is helpless. A typical user can't understand what is going wrong with his machine and why he can't do even simple tasks. A new feature, which has this major side effect, shouldn't be turned on by default. It's completely wrong. Users around the world spent hours and days on finding the source of this problem. They conclude that it's due to this new feature in Thunderbird 3. The funny thing is that we didn't find any significant difference between searching with or without indexing . It seems that for a typical user, this feature is not needed.
   


2. The second feature is the Message Synchronization of IMAP accounts. Thunderbird synchronizes the IMAP folders and saves the messages locally on the hard disk of the machine. It means that all your IMAP accounts reside on the machine hard disk. This feature was already in Thunderbird 2 but its default was turned off. In Thunderbird 3, its default was changed to be on. In addition, if Thunderbird 2 was migrated to Thunderbird 3, this feature was turned on automatically, even if it wasn't turned on in your Thunderbird 2 settings! This feature has a huge impact on the computer resources since it downloads all your e-mail messages and stores them on the hard disk of the machine. It means that it uses your Internet connection to download gigs of data and uses your hard disk to store them. It took Thunderbird 3 days to synchronize our mailbox and during this time  it hogged our Internet connection by downloading our entire mailbox while making thousands of write operations to the hard disk. Since Gmail maps messages to labels, multiple  copies of the same message are held when synchronization is enabled, thus increasing the occupied disk space. As a consequence, our 5GB online mailbox increased to 40GB of data that were downloaded from the Internet and were stored on our hard disk without getting any warning alert from Thunderbird!
   This feature may be useful to many users but since it affects dramatically the resources of the machine, it shouldn't be turned on by default. Some of our machines, which have "only" 30GB of free space, were stuck during the synchronization operation. Thunderbird used the whole disk space and not even a single sector was left free.
   

Thunderbird is a great e-mail client and its popularity is growing. However, these types of irresponsible mistakes, which obviously harm thousands of thousands of users around the world, can ruin its reputation and slows its vast spreading. Thunderbird is used by all types of users and not just by computer geeks that know what each feature means and how to tweak it.

How to solve these problem using PerfProtector?
The solution is very simple. In the main dashboard of PerfProtector, right-click on the Thunderbird alert and choose either "Disable Global Search and Indexer Functionality" to disable the global search or the "Disable Message Synchronization Functionality" to disable message synchronization.

How to solve these problems manually?
To disable the Global Search and Indexer functionality:

1. Open the options window. On Windows, click Tools-> Options. On Linux, click Edit-> Preferences. 
2. Click on Advanced -> General -> Advanced Configuration.
3. Uncheck the Enable Global Search and Indexer checkbox.
   

To disable the Message Synchronization functionality:

1. Open the accounts settings window. On Windows, click Tools-> Account Settings. On Linux, click Edit-> Account Settings. 
2. For each IMAP account that is configured in your Thunderbird, choose Synchronization & Storage and under Message Synchronization uncheck the Keep Messages For This Account On This Computer checkbox.
   

I'm reading: Thunderbird 3: Is It Really All Yours?Tweet this!

There is a bandwidth hogger in my computer

I'm reading: There is a bandwidth hogger in my computerTweet this!

.

A couple of weeks ago we distributed our beta version of PerfProtector among a group of beta testers around the world.

Prior to running PerfProtector by the beta testers, we questioned them regarding some performance problems that they recently encountered.
Some beta testers reported that although they have a very fast Internet connection, they encountered some inconsistent slowdown in their connections - they had good hours but also very bad hours where they couldn't even check their e-mails. This problem wasn't location-specific.

After several hours of monitoring the beta testers machines, we got urgent e-mails from almost all of the slow-connected users. All of them said that PerfProtector identified a single process as the source of the major decrease in their Internet performance: the ultimate hogger was Skype.
All of these users had a public IP address and a relatively good Internet connection.

Well, it isn't such a big surprise since Skype is known to be a bandwidth hogger but the interesting thing was that PerfProtector detected Skype as a huge threat to the performance, almost simultaneously on all of the machines. As a matter of fact, it got the maximum abnormality score: a perfect 100.

In order to reproduce the problem, we set up a Windows XP machine with a public IP address in our lab.
We installed Skype version 4.2.0.158 and monitored the machine with PerfProtector.

After one day, our Internet connection became a bit slower and PerfProtector identified Skype as the source of the problem.
After two days, it became much slower and all websites were uploaded very slowly.
After four days we couldn't surf to any website or use our mail client - the machine was hogged to death!


The graph of the number of Internet connections that Skype used in our machine during a period of nine days illustrates the problem

We can see how bad  things became over time and why our machine was completely blocked due to Skype abnormal behavior.
Hundreds of Internet connections, almost all our upload bandwidth, most of our download bandwidth - the result is a completely hogged machine. Skype indeed takes no prisoners...

The reason for that behavior is well-known: you have a machine with a public IP and a  fast internet connection. Your machine is online for hours and therefore you become a perfect Skype supernode candidate. Skype needs supernode machines in order to maintain its network and enable calls to/from users that are, for example, behind NAT or proxy.
This communication architecture is acceptable as long as it doesn't affect the performance of the supernodes machines. However, as we can see in our recent experiment, Skype has no limits and its greedy behavior just killed our machine.

What can be done?
It is possible to prevent the Skype client from being a supernode. This way, it will be limited to maintain only a few network connections.
However, if everyone will disable the supernode functionality the Skype network will die and no one will be able to make calls. Skype can't exist without supernodes.
This problem of hogging the bandwidth by Skype is known for a long time.,We think that Skype could have  solved this problem but it still continues to hog and affect dramatically the performance of machines around the world.
Skype is a commercial company - it has a business to maintain, it has clients and it has competitors. Skype has to solve the problems that it causes otherwise it won't have clients. As simple as that - unhappy customers can use other products.

Conclusion, until Skype solves this acute problem, we recommend to disable the Supernode functionality from every machine. 


How to solve this problem using PerfProtector?
The solution is very simple, while you are in the main dashboard of PerfProtector, right-click on the Skype alert and choose "Apply the Disable Supernode Functionality". That's it. From now on you won't be a supernode anymore.

How to solve this problem manually (on Windows machines)?
1. Copy the following text and save it as "DisableSkypeSupernode.reg" :

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Skype]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Skype\Phone]
"DisableSupernode"=dword:00000001


2. Double-click on the saved file. You should get a message box that is similar to this one:

 Choose "Yes"

3. You are done. You should get a message box that is similar to this one:

4. Reboot your machine


 .

I'm reading: There is a bandwidth hogger in my computerTweet this!

Who are we?

I'm reading: Who are we?Tweet this!

.

Our team developed a novel anomaly detection system that monitors the processes in the user's machine and identifies abnormal behavior. The system uses patent protected mathematical algorithms and it is distributed as a freeware.

This system protects the machine by keeping the overall performance optimal - it makes sure that all processes behave normally  without causing problems that may affect the resources of the machine - for example,  hogging the network bandwidth, excessive resource usage (disk, memory, cpu) and more.

Our idea is that by combining our tools with the public knowledge the users have, we can improve the tools and create better methods that are constantly updated.
This way, the users of the system will get a free system, and by contributing their knowledge, the system will improve its detection over time. This way, we create a network of knowledge.


How does PerfProtector works?
Once installed in the client machine, PerfProtector starts its short training phase (about 20 minutes). During the training phase, PerfProtector collects and analyzes several statistics from each active process. Then, it builds a normal profile for each process.
At the end of the training phase, PerfProtector switches automatically to the testing phase. During this phase, PerfProtector monitors and analyzes in realtime the statistics of each process and it looks for deviations from the previously built normal behavior. 

These deviations are constantly scored according to their abnormality levels. The user can see in realtime the score of each process. The system displays automatically alerts regarding the most problematic processes.

In the following image we see a screenshot of the system.
The system presents:
On the upper section - the overall CPU and memory usage
On the middle section - the per-process statistics including the abnormality score for each process
On the lower section - the log of the major abnormality alerts including the duration of the abnormal behavior, the overall abnormality score of the anomalous process and individual abnormality scores for each statistic of this process

 Then, by combining the network of knowledge, the system suggests a solution that will improve the performance of the user's machine.


Couple of weeks ago we distributed our beta version of PerfProtector among a group of beta testers.
This was the first time that the system was running simultaneously on users machines in the US, in Europe and in Asia.

On the following posts, we will give some interesting events that PerfProtector detected around the world.

I'm reading: Who are we?Tweet this!