Windows Defender goes nuts when running rustdoc on some projects

a9a312c
Opened by Jascha at 2025-03-16 06:48:45

rustdoc gets pretty much completely stalled on some projects by Windows Defender on Windows 10. rustdoc cpu usage drops to 0%, while MsMpEng.exe uses 100% on a single core. This issue seems to have popped up only a few weeks ago.

  1. rustdoc is creating thousands of files. Windows defender has to intercept each one and check whether it is okay. My recommended solution is to add the folder where you do all your rust dev to the windows defender exceptions.

    As for why the issue popped up recently, it could be that rustdoc's filesystem access patterns have changed in a way that hits a pathological edge case of Defender.

    Peter Atashian at 2016-09-05 07:04:52

  2. I understand and that is what I do for now. However, since cargo pulls in and compiles external crates in a subfolder of that same folder, it doesn't seem that safe. And adding exceptions for every target/.../doc folder for every project, profile and target is a complete hassle. As I've said, I've only seen this happen in the past few weeks, but that could be on me. It could very well be that I hadn't noticed it before. Thanks for the quick response.

    Jascha at 2016-09-05 07:19:28

  3. I googled a bit out of curiosity. It looks like you can submit false positives here: https://www.microsoft.com/en-us/security/portal/submission/submit.aspx

    Maybe that would resolve the issue?

    Emi at 2016-09-05 08:43:31

  4. @slimsag There's no false positives here. This is simply Windows Defender slowing things down dramatically by checking files produced by rustdoc.

    Peter Atashian at 2016-09-05 08:52:30

  5. You're totally right. My apologies -- I misread.

    On Sep 5, 2016 1:52 AM, "Peter Atashian" notifications@github.com wrote:

    @slimsag https://github.com/slimsag There's no false positives here. This is simply Windows Defender slowing things down dramatically by checking files produced by rustdoc.

    — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/rust-lang/rust/issues/36277#issuecomment-244693599, or mute the thread https://github.com/notifications/unsubscribe-auth/ADBrOFRsUJdHZ1wStKYOQPNLeDSaSrLcks5qm9hggaJpZM4J0xvc .

    Emi at 2016-09-05 09:17:27

  6. For anyone who's interested, these are my Rust related Windows Defender excluded processes:

    image

    Boscop at 2018-07-23 23:12:07

  7. Can you reproduce the issue still? To be honest, I think rustdoc can't do much about the issue. It has to create a lot of files...

    Kazuyoshi Kato at 2018-09-28 05:23:16

  8. @kzys What can be done is to make docs optional again: https://github.com/rust-lang-nursery/rustup.rs/issues/998 And it should be done IMO, to make updating nightlies much faster and because space is limited on Raspberry Pi. I never used the installed docs anyway, always the online docs. It's required to have an internet connection anyway to be able to use cargo..

    Boscop at 2018-09-28 21:13:48

  9. In that case, cargo, rustup, or both of them should have the option to not install docs. Rustdoc itself can't do much.

    Kazuyoshi Kato at 2018-09-29 21:01:58

  10. The real solution here is for rustdoc to stop creating so many files! Come up with ways to merge multiple items into a single html file, so crates like winapi don't take literal hours to document.

    Peter Atashian at 2018-09-29 23:43:10

  11. Sorry if this is too off-topic: How can I exclude ALL nightlies from causing Windows Defender to scan the files they create? I.E. all exe files under D:\Program Files\.multirust\toolchains. It seems I can only add individual .exe files under "Excluded processes" and I can only enter directories for "Excluded files and locations" but when I add D:\Program Files\.multirust\toolchains to that category, it will only not scan the contents of that dir, but still the files created by exes in that dir!

    I found this answer: https://www.reddit.com/r/Windows10/comments/5gf38v/when_excluding_a_process_in_windows_defender_do_i/day7lz6/ But it doesn't seem to work on Win 8.1:

    image

    @retep998 Do you have an idea how to exclude all installed nightlies from Windows Defender (the files they create) on Win 8.1?

    Boscop at 2018-11-13 23:47:06

  12. @Boscop help questions are best posed on users.rust-lang.org

    Steve Klabnik at 2018-11-14 18:56:41

  13. Triage: this is really late (like 6 years later), but current Windows dev recommendations would be to setup a Dev Drive on a sufficiently recent Windows 11 (possible even with ReFS). For dev drive, Windows defender will change its default to be performance mode.

    But only do that if you can trust the deps / build process / produced artifacts (standard development safety practices apply).

    I don't think this is very actionable for rustdoc atm.

    许杰友 Jieyou Xu (Joe) at 2025-03-16 06:08:18

  14. The only actionable thing that rustdoc can do here is as I mentioned before: reducing the number of files that are created. Granted, that is a significant undertaking that would involve a drastically different documentation format, so it's not an easy fix.

    Peter Atashian at 2025-03-16 06:48:45