How much is "a lot" of CPU time for anti-virus?

When I look at the Windows Task Manager I can see the accumulated CPU time for each process that's running. Can that give some meaningful idea of the load the security software places on the system or is most of that time run up during idle periods and not reflective of how the software affects the system when I'm using it heavily?

On my notebook computer, I see that the System Idle Process has accumulated 10:37:54 right now. A few of the "Host Process for Windows Services" have 2-4 minutes as does the NT Kernel. The Windows Sidebar has taken up 0:18:11 and otherwise nothing has more than a minute or so of time except for some Symantec processes.

All totalled they are using about 4.3MB of "Private Working Set" and have accumulated just a smidge over 8 minutes of CPU time. Eight minutes out of ten hours and four megs out of two gigs just doesn't sound like much at all. Yet people always say that Norton is so piggy. This is the whole suite, not just anti-virus. Surely there's something missing from the measurements I'm seeing.

 

anything more than 0-1% cpu usage on idle is too much.

on-demand cpu time can vary depending on each AV, there is no 'too much' for this.

 

I would agree - something is missing or not being measured. Just run a machine with any real time AV for a week and then run the same machine without. On any normal everyday machine I don't think any measurement will be needed to experience the difference.