Support

What is the typical weight of running the PHP File Change Scanner? 

About the same as taking a backup.

After a first scan, is the resource consumption reduced? 

Yes, and significantly so. Core Joomla files essentially skip the Threat Score calculation if their checksum matches the one from the official release.

Is running it nightly too much?

No, it's pretty normal. It depends on how often your sites change, and how much of an early warning you want in case your site gets hacked. Nightly or once per week are the most common ways to do it, depending on those factors.

Is running all the sites sequentially a bad idea, like if it is 15 sites of moderate size, will it drag the server down and run for hours?

PHP is single threaded. At worst, you will be using up one CPU core quite heavily. Running in parallel is worse, as you'll not only be using multiple CPU cores heavily, you will also be raising the iowait due to the much heavier I/O operations of scanning multiple sites. A high iowait is far worse than increased CPU usage; iowait is the time the kernel can do nothing at all, waiting for I/O operations.

Is there any cleanup concern I should have?

No, not really.

Will I accumulate any excessive storage from frequent scans?

Not really, no. Only the first scan creates records for all files. From that point onwards, each scan only creates records for new, modified, and suspicious files. Don't judge the storage requirements by what's happening on the first scan. The first scan needs to establish a baseline for your site.

You can of course go back and periodically (like, once every 3–6 months) delete older scan reports as they stop being relevant at that point. Do not overdo it, though. If your site gets hacked you may want to go back to a scan from a few weeks ago to see what happened.