I am currently investigating some performance issues with our cluster and was curious as to what effect real time virus scanning has on a domino server.
Our domino servers have SAV client installed like any other server and are managed by a SAV server. Looking at the real time protection stats live, I can see nsf’s getting scanned non stop (which makes sense) however CPU use is not excessive.
We also have AV and content filtering at the gateway via MailMarshal, and managed AV at the desktop.
My thoughts are:
-Should I just exclude the Domino Data dir from real time scanning?
-Would using Symantec Mail Security for Domino be more efficient? (I see this as overkill as we already have content filtering/AV protection via our mail gateway)
-Should I just leave as is as SAV does not appear to hog resources on the servers?
Any thoughts/experience with SAV and Domino would be much appreciated.
Subject: Real Time anti virus perf impact
It is important to have a virus scanner on the computer. However I don’t think you need to have it scan *.nsf files. If ALL your mail is already filtered for viruses, this should get most of the viruses. Any extremely new viruses will be detected by the host computer (hopefully). Does SAV actually scan inside nsf files? If it doesn’t scan individual documents, it’s useless. Then you tell it not to scan *.nsf files.
Subject: RE: Real Time anti virus perf impact
Good idea, I may just set an exclusion for .nsf files. There is a very very slim chance of any virus making it through to the domino servers via email as even if a new bourne virus attempts to come through our MailMarshal gateway and defintions have not been released yet (happens all too often) we have it blocking all dangerous file types as a fail safe.
Im sure SAV does actually scan the mail files as I did have an incident of SAV falsely reporting it found mydoom in a users mail file, turns out it was just mime encoded jibberish as opposed to the actual attachment.
Well I think as the servers get nightly scans anyway, and with AV at the gateway and desktop I may just disable realtime on data dir to see if this helps peformance