antivirus software question

I currently exclude the directories that contain the sql database files
(mdf, ldf) from my antivirus 'real time protection' and scheduled sweep
scans. Actually I do this for any database files (act, quickbooks, ms
access) but I was recently thinking about this and I realized that I'm not
really sure if its necessary?
sticking with SQL server 2000/2005 since that is what this forum is for, is
it true that I should be excluding these directories (the ones with the
database and log files) from my antivirus software's protection?
and just in case someone is also familiar with the needs of any of the other
databases I mentioned, please feel free to comment on them as well. All
those other systems are flat file based database systems. I don't know if
that makes a difference with respect to antivirus software.
Each AntiVirus software scans computers differently. To generally say that
one wont affect your SQL server when anther might would be misleading.
You should test scanning folders with your particular software to see it
affects your SQL server. A decision should be made by the business owner as
to whether scanning that directory is mandated or not.
There are tons of known issues using Antivirus in a clutered envirnoment so
special attention should be givin in this situation.
here are two great articles...
"Guidelines for choosing antivirus software to run on the computers that are
running SQL Server"
http://support.microsoft.com/?kbid=309422
"Antivirus Software May Cause Problems with Cluster Services"
http://support.microsoft.com/kb/250355/
thanks,
/*
Warren Brunk - MCITP - SQL 2005, MCDBA
www.techintsolutions.com
*/
"djc" <noone@.nowhere.com> wrote in message
news:ezYIrdB3GHA.4228@.TK2MSFTNGP06.phx.gbl...
>I currently exclude the directories that contain the sql database files
>(mdf, ldf) from my antivirus 'real time protection' and scheduled sweep
>scans. Actually I do this for any database files (act, quickbooks, ms
>access) but I was recently thinking about this and I realized that I'm not
>really sure if its necessary?
> sticking with SQL server 2000/2005 since that is what this forum is for,
> is it true that I should be excluding these directories (the ones with the
> database and log files) from my antivirus software's protection?
> and just in case someone is also familiar with the needs of any of the
> other databases I mentioned, please feel free to comment on them as well.
> All those other systems are flat file based database systems. I don't know
> if that makes a difference with respect to antivirus software.
>
|||thanks for the reply Warren. Are you refering to stability/corruption
effects or only performance effects? My main concern is if there may be
stability/corruption issues due to the antivirus, not performance. I could
gage the performance easily enough after making a change but its the
possible corruption and/or stability issues that my not be immediately
apparrent (and possibly realized to late!) that worry me. Does this change
anything? or is this still a per product issue that requires individual
testing? ...I'm always looking for that nice, simple, yet broad, rule thats
easy to remember : )
"Warren Brunk" <wbrunk@.techintsolutions.com> wrote in message
news:%23EaUchB3GHA.4312@.TK2MSFTNGP02.phx.gbl...
> Each AntiVirus software scans computers differently. To generally say
> that one wont affect your SQL server when anther might would be
> misleading.
> You should test scanning folders with your particular software to see it
> affects your SQL server. A decision should be made by the business owner
> as to whether scanning that directory is mandated or not.
> There are tons of known issues using Antivirus in a clutered envirnoment
> so special attention should be givin in this situation.
> here are two great articles...
> "Guidelines for choosing antivirus software to run on the computers that
> are running SQL Server"
> http://support.microsoft.com/?kbid=309422
> "Antivirus Software May Cause Problems with Cluster Services"
> http://support.microsoft.com/kb/250355/
> thanks,
> --
> /*
> Warren Brunk - MCITP - SQL 2005, MCDBA
> www.techintsolutions.com
> */
>
> "djc" <noone@.nowhere.com> wrote in message
> news:ezYIrdB3GHA.4228@.TK2MSFTNGP06.phx.gbl...
>
|||I am referring to both stability, performance and security. Installing
AntiVirus on a SQL server increases surface area which has security risks.
But what I am really trying to say is you need to test it with your
particular anti virus software. For me, I dont want anything actively
scanning my SQL server files for a thousand reasons. Antivirus software can
certainly create a bottleneck due to the program requiring too much CPU
time -- especially if the server is also running an e-mail server or program
that requires a lot of antivirus resources (not necessarily a best
practice). It can also create file I/O problems if real-time scanning is
enabled for all files that are opened. I definitely recommend running
malware protection on a SQL Server (or any database server for that matter),
but be sure to exclude your database directories (or specific database
files) from the real-time protection if you can. Also, keep an eye out on
processor utilization to make sure the malware protection is not eating up
all the resources.
I have seen countless forums on how AV software locks up your DB files and
put the database in Suspect Mode or causing SQL server to fail.
thanks,
/*
Warren Brunk - MCITP - SQL 2005, MCDBA
www.techintsolutions.com
*/
"djc" <noone@.nowhere.com> wrote in message
news:%23QtRDrB3GHA.4484@.TK2MSFTNGP02.phx.gbl...
> thanks for the reply Warren. Are you refering to stability/corruption
> effects or only performance effects? My main concern is if there may be
> stability/corruption issues due to the antivirus, not performance. I could
> gage the performance easily enough after making a change but its the
> possible corruption and/or stability issues that my not be immediately
> apparrent (and possibly realized to late!) that worry me. Does this change
> anything? or is this still a per product issue that requires individual
> testing? ...I'm always looking for that nice, simple, yet broad, rule
> thats easy to remember : )
> "Warren Brunk" <wbrunk@.techintsolutions.com> wrote in message
> news:%23EaUchB3GHA.4312@.TK2MSFTNGP02.phx.gbl...
>

antivirus software question

I currently exclude the directories that contain the sql database files
(mdf, ldf) from my antivirus 'real time protection' and scheduled sweep
scans. Actually I do this for any database files (act, quickbooks, ms
access) but I was recently thinking about this and I realized that I'm not
really sure if its necessary?
sticking with SQL server 2000/2005 since that is what this forum is for, is
it true that I should be excluding these directories (the ones with the
database and log files) from my antivirus software's protection?
and just in case someone is also familiar with the needs of any of the other
databases I mentioned, please feel free to comment on them as well. All
those other systems are flat file based database systems. I don't know if
that makes a difference with respect to antivirus software.Each AntiVirus software scans computers differently. To generally say that
one wont affect your SQL server when anther might would be misleading.
You should test scanning folders with your particular software to see it
affects your SQL server. A decision should be made by the business owner as
to whether scanning that directory is mandated or not.
There are tons of known issues using Antivirus in a clutered envirnoment so
special attention should be givin in this situation.
here are two great articles...
"Guidelines for choosing antivirus software to run on the computers that are
running SQL Server"
http://support.microsoft.com/?kbid=309422
"Antivirus Software May Cause Problems with Cluster Services"
http://support.microsoft.com/kb/250355/
thanks,
--
/*
Warren Brunk - MCITP - SQL 2005, MCDBA
www.techintsolutions.com
*/
"djc" <noone@.nowhere.com> wrote in message
news:ezYIrdB3GHA.4228@.TK2MSFTNGP06.phx.gbl...
>I currently exclude the directories that contain the sql database files
>(mdf, ldf) from my antivirus 'real time protection' and scheduled sweep
>scans. Actually I do this for any database files (act, quickbooks, ms
>access) but I was recently thinking about this and I realized that I'm not
>really sure if its necessary?
> sticking with SQL server 2000/2005 since that is what this forum is for,
> is it true that I should be excluding these directories (the ones with the
> database and log files) from my antivirus software's protection?
> and just in case someone is also familiar with the needs of any of the
> other databases I mentioned, please feel free to comment on them as well.
> All those other systems are flat file based database systems. I don't know
> if that makes a difference with respect to antivirus software.
>|||thanks for the reply Warren. Are you refering to stability/corruption
effects or only performance effects? My main concern is if there may be
stability/corruption issues due to the antivirus, not performance. I could
gage the performance easily enough after making a change but its the
possible corruption and/or stability issues that my not be immediately
apparrent (and possibly realized to late!) that worry me. Does this change
anything? or is this still a per product issue that requires individual
testing? ...I'm always looking for that nice, simple, yet broad, rule thats
easy to remember : )
"Warren Brunk" <wbrunk@.techintsolutions.com> wrote in message
news:%23EaUchB3GHA.4312@.TK2MSFTNGP02.phx.gbl...
> Each AntiVirus software scans computers differently. To generally say
> that one wont affect your SQL server when anther might would be
> misleading.
> You should test scanning folders with your particular software to see it
> affects your SQL server. A decision should be made by the business owner
> as to whether scanning that directory is mandated or not.
> There are tons of known issues using Antivirus in a clutered envirnoment
> so special attention should be givin in this situation.
> here are two great articles...
> "Guidelines for choosing antivirus software to run on the computers that
> are running SQL Server"
> http://support.microsoft.com/?kbid=309422
> "Antivirus Software May Cause Problems with Cluster Services"
> http://support.microsoft.com/kb/250355/
> thanks,
> --
> /*
> Warren Brunk - MCITP - SQL 2005, MCDBA
> www.techintsolutions.com
> */
>
> "djc" <noone@.nowhere.com> wrote in message
> news:ezYIrdB3GHA.4228@.TK2MSFTNGP06.phx.gbl...
>>I currently exclude the directories that contain the sql database files
>>(mdf, ldf) from my antivirus 'real time protection' and scheduled sweep
>>scans. Actually I do this for any database files (act, quickbooks, ms
>>access) but I was recently thinking about this and I realized that I'm not
>>really sure if its necessary?
>> sticking with SQL server 2000/2005 since that is what this forum is for,
>> is it true that I should be excluding these directories (the ones with
>> the database and log files) from my antivirus software's protection?
>> and just in case someone is also familiar with the needs of any of the
>> other databases I mentioned, please feel free to comment on them as well.
>> All those other systems are flat file based database systems. I don't
>> know if that makes a difference with respect to antivirus software.
>|||I am referring to both stability, performance and security. Installing
AntiVirus on a SQL server increases surface area which has security risks.
But what I am really trying to say is you need to test it with your
particular anti virus software. For me, I dont want anything actively
scanning my SQL server files for a thousand reasons. Antivirus software can
certainly create a bottleneck due to the program requiring too much CPU
time -- especially if the server is also running an e-mail server or program
that requires a lot of antivirus resources (not necessarily a best
practice). It can also create file I/O problems if real-time scanning is
enabled for all files that are opened. I definitely recommend running
malware protection on a SQL Server (or any database server for that matter),
but be sure to exclude your database directories (or specific database
files) from the real-time protection if you can. Also, keep an eye out on
processor utilization to make sure the malware protection is not eating up
all the resources.
I have seen countless forums on how AV software locks up your DB files and
put the database in Suspect Mode or causing SQL server to fail.
thanks,
/*
Warren Brunk - MCITP - SQL 2005, MCDBA
www.techintsolutions.com
*/
"djc" <noone@.nowhere.com> wrote in message
news:%23QtRDrB3GHA.4484@.TK2MSFTNGP02.phx.gbl...
> thanks for the reply Warren. Are you refering to stability/corruption
> effects or only performance effects? My main concern is if there may be
> stability/corruption issues due to the antivirus, not performance. I could
> gage the performance easily enough after making a change but its the
> possible corruption and/or stability issues that my not be immediately
> apparrent (and possibly realized to late!) that worry me. Does this change
> anything? or is this still a per product issue that requires individual
> testing? ...I'm always looking for that nice, simple, yet broad, rule
> thats easy to remember : )
> "Warren Brunk" <wbrunk@.techintsolutions.com> wrote in message
> news:%23EaUchB3GHA.4312@.TK2MSFTNGP02.phx.gbl...
>> Each AntiVirus software scans computers differently. To generally say
>> that one wont affect your SQL server when anther might would be
>> misleading.
>> You should test scanning folders with your particular software to see it
>> affects your SQL server. A decision should be made by the business owner
>> as to whether scanning that directory is mandated or not.
>> There are tons of known issues using Antivirus in a clutered envirnoment
>> so special attention should be givin in this situation.
>> here are two great articles...
>> "Guidelines for choosing antivirus software to run on the computers that
>> are running SQL Server"
>> http://support.microsoft.com/?kbid=309422
>> "Antivirus Software May Cause Problems with Cluster Services"
>> http://support.microsoft.com/kb/250355/
>> thanks,
>> --
>> /*
>> Warren Brunk - MCITP - SQL 2005, MCDBA
>> www.techintsolutions.com
>> */
>>
>> "djc" <noone@.nowhere.com> wrote in message
>> news:ezYIrdB3GHA.4228@.TK2MSFTNGP06.phx.gbl...
>>I currently exclude the directories that contain the sql database files
>>(mdf, ldf) from my antivirus 'real time protection' and scheduled sweep
>>scans. Actually I do this for any database files (act, quickbooks, ms
>>access) but I was recently thinking about this and I realized that I'm
>>not really sure if its necessary?
>> sticking with SQL server 2000/2005 since that is what this forum is for,
>> is it true that I should be excluding these directories (the ones with
>> the database and log files) from my antivirus software's protection?
>> and just in case someone is also familiar with the needs of any of the
>> other databases I mentioned, please feel free to comment on them as
>> well. All those other systems are flat file based database systems. I
>> don't know if that makes a difference with respect to antivirus
>> software.
>>
>

antivirus software question

I currently exclude the directories that contain the sql database files
(mdf, ldf) from my antivirus 'real time protection' and scheduled sweep
scans. Actually I do this for any database files (act, quickbooks, ms
access) but I was recently thinking about this and I realized that I'm not
really sure if its necessary?
sticking with SQL server 2000/2005 since that is what this forum is for, is
it true that I should be excluding these directories (the ones with the
database and log files) from my antivirus software's protection?
and just in case someone is also familiar with the needs of any of the other
databases I mentioned, please feel free to comment on them as well. All
those other systems are flat file based database systems. I don't know if
that makes a difference with respect to antivirus software.Each AntiVirus software scans computers differently. To generally say that
one wont affect your SQL server when anther might would be misleading.
You should test scanning folders with your particular software to see it
affects your SQL server. A decision should be made by the business owner as
to whether scanning that directory is mandated or not.
There are tons of known issues using Antivirus in a clutered envirnoment so
special attention should be givin in this situation.
here are two great articles...
"Guidelines for choosing antivirus software to run on the computers that are
running SQL Server"
http://support.microsoft.com/?kbid=309422
"Antivirus Software May Cause Problems with Cluster Services"
http://support.microsoft.com/kb/250355/
thanks,
--
/*
Warren Brunk - MCITP - SQL 2005, MCDBA
www.techintsolutions.com
*/
"djc" <noone@.nowhere.com> wrote in message
news:ezYIrdB3GHA.4228@.TK2MSFTNGP06.phx.gbl...
>I currently exclude the directories that contain the sql database files
>(mdf, ldf) from my antivirus 'real time protection' and scheduled sweep
>scans. Actually I do this for any database files (act, quickbooks, ms
>access) but I was recently thinking about this and I realized that I'm not
>really sure if its necessary?
> sticking with SQL server 2000/2005 since that is what this forum is for,
> is it true that I should be excluding these directories (the ones with the
> database and log files) from my antivirus software's protection?
> and just in case someone is also familiar with the needs of any of the
> other databases I mentioned, please feel free to comment on them as well.
> All those other systems are flat file based database systems. I don't know
> if that makes a difference with respect to antivirus software.
>|||thanks for the reply Warren. Are you refering to stability/corruption
effects or only performance effects? My main concern is if there may be
stability/corruption issues due to the antivirus, not performance. I could
gage the performance easily enough after making a change but its the
possible corruption and/or stability issues that my not be immediately
apparrent (and possibly realized to late!) that worry me. Does this change
anything? or is this still a per product issue that requires individual
testing? ...I'm always looking for that nice, simple, yet broad, rule thats
easy to remember : )
"Warren Brunk" <wbrunk@.techintsolutions.com> wrote in message
news:%23EaUchB3GHA.4312@.TK2MSFTNGP02.phx.gbl...
> Each AntiVirus software scans computers differently. To generally say
> that one wont affect your SQL server when anther might would be
> misleading.
> You should test scanning folders with your particular software to see it
> affects your SQL server. A decision should be made by the business owner
> as to whether scanning that directory is mandated or not.
> There are tons of known issues using Antivirus in a clutered envirnoment
> so special attention should be givin in this situation.
> here are two great articles...
> "Guidelines for choosing antivirus software to run on the computers that
> are running SQL Server"
> http://support.microsoft.com/?kbid=309422
> "Antivirus Software May Cause Problems with Cluster Services"
> http://support.microsoft.com/kb/250355/
> thanks,
> --
> /*
> Warren Brunk - MCITP - SQL 2005, MCDBA
> www.techintsolutions.com
> */
>
> "djc" <noone@.nowhere.com> wrote in message
> news:ezYIrdB3GHA.4228@.TK2MSFTNGP06.phx.gbl...
>|||I am referring to both stability, performance and security. Installing
AntiVirus on a SQL server increases surface area which has security risks.
But what I am really trying to say is you need to test it with your
particular anti virus software. For me, I dont want anything actively
scanning my SQL server files for a thousand reasons. Antivirus software can
certainly create a bottleneck due to the program requiring too much CPU
time -- especially if the server is also running an e-mail server or program
that requires a lot of antivirus resources (not necessarily a best
practice). It can also create file I/O problems if real-time scanning is
enabled for all files that are opened. I definitely recommend running
malware protection on a SQL Server (or any database server for that matter),
but be sure to exclude your database directories (or specific database
files) from the real-time protection if you can. Also, keep an eye out on
processor utilization to make sure the malware protection is not eating up
all the resources.
I have seen countless forums on how AV software locks up your DB files and
put the database in Suspect Mode or causing SQL server to fail.
thanks,
/*
Warren Brunk - MCITP - SQL 2005, MCDBA
www.techintsolutions.com
*/
"djc" <noone@.nowhere.com> wrote in message
news:%23QtRDrB3GHA.4484@.TK2MSFTNGP02.phx.gbl...
> thanks for the reply Warren. Are you refering to stability/corruption
> effects or only performance effects? My main concern is if there may be
> stability/corruption issues due to the antivirus, not performance. I could
> gage the performance easily enough after making a change but its the
> possible corruption and/or stability issues that my not be immediately
> apparrent (and possibly realized to late!) that worry me. Does this change
> anything? or is this still a per product issue that requires individual
> testing? ...I'm always looking for that nice, simple, yet broad, rule
> thats easy to remember : )
> "Warren Brunk" <wbrunk@.techintsolutions.com> wrote in message
> news:%23EaUchB3GHA.4312@.TK2MSFTNGP02.phx.gbl...
>

AntiVirus Software

We have McAfee VirusScan installed on our database server. I would like to
configure the system not to scan *.bak, *.mdf, *.ldf. My question:
1. Is this the right configuration ?
2. By doing so, any potential security breach ?
3. By doing so, will the SQL box performance improve a bit?
Furthermore, we will have a new clustered SQL insatlled later on in our data
center, any recommendation on antiVirus configuration on SAN ?
Much appreciated.Hi
By not allowing the file extensions to be scanned will mean any file in any
directory will be able to have this extension, you may want to look at
excluding by directory, which if would leave less possibilities for a rogue
file if your permissions are tight enough, a combination of both would be
even tighter!!.
You may want to run MBSA to see if it recomends anything to be improved.
http://support.microsoft.com/defaul...kb;en-us;309422 also
recommends .ndf files but database files can have any extension name so make
sure that any database file extension is included in an exclude list. The
article also gives recommendations for SAN discs.
Make sure that your database do not have the autoclose property set.
If you have full text searching then you should look at not scanning
"C:\Program Files\Microsoft SQL Server\MSSQL\FTData"
A-V software can cause problems such as
http://support.microsoft.com/defaul...kb;en-us;170338
The performance effect of the a-v software will depend to some extent on the
hardware you are running, make sure that when it is running it is not too
resource hungry and your disc have not become a bottleneck.
John
"Lan" <Lan@.discussions.microsoft.com> wrote in message
news:AAF5085D-DF64-4E0E-A4F2-7C34D0AC468F@.microsoft.com...
> We have McAfee VirusScan installed on our database server. I would like to
> configure the system not to scan *.bak, *.mdf, *.ldf. My question:
> 1. Is this the right configuration ?
> 2. By doing so, any potential security breach ?
> 3. By doing so, will the SQL box performance improve a bit?
> Furthermore, we will have a new clustered SQL insatlled later on in our
> data
> center, any recommendation on antiVirus configuration on SAN ?
> Much appreciated.|||Most anti-virus products will allow you to bypass the scanning of specific
directories.You can selectively disallow the scanning of the data file and
transaction log directories.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"Lan" <Lan@.discussions.microsoft.com> wrote in message
news:AAF5085D-DF64-4E0E-A4F2-7C34D0AC468F@.microsoft.com...
> We have McAfee VirusScan installed on our database server. I would like to
> configure the system not to scan *.bak, *.mdf, *.ldf. My question:
> 1. Is this the right configuration ?
> 2. By doing so, any potential security breach ?
> 3. By doing so, will the SQL box performance improve a bit?
> Furthermore, we will have a new clustered SQL insatlled later on in our
> data
> center, any recommendation on antiVirus configuration on SAN ?
> Much appreciated.|||I don't know what type of virus McAfee would be looking for in a mdf or ldf
file. If it scans the entire GB sized files from top to bottom while
referncing every possible virus signature pattern, it would result in a lot
of wasted I/O, CPU cycles, and possibly locking issues.
First make sure you have installed the version specifically designed to run
on a server. Also, it may only be prudent to have it scan only those file
types typically infected by viruses.
"Lan" <Lan@.discussions.microsoft.com> wrote in message
news:AAF5085D-DF64-4E0E-A4F2-7C34D0AC468F@.microsoft.com...
> We have McAfee VirusScan installed on our database server. I would like to
> configure the system not to scan *.bak, *.mdf, *.ldf. My question:
> 1. Is this the right configuration ?
> 2. By doing so, any potential security breach ?
> 3. By doing so, will the SQL box performance improve a bit?
> Furthermore, we will have a new clustered SQL insatlled later on in our
> data
> center, any recommendation on antiVirus configuration on SAN ?
> Much appreciated.|||On Fri, 30 Dec 2005 01:57:02 -0800, Lan <Lan@.discussions.microsoft.com> wrot
e:
in <AAF5085D-DF64-4E0E-A4F2-7C34D0AC468F@.microsoft.com>

>We have McAfee VirusScan installed on our database server. I would like to
>configure the system not to scan *.bak, *.mdf, *.ldf. My question:
>1. Is this the right configuration ?
>2. By doing so, any potential security breach ?
>3. By doing so, will the SQL box performance improve a bit?
>Furthermore, we will have a new clustered SQL insatlled later on in our dat
a
>center, any recommendation on antiVirus configuration on SAN ?
>Much appreciated.
I've found McAfee to be about the worst choice for anti virus, especially on
a
server. It's bloated, heavy handed, and almost amateurish in its ability to
discriminate between what constitutes a threat and what doesn't.
For ease of use, small footprint, and utter effectiveness have a look at AVG
.
Although I'm disheartened by the fact that they've been acquired by microsof
t,
it's been almost a year now and I haven't seen any overtly negative changes
yet.
Stefan Berglund

Anti Virus scanning and database files

Does Microsoft have an official position on excluding MDF/LDF files from
virus scanning? I searched the KBs but couldnt come up with anything.
Thanks.Neil W. wrote:
> Does Microsoft have an official position on excluding MDF/LDF files
> from virus scanning? I searched the KBs but couldnt come up with
> anything.
You can refer to this kb article
http://support.microsoft.com/kb/309422/en-us
Usually I exclude SQL Server data files from scanning...

> Thanks.
Bye
Luca Bianchi
Microsoft MVP - SQL Server
http://mvp.support.microsoft.com