Poor performance while virus scanner is active

[joeragan_anom]

Hi !

I have one FAS2020 filer with SATA disks which almost 1 year-old. I also installed one antivirus server running TrendMicro ServerProtect for NetApp filer v5.8. Within the last 3 months, there has been 3 incidents that users were experiencing poor performance while accessing files. I found out that this was caused by the antivirus process, if I turned off the vscan function then the performance returned to normal. When the first incident happened, I restarted the antivirus server but it did not help. After the second incident, I built another antivirus server and it was working fine until the third incident happened last week.

Does anyone have any idea as to the possible root cause of these incidents? At the moment I turned the vscan off but I am worry about virus outbreak if I keep it off.

Regards,

[ekashpureff]

Root cause - more load on your CIFS shares as traffic has grown.

There's a lot of information to be looked at:

CPU load on the scanning servers.

Network bandwidth on connection to scanning servers.

Current load on the filer (CPU, Disk, cache).

Have you set 'vscan extensions include/exclude' to avoid scanning files that aren't likely to be a threat ?

Have you considered implementing '-novscanread' on shares deamed to be clean ?

At your service,

Eugene Kashpureff