What AV are you using on your servers

Forums › IT Pro and developers › What AV are you using on your servers

gjm

808 posts

Ultimate Geek

#73028 7-Dec-2010 16:29

Hey guys, I about to do a little review project for the Anti virus software on our servers and wanted to see what other people were using and if they could recommend it. We are currently using TrendMicro which seems to be doing an ok job. I have used Symantec and McAfee in the past and have had game (server) stopping issues with both of them so am steering well clear of those 2. Other than that....any suggestions or recommendations?

NB: Windows Platform, 32 and 64 bit, needs to be centrally managable

Do surveys for Beer money (referral link) - Octopus Group

Link for buying beer (not affiliated, just like beer) - Good George

sampler

445 posts

Ultimate Geek

ID Verified

Trusted

Lifetime subscriber

#414115 7-Dec-2010 16:35

Esets Nod32 when setup correctly is very effective

freitasm

BDFL - Memuneh
79273 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#414116 7-Dec-2010 16:39

What kind of server? Is this a file server, a database server, or a webserver?

I don't run anything on Geekzone. The volume of a) web traffic b) SQL updates c) outgoing emails could probably make the AV use up a few much needed CPU cycles...

I do have some quarantine procedures, and every few weeks run a full scan using HouseCall - which is not a resident software.

jaymz

1133 posts

Uber Geek

#414121 7-Dec-2010 16:48

We use NOD32 as well, no major issues, we did spend a lot time testing the configurations though.

@freitasm - You may be interested in an article I read recently. http://www.tomshardware.com/reviews/anti-virus-virus-scanner-performance,2777-6.html

It refers to desktops, but it is quite surprising to see how little impact some AV has on some systems.

Not saying you should run AV, but it makes for a interesting read!

freitasm

BDFL - Memuneh
79273 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#414122 7-Dec-2010 16:49

Yes, I read that when it came out. I actually spend 2/3 of the day reading stuff. My RSS feed list is loooong.

gjm

808 posts

Ultimate Geek

#414124 7-Dec-2010 16:51

freitasm: What kind of server? Is this a file server, a database server, or a webserver?

yes to all the above.....

we have quite a few servers all doing different things i.e. multiple file / print servers, SQL servers, Exchange, Management(Backup, Monitoring etc) and a few other things beside.

Been reading a bit about NOD and they reckon they have quite a small footprint in terms of hogging system resources. Any comment on that from anyone?

Do surveys for Beer money (referral link) - Octopus Group

Link for buying beer (not affiliated, just like beer) - Good George

AndrewTD

292 posts

Ultimate Geek

Trusted

Lifetime subscriber

#414127 7-Dec-2010 17:01

We use Symantec AV on all the Windows servers we support for our clients.
It works well enough overall to keep us and our clients happy.

kind regards Andrew TD

CYaBro

4584 posts

Uber Geek

ID Verified

Trusted

#414138 7-Dec-2010 17:25

Have used most of the AV products over the years but have been using Eset NOD32 for about 5-6 years now and haven't had the need to look elsewhere.
It is easy to setup and configure, managing licenses etc is easy and the local distributor, Chillisoft, are very knowledgable and helpful if you ever need anything or have a problem.

Opinions are my own and not the views of my employer.

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

Regs

4066 posts

Uber Geek

Trusted

Snowflake

#414333 7-Dec-2010 22:31

i've had massive problems with several a/v products on servers with clients.

one client had AVG installed. their disk write I/O's were dropped by a factor of 15 for writes and halved for reads when AVG was installed, but not running. It wasnt until we removed it completely that performance recovered.

another client had problems running CRM and SharePoint and other sites which make heavy use of javascript with McAfee. McAfee has a javascript scanning engine that brings client computers to their knees. In later versions there is a 'whitelist' ability which helps somewhat letting you bypass javascript scanning for specified URLs.

more problems were had at yet another site, this time with ESET NOD. On this specific SQL Server, we could not get the CPU usage to peak any higher than 10% and data imports were running at 1 record per second with NOD installed. Once we removed NOD, the data imports ran at 80 records per second.

my recommendation to clients is now that we do not investigate causes for performance issues until the first step of uninstalling antivirus has been taken.

i personally dont see the need for antivirus on application servers if you:
* firewall server properly
* prevent removeable media from being attached
* block internet browsing directly on the server
Along with this you should also:
* run malware/antivirus on the clients - but configure URL whitelists and directory exceptions as required
* run av/malware detection at the firewall/perimeter
* run a/v on the the mail gateway

it can also help speed up clients to disable realtime virus scanning on all but removeable disks.

Sales Engineer
Snowflake
www.snowflake.com

about.me/nzregs
Twitter: @nzregs

quandum

204 posts

Master Geek

#414341 7-Dec-2010 22:45

gjm: Hey guys, I about to do a little review project for the Anti virus software on our servers and wanted to see what other people were using and if they could recommend it. We are currently using TrendMicro which seems to be doing an ok job. I have used Symantec and McAfee in the past and have had game (server) stopping issues with both of them so am steering well clear of those 2. Other than that....any suggestions or recommendations?

NB: Windows Platform, 32 and 64 bit, needs to be centrally managable

We use forefront across our 8000 or so servers that are mostly highly virtualized. :-) Seems to work well.

I would love to change the world, but they won't give me the source code

#BOFH

gjm

808 posts

Ultimate Geek

#414421 8-Dec-2010 08:37

thanks for the feedback guys. While our gateways/border is heavily secured with multiple products it is still part of our layered defense to run AV on all servers so not having it isnt an option at this point. So far every product Ive looked at has good and bad stories about it although havent done much research into forefront yet so may check it out.

Cheers

Do surveys for Beer money (referral link) - Octopus Group

Link for buying beer (not affiliated, just like beer) - Good George

Regs

4066 posts

Uber Geek

Trusted

Snowflake

#414487 8-Dec-2010 10:26

gjm: thanks for the feedback guys. While our gateways/border is heavily secured with multiple products it is still part of our layered defense to run AV on all servers so not having it isnt an option at this point. So far every product Ive looked at has good and bad stories about it although havent done much research into forefront yet so may check it out.

Cheers

i havent run into any problems with forefront yet, and given that microsoft are delivering it you would *hope* that they do some testing against their products like SQL, Exchange, SharePoint, CRM and ERP to ensure there are no negative impacts.... but i wouldnt hold my breath :)

When i get a chance i might deploy it (forefront) to a crm and sql server and run the performance profile tests before/after to see what impact there is. It wont be for a few weeks though..

Sales Engineer
Snowflake
www.snowflake.com

about.me/nzregs
Twitter: @nzregs

gjm

808 posts

Ultimate Geek

#414517 8-Dec-2010 10:54

I did use antigen a few years ago and it got a large "fail" in my books. Is forefront a different product or just antigen evolved?

Do surveys for Beer money (referral link) - Octopus Group

Link for buying beer (not affiliated, just like beer) - Good George

Ragnor

8220 posts

Uber Geek

Trusted

#414534 8-Dec-2010 11:04

By the time you exclude all the folders and files you need to for avoiding performance and other issues (SQL Server, IIS etc) you have to wonder if it makes sense to run real time active AV on servers.

Scheduled scans for low usage times might be the better option.

ieatservers

73 posts

Master Geek

#423866 4-Jan-2011 03:54

ESET NOD32 Antivirus 4 Business Edition is installed in a lot of our Windows Server 2008/R2 servers.

michaelmurfy

meow
13243 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#423870 4-Jan-2011 05:21

Linux for me on all my servers - so None.

Any Windows Server I just recommend making sure it's firewalled off, only announcing the services needed on the internet + make sure these are fully patched and upgraded (Don't go using insecure and buggy software on production servers) and things should be fine.

I have not used Windows for years, but I do say to everyone - common sense is better than any Antivirus Product out there.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.