SQL Clone
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


sqlservr.exe process increase CPU when antivirus is enabled


sqlservr.exe process increase CPU when antivirus is enabled

Author
Message
pgrassin
pgrassin
Forum Newbie
Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)

Group: General Forum Members
Points: 2 Visits: 13
Hi,
This is the first time I add a topic here, but I recieve the SQLserverCentral Newsletter every week and find some topics very interesting. Thanks.

So I have the following issue on a SQL 2000 server protected by McAfee antivirus.
When McAfee is disabled, sqlserver.exe process uses less than 10% of the CPU
When I enabled McAfee, sqlserver.exe process jumps to about 60% of the CPU
It slows down the t-sql queries and some sql clients get timeout that affect client applications.

I opened a ticket to McAfee, but get no answer expected to install the last version. That is done but the issue remains.

Here are the McAfee exclusions:
BAK, LDF, MDF,NDF,TRN files
C:\Program Files\CA\
C:\Program Files\Microsoft SQL Server\MSSQL\BACKUP and subfolders
C:\Program Files\Microsoft SQL Server\MSSQL\Binn and subfolders
C:\Program Files\Microsoft SQL Server\MSSQL\Data and subfolders
C:\Program Files\Microsoft SQL Server\MSSQL\FTData and subfolders
D:\BACKUP and subfolders
D:\MSLSQL\Data and subfolders
D:\Tracability Manager and subfolders (databases are located in this directory)

Here are the McAfee Low Risk Process:
Aexauditpls.exe
Aexnsclient.exe
Aexnsclienttransport.exe
Aexnswdusr.exe
Agentsvr (SQL Agent)
Sqlservr.exe
UnivAgent.exe

Configuration
Windows Server 2003 Standard Edition SP2 – intel Xeon 2 CPU 3,06GHz 4GO RAM (3GB swith)
SQL 2000 SP4
McAfee VirusScan Entreprise 8.7.0i

If someone has an idea ??

Pierre
Joie Andrew
Joie Andrew
SSCrazy
SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)

Group: General Forum Members
Points: 2315 Visits: 2032
Not sure. I know we used to see a lot of contention of resources and file handles with Symantec, but I believe there were some exclusions that were left out.

What happens if you try and exclude the entire c:\program files\Microsoft SQL Server directory?

Are there any database files that are not in the default locations that McAfee could be trying to scan?

Joie Andrew
"Since 1982"
pgrassin
pgrassin
Forum Newbie
Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)Forum Newbie (2 reputation)

Group: General Forum Members
Points: 2 Visits: 13
Thanks for your answer Joie,
I tried to exclude all drives of the server. I saw that McAfee didn't scan anything and the CPU usage of sqlservr.exe increased up to 60%... It seems that the issue is not related to scanning operations.

Pierre
Gianluca Sartori
Gianluca Sartori
SSCrazy Eights
SSCrazy Eights (9.9K reputation)SSCrazy Eights (9.9K reputation)SSCrazy Eights (9.9K reputation)SSCrazy Eights (9.9K reputation)SSCrazy Eights (9.9K reputation)SSCrazy Eights (9.9K reputation)SSCrazy Eights (9.9K reputation)SSCrazy Eights (9.9K reputation)

Group: General Forum Members
Points: 9868 Visits: 13350
My two cents: I wouldn't install an antivirus on a production server. I would rather perform a remote scan from another machine.

--Gianluca Sartori

How to post T-SQL questions
spaghettidba.com
@spaghettidba
Joie Andrew
Joie Andrew
SSCrazy
SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)SSCrazy (2.3K reputation)

Group: General Forum Members
Points: 2315 Visits: 2032
That is an option, but I know a lot of environments will not allow that because that negates any possibility of real-time protection.

Joie Andrew
"Since 1982"
omararbues
omararbues
Forum Newbie
Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)

Group: General Forum Members
Points: 1 Visits: 0
This article may be of assistance to you.

http://sysadminops.blogspot.com/2011/10/how-to-exclude-processes-from-virus.html
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search