Getting Data In

What do I need to do to run Anti Virus software with Splunk on Windows?

Simeon
Splunk Employee
Splunk Employee

I am running Splunk and want to run Anti Virus with it.

Tags (2)
1 Solution

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...