Getting Data In

What do I need to do to run Anti Virus software with Splunk on Windows?

Simeon
Splunk Employee
Splunk Employee

I am running Splunk and want to run Anti Virus with it.

Tags (2)
1 Solution

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...