Id like to know how can i masure the latency that the move av add to my envirment?
I also have av for storage and from the storage monitor (graphana) i can see the latency that the av for storage add to my envirment.
I am talking about in general within MOVE we do not have any tool that can give you performance related data. If you want to know the latency, you have to see with and without MOVE what is the time difference while performing a job. If there are some additional load given by MOVE then we can look at it from the MOVE log side what is the reason for the same.
Hi, for MP, possibly have a look at the mvadm stats cmd - https://docs.mcafee.com/bundle/move-antivirus-4.8.0-server-command-line-interface-reference-guide/pa...
Look at the av request response time.
For both MOVE AGL and MP, exclusion tuning is important. Schedule and use the top 10 report to ensure your exclusion policy is accurate
Open an admin cli, and call "mvadm stats" - check what value is reported
Avg request process time: = example 0.045183 sec
Ideally this should be well under 0.1 s
Check the heartbeat count - this indicates the number of connected clients and check the loads are balanced across all SVM.
Check the threat report in ePO for scan timeouts from MOVE, and adjust exclusions accordingly.
thank you very much.
i check my move server and the Avg request process time is less 0.1 s.
i have 2 question plz:
1) when i check inside my av for storage server the Avg request process time is between 0.4 to 0.7
is that ok? what is is ideally time?
2) if i have a 50,000 scan request per hour how much scan server do i need?
Hi, for the question " I have 50,000 scan request per hour how much scan server do i need?"
If you run the mvadm stats command on the SVM and look at the output, are most of these chksum lookups, or are they requiring substantial numbers of file transfers to take place?
Have a look at the number of idle scan threads reported also. This should be close to the total scan threads value. If it is much lower it suggests scans are starting to queue.
50k scans in an hour equates to around 14 per second, which should be fine, but I would assume there are peaks and troughs during this hour so would check the host performance stats for network traffic and CPU usage
Also, if you open resource monitor on the SVM and look at the CPU / network utilization figures associated with the move server process what do you see ?
If you are using TIE, then look at the TIE av response time per req also, as well as the total Tie requests.
I would also schedule the ePO "top 10" client task on the SVM and review the output to confirm exclusion policies are appropriate.