I would appreciate any assistance you can provide me. We have a new install of Orchestrator 5.1.0, Viruscan Enterprise 8.8.0, and VSES 1.1.0. The hardware we are using is a Dell FS8600 filer in front of SC8000 NAS storage. This is a new installation so the FS8600 and VSES servers are not in production yet. During testing we are finding VERY poor performance on small files. Performing a copy of several thousand small files will take hours to complete. Approximately 6500 files which total 80MB in size will take hours to copy while 2 of files of 40MB in size a piece takes mere seconds.
The two 2008R2 scanning servers are VMs with 4 cores and 8 GB of ram. I understand that's against best practice, but this is just early testing with a single ICAP client/server & single machine pulling files. The scanning servers are only averaging approximately 80-100 files per minute and 1 or 2 scanning threads. That ICAP statistics show sub 5 ms average scan times but approximate 500 ms average request times. (I'm not entirely clear what the "average request time" statistic is really showing. Windows performance monitors on those servers and the FS8600's performance monitors don't reveal any bottlenecks.
Sorry, but I must have given the wrong impression. It's only using 1 or 2 threads. They are set to the 100 thread default.
I've opened a ticket with McAfee. If they help me resolve this problem, I will post the solution here.
Thanks for your help.
tselliott, did you get a resolution on that one? sounds like an interesting challenge and I wouldn't mind checking my systems to make sure they perform as best they can.
No, we have not found an answer to this problem yet. It's been very frustrating due to the amount of time, money, and work involved with these products. We've also had Dell/Compellent support assisting us. Part of the problem is the lack of information. I've been unable to get either Dell or McAfee to provide any sort of performance metrics that we should be able to achieve. This is high end storage on 10gbps networks utilizing scanning servers that exceed all of McAfee's requirements.
Currently, we're waiting for someone from McAfee's tier 3 support to contact us. Dell has said that they were in the process of obtaining the Symantec equivalent software for test/comparison purposes.
The problem appears to be the "access time" as reported by McAfee's ICAP statistics. Regardless of the file size (below 1MB anyway) the average scan time is below 10ms per file but the average "access time" runs 400-600ms. Half a second per file really adds up when you're copying thousands of files. Example: 10000 files only totaling 50-100MB in size will take 80-90 minutes to copy. That's unacceptable.
If there's anything else you would like to know, please feel free to contact me. I'd also like to hear any information you can provide.
Any update on this? We are trying to bring an Isilon Cluster to production and I am very concerned about the ICAP servers being a bottleneck. There is almost no documentation in reference to Isilon it's mostly Oracle and NetApp.