7 Replies Latest reply on Apr 14, 2015 10:10 AM by mpickard247

    VirusScan Enterprise for Storage

    tselliott

      Hello,

       

      I would appreciate any assistance you can provide me. We have a new install of Orchestrator 5.1.0, Viruscan Enterprise 8.8.0, and VSES 1.1.0. The hardware we are using is a Dell FS8600 filer in front of SC8000 NAS storage. This is a new installation so the FS8600 and VSES servers are not in production yet. During testing we are finding VERY poor performance on small files. Performing a copy of several thousand small files will take hours to complete. Approximately 6500 files which total 80MB in size will take hours to copy while 2 of files of 40MB in size a piece takes mere seconds.

       

      The two 2008R2 scanning servers are VMs with 4 cores and 8 GB of ram. I understand that's against best practice, but this is just early testing with a single ICAP client/server & single machine pulling files. The scanning servers are only averaging approximately 80-100 files per minute and 1 or 2 scanning threads. That ICAP statistics show sub 5 ms average scan times but approximate 500 ms average request times. (I'm not entirely clear what the "average request time" statistic is really showing. Windows performance monitors on those servers and the FS8600's performance monitors don't reveal any bottlenecks.

       

      Any ideas?

       

      Thank you,

      Tom

        • 1. Re: VirusScan Enterprise for Storage
          llamamecomoquieras

          Hi,

           

          How many filers do you have?

           

          Regards,

           

          Jose

          • 2. Re: VirusScan Enterprise for Storage
            tselliott

            One filer, Jose.

            • 3. Re: VirusScan Enterprise for Storage
              ansarias

              I'll suggest to increase AV scan threads value under Performance tab. As default value is 100.

              • 4. Re: VirusScan Enterprise for Storage
                tselliott

                Sorry, but I must have given the wrong impression. It's only using 1 or 2 threads. They are set to the 100 thread default.

                 

                I've opened a ticket with McAfee. If they help me resolve this problem, I will post the solution here.

                 

                Thanks for your help.

                • 5. Re: VirusScan Enterprise for Storage
                  gunnars

                  tselliott, did you get a resolution on that one? sounds like an interesting challenge and I wouldn't mind checking my systems to make sure they perform as best they can.

                  • 6. Re: VirusScan Enterprise for Storage
                    tselliott

                    Gunnars,

                     

                    No, we have not found an answer to this problem yet. It's been very frustrating due to the amount of time, money, and work involved with these products.  We've also had Dell/Compellent support assisting us. Part of the problem is the lack of information. I've been unable to get either Dell or McAfee to provide any sort of performance metrics that we should be able to achieve. This is high end storage on 10gbps networks utilizing scanning servers that exceed all of McAfee's requirements.

                     

                    Currently, we're waiting for someone from McAfee's tier 3 support to contact us. Dell has said that they were in the process of obtaining the Symantec equivalent software for test/comparison purposes.

                     

                    The problem appears to be the "access time" as reported by McAfee's ICAP statistics. Regardless of the file size (below 1MB anyway) the average scan time is below 10ms per file but the average "access time" runs 400-600ms. Half a second per file really adds up when you're copying thousands of files. Example: 10000 files only totaling 50-100MB in size will take 80-90 minutes to copy. That's unacceptable.

                     

                    If there's anything else you would like to know, please feel free to contact me.  I'd also like to hear any information you can provide.

                     

                    Thanks,

                    Tom

                    • 7. Re: VirusScan Enterprise for Storage
                      mpickard247

                      Any update on this?  We are trying to bring an Isilon Cluster to production and I am very concerned about the ICAP servers being a bottleneck.  There is almost no documentation in reference to Isilon it's mostly Oracle and NetApp.