Recommended Antivirus Exclusions

Overview

It is important to achieve a balance between ensuring a secure and virus-free server environment, while not interfering with the reliability and performance of each server/application. Virus scanning is often a cause of performance issues, as lack of properly configured anti-virus exclusions may cause outages of applications and services due to contention or file locking. Additionally most Virus scanning engines include Real Time scanning of some type enabled as a default profile. This may introduce performance issues or possible job failures during normal backup, restore and other CommVault actions.

Example: The AV software may lock the collect files generated during a backup job.

This document covers the required directories to be excluded from Antivirus scanning.

 
  1. CommCell performance on backup jobs and unknown backup failures may be due to Host-based Intrusion Prevention Systems (HIPS).
  2. If you experience performance and consistency issues with SQL server when certain modules are loaded into the server, see Microsoft KB 2033238.

Solution

To avoid issues introduced by Anti-Virus software, we recommend you to implement exclusions for the directory structures from read, write and scan options depending on the company policies.

The information provided is not a complete list of exclusions as the product may change with updates, versions and/or innovation to existing or new software modules. It is recommended to test the functions of the software's features and monitor the processes and how they interact with Anti-Virus software during normal operations and work with the AV vendor to achieve proper configuration and tuning of the AV software. The goal is to allow normal backup/restore operations so that the rules and schedules for the AV operations do not interfere, impede or prevent successful backup.

 
  1. Make sure that the Anti-Virus scans are not scheduled during backup operations.
  2. Make sure that the onDemand Anti-Virus scans are not run during backup operations.

List of Exclusions

Make sure that the following installation paths are excluded.

CommServe, MediaAgent and Client iDataAgent

Software Install Path

*:\Program Files\CommVault\Simpana\**

Path to Job Results Folder

Exclude the job results folder, if it is different from the default path.

Example: C:\jobresults\**

Path to Index CacheFolder

Exclude the index cache folder, if it is different from the default path.

Example: H:\IndexCache\**

Processes

For all the processes listed, the names may be truncated to 15 characters for legacy operating systems and Anti-Virus applications to work properly. Contact the OS or Anti-Virus vendor to understand about their software limitations.

You can view the Services installed by the Software using the following links:

Version 10.0 Services

Version 9.0 Services

Version 8.0 Services

Base Client

All systems within a CommCell have the following processes installed. These processes are used for Data Protection operations.

The following processes are unique to the CommCell components type under which they are listed.

Active Directory iDataAgent

 CDRVSSEnabler

CommCell Console

CommNet Browser

CommNet Server

CommServe

Content Indexing Server

Data Classification

DB2

Database Upgrade

DM2 Web Client

DM2 Web Service

Documentum

Driver for File System Data Migrator

Exchange iDataAgent

Exchange Database

Exchange Data Migrator

Exchange Data Migrator Client

Exchange Data Migrator Web Proxy

Exchange Mailbox

Exchange Public Folder

Exchange Public Folder Data Migrator

Exchange Web Folder

External Data Connector

CVEDCPrepare.exe

FLR

File System iDataAgent

File System NDMP Enabler

CVNRDS.exe

License Lookup Admin

License Server

License Web App

License Web Service

Lotus Notes Database

Lotus Notes Data Migrator

Lotus Notes Data Migrator Client

Lotus Notes Document

MediaAgent

Media Explorer

SQL

MySQL

NAS NDMP

CVNdmpRemoteServer.exe

Network Storage Data Migrator Client

Offline Mining Exchange Database End-User

1-Touch Client Binaries Folder

Oracle iDataAgent

Outlook Web Access Proxy Enabler

Pre-Post Install

PrePostInstall.exe

Primary Content Indexing for Exchange

Primary Content Indexing

CvRMSDecryptor.exe

Proxy Host

Proxy Host Image Level

CVVICleanup.exe

Replication

Resource Pack

Resource Pack Internal use

Resource Pack Limited use

Root of CPU Folder

SAP

SAPMaxDB

SharePoint Data Migrator

SharePoint V2 Document

SnapVault Open Systems Enabler

Software Snapshot

QST2.exe

SRM Exchange Agent

SRM File System Agent

SRM NAS Agent

SRM Netware Proxy Agent

SRMNetWareAgent.exe

SRM Oracle Agent

SRMOracleAgent.exe

SRM Server

SRM SharePoint Agent

SRM SQL Agent

SRMSQLServerAgent.exe

Sybase Agent

System Recovery Server

Test Automation

DriverProgram.exe

Update System

UpdateSystem.exe

Virtual Server iDataAgent

VSS Enabler

bcdcopy.exe

WinImage

Work Station Backup

Additional MediaAgent Paths

For Magnetic Libraries:

*:\CV_MAGNETIC\**

For Deduplication Data Bases: Get the location from the GUI, on the Copy Properties dialog box of the primary copy.

Additional Information

There may be several folders that may be moved outside the software default installation directory.

CommServe, MediaAgent and Client iDataAgent

UpdatesCache folder with subfolders CVPackages and CVUpdates

Default Path

C:\Program Files\bull\Calypso\SoftwareCache

CommServe

DR Backupset Directories

Default Path

C:\Program Files\bull\CS_DR

MediaAgent

Index cache folder

Default Path

C:\Program Files\bull\Calypso\IndexCache

Job Results Directory

Default Path

C:\Program Files\bull\Calypso\iDataAgent\JobResults

Client iDataAgent

Job Results Directory

Default Path

C:\Program Files\bull\Calypso\iDataAgent\JobResults

  Note that the 7z.exe, zip.exe, unzip.exe, javaw.exe and the Java Program Files folders are used by CommCell Console on the CommServe, CommCell Console Web GUI, Content Indexing and Search and any workstations accessing the Stand Alone Console or the Web GUI. If these executables and folders are scanned by Anti-Virus software, it may cause some issues with the Console GUI.

External References

  1. For Microsoft recommendations on AntiVirus exclusion for current operating systems, refer to Microsoft KB article 822158.
  2. For standard Microsoft recommendations for Servers running SQL Server, see Microsoft KB article 309422.
  3. For more information on issues caused by Antivirus software on Cluster Services that are not cluster aware, refer to Microsoft KB article 250355.
  4. For more information on configuring and viewing FEP Group Policy settings, see Configuring and Viewing FEP Group Policy Settings.
  5. For more information on Symantec standard recommendations for Servers to create exceptions, see Creating Centralized Exceptions in Symantec Endpoint Protection Manager 11", Creating Centralized Exceptions in Symantec Endpoint Protection Manager 12.x, Creating Centralized Exceptions in Symantec Endpoint Protection Manager 12.1"
  6. For McAfee standard recommendations for Servers to create exceptions, see Virus Scan Enterprise exclusions (Master Article).
  7. For Sophos standard recommendations for Servers to create exceptions, see Recommended vendor exclusions for use with Sophos products, How to: Exclude items from scanning, Files and folder exclusions do not work.

DISCLAIMER

Implementing the anti-virus exclusions described in this document may increase the attack vulnerability risk to computers or network by malicious users or by malware or viruses. Before making these changes, it is recommended that the attack vulnerability risks that are associated with implementing these settings be evaluated. It is up to the discretion of the reader's and their company's policies whether to implement the guidelines recommended within this document.

Minor revisions and/or service packs that are released by application and operating system vendors are supported by our software. We will provide information on any known caveat for the revisions and/or service packs. In some cases, these revisions and/or service packs affect the working of our software. Changes to the behavior of our software resulting from an application or operating system revision/service pack may be beyond our control. The older releases of our software may not support the platforms supported in the current release. However, we will make every effort to correct the behavior in the current or future releases when necessary. Please contact your Software Provider for any problem with a specific application or operating system.

Additional considerations regarding minimum requirements and End of Life policies from application and operating system vendors are also applicable.