https://community.splunk.com/t5/Getting-Data-In/What-do-I-need-to-do-to-run-Anti-Virus-software-with-Splunk-on/m-p/77386#M15854 <P>Correct - <A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/ReleaseNotes/RunningSplunkalongsideWindowsantivirusproducts">https://docs.splunk.com/Documentation/Splunk/7.2.3/ReleaseNotes/RunningSplunkalongsideWindowsantivirusproducts</A> </P> Mon, 14 Jan 2019 21:22:23 GMT jaxjohnny2000 2019-01-14T21:22:23Z https://community.splunk.com/t5/Getting-Data-In/What-do-I-need-to-do-to-run-Anti-Virus-software-with-Splunk-on/m-p/77384#M15852 <P>I am running Splunk and want to run Anti Virus with it.</P> Tue, 26 Oct 2010 01:25:27 GMT https://community.splunk.com/t5/Getting-Data-In/What-do-I-need-to-do-to-run-Anti-Virus-software-with-Splunk-on/m-p/77384#M15852 Simeon 2010-10-26T01:25:27Z https://community.splunk.com/t5/Getting-Data-In/What-do-I-need-to-do-to-run-Anti-Virus-software-with-Splunk-on/m-p/77385#M15853 <P>Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.</P> <P>The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:</P> <PRE><CODE><A href="http://support.microsoft.com/kb/309422" target="test_blank">http://support.microsoft.com/kb/309422</A> <A href="http://support.microsoft.com/kb/822158" target="test_blank">http://support.microsoft.com/kb/822158</A> <A href="http://technet.microsoft.com/en-us/library/bb332342.aspx" target="test_blank">http://technet.microsoft.com/en-us/library/bb332342.aspx</A> <A href="http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848" target="test_blank">http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848</A> </CODE></PRE> <P>My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.</P> <P>I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.</P> Tue, 26 Oct 2010 01:28:11 GMT https://community.splunk.com/t5/Getting-Data-In/What-do-I-need-to-do-to-run-Anti-Virus-software-with-Splunk-on/m-p/77385#M15853 araitz 2010-10-26T01:28:11Z https://community.splunk.com/t5/Getting-Data-In/What-do-I-need-to-do-to-run-Anti-Virus-software-with-Splunk-on/m-p/77386#M15854 <P>Correct - <A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/ReleaseNotes/RunningSplunkalongsideWindowsantivirusproducts">https://docs.splunk.com/Documentation/Splunk/7.2.3/ReleaseNotes/RunningSplunkalongsideWindowsantivirusproducts</A> </P> Mon, 14 Jan 2019 21:22:23 GMT https://community.splunk.com/t5/Getting-Data-In/What-do-I-need-to-do-to-run-Anti-Virus-software-with-Splunk-on/m-p/77386#M15854 jaxjohnny2000 2019-01-14T21:22:23Z