Getting Data In

What do I need to do to run Anti Virus software with Splunk on Windows?

Simeon
Splunk Employee
Splunk Employee

I am running Splunk and want to run Anti Virus with it.

Tags (2)
1 Solution

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...