Getting Data In

What do I need to do to run Anti Virus software with Splunk on Windows?

Simeon
Splunk Employee
Splunk Employee

I am running Splunk and want to run Anti Virus with it.

Tags (2)
1 Solution

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...