Getting Data In

What do I need to do to run Anti Virus software with Splunk on Windows?

Simeon
Splunk Employee
Splunk Employee

I am running Splunk and want to run Anti Virus with it.

Tags (2)
1 Solution

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Because Splunk index and search does a lot of IO/CPU/Memory/Network, most anti-virus software will suspect that Splunk is malware on indexers and search heads.

The mainstream solution to this problem is also the simplest one, namely to exclude directories and processes of applications that perform heavy lifting from virus scans:

http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/822158
http://technet.microsoft.com/en-us/library/bb332342.aspx
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2002092413394848

My recommendation is that the directory “$SPLUNK_HOME/var” (as well as any alternate $SPLUNK_DB locations) and the processes splunkd.exe, splunk-search.exe and splunk-optimize.exe should be excluded from file and real-time scanning on any servers that do indexing and search.

I do not think that forwarders present a problem given that there is little to no indexing performed locally, and I haven’t heard of many customers who are primarily using Splunk as a forwarder rather than an indexer on Windows platforms bringing A/V problems to support.

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...