I have been to some IT departments where the standard procedure is to install antivirus/antispyware software on all servers, no matter what applications are running on it. In addition, the default settings are left untouched, which means that virtually every byte of data is examined, in real time, before it is read or written to disk. This virus checking is in addition to any regularly scheduled scans of most of the files on the server’s drives.
If you have ever examined the amount of memory, CPU, and disk I/O resources used by antivirus/antispyware software, you will know that it is a performance hog and, on a busy SQL Server, can cause huge performance issues for your users.
So what do you do? Depending on your situation, you have one of three options:
- Run the AV software using its default settings, and buy big enough hardware to overcome any resource contention issues.
- Remove the AV software entirely, but take other measures to help ensure that viruses can’t affect your server.
- Compromise. Some DBAs remove the AV software from their SQL Servers, but remotely scan it from another server on a scheduled basis, and during a time when the server is not too busy. Other DBAs leave the AV software on their SQL Servers, but change the default settings so that the scans exclude .mdf, .ldf, .ndf, .bak, .trn, full-text catalog files, and any folders that include Analysis Services data.
If your SQL Server is running on a web server that is accessible from the Internet, then the first option might be the right choice. If your SQL Server is running on a closed network, then the second option might work fine. If your SQL Server is in a mixed environment, combined with other servers and end-users connected to the same network, then the third option might be best.
So, here’s my question to you. Have you given any serious thought as to the level of antivirus/antispyware protection you need for your SQL Server instances, and to the performance implications of the strategy you have chosen? If you have, tell us what you have done, and why you have made the choices you did.
Brad M McGehee
Director of DBA Education
Red Gate Software
