Surebackup A/V scan extremely slow

[cgsm]

@Gostev Yes, I have opened a case and am awaiting a reply. Thanks.

I just cannot find a way to utilize the malware checking, not that I need it, based on the length of time it takes to complete on my relatively small number of VMs and total size. I would like to use it, to confirm my backups are malware free...

[Matt.Sharpe]

Has this yet been reviewed and on the roadmap? Parallel AV scanning?

Large infrastructures want to use this feature, but the long run time of a sequential malware scan with Defender is a put off...

[cgsm]

I do not think there is a way around it. Defender (MpCmdRun.exe) can only run one "-File" scan (in this case, a VM disk file) at a time.

If I have Defender running and scanning a VM via Veeam and I try to run MpCmdRun.exe manually against any other file, it exits immediately with "Scan finished". A more helpful exit code like "you can only run one -File scan at a time" would be nice from MSFT.

I do agree, it does suck and really limits the usability of SureBackup's malware scan feature. As of now, I just have a bunch of SureBackup jobs, each targeting a different Application Group with a single VM assigned, that run once a week or month based on the size of the VM and how long it takes to scan. Some VMs I don't scan at all because it takes sooooo long.

I haven't tried any other malware scanners to see if they perform in parallel.

Also, with Defender, you have to configure with Set-MpPreference to prevent updates from installing during scans. Definition updates will stop any running scans thus causing SureBackup to report a failure. See SignatureScheduleDay, SignatureScheduleTime, SignatureUpdateCatchupInterval, SignatureUpdateInterval.

[Dima P.]

Hello folks,

Thank you for your feedback!

Has this yet been reviewed and on the roadmap?

We have planned some improvements for the AV scan functionality for the upcoming versions. Stay tuned for product updates and announcements.

Parallel AV scanning?

We leverage the functionality provided by the AV vendor and they mostly do provide single scan job at a time. There is a possibility to overcome this limitation - since the backup is mounted to the mount host for a AV scan you can perform verification for backups from different repositories at the same time - just need to make sure that mount host is different for each repository with the backup.