Comprehensive data protection for all workloads
Post Reply
ned
Enthusiast
Posts: 25
Liked: 5 times
Joined: Dec 09, 2014 9:13 pm
Full Name: Ned Thomas
Contact:

Surebackup A/V scan extremely slow

Post by ned » May 15, 2020 6:00 pm

I'm running Surebackup with VBR v10 (P1), which is running fine. I'm now trying to leverage the A/V scan option using Microsoft Windows Defender. This works but is extremely slow. The Windows Defender scan runs sequentially - one VM at a time and only one volume at a time. This is a major bottleneck and basically makes it unusable in my current environment.

Is anyone leveraging Surebackup with the A/V option? What A/V tool are you using? Any recommendations in general to optimize this process?

Thanks, Ned


[ID# 04165665] Surebackup A/V scan slow and sequential one VM at a time
Back to My Cases
Product: Veeam Backup & Replication
Severity: 3
Opened: May 8, 2020 22:54
VBR v10 (P1), VMware ESXi 6.7u3, Windows 2016, Windows Defender A/V scanner
SOBRs on EMC VNX5700 hybrid storage array

HannesK
Veeam Software
Posts: 5439
Liked: 738 times
Joined: Sep 01, 2014 11:46 am
Location: Austria
Contact:

Re: Surebackup A/V scan extremely slow

Post by HannesK » May 18, 2020 5:54 am

Hello,
I could not find any information what you mean with "extremely slow" (5Mbyte/s, 100 MByte/s, whatever speed).

Did you test with parallel scan performance and did you see better values with parallel scanning?

There are several ways to test it
1) start multiple instant VM recoveries in parallel with secure restore
2) start multiple Windows file level recoveries in parallel and do manual parallel scans of c:\veeamflr\... (that's what I did)

I'm not sure whether parallel scanning really helps. in my system I have 100% CPU load with only one scan, but test system is not really large.

Best regards,
Hannes

ned
Enthusiast
Posts: 25
Liked: 5 times
Joined: Dec 09, 2014 9:13 pm
Full Name: Ned Thomas
Contact:

Re: Surebackup A/V scan extremely slow

Post by ned » May 18, 2020 5:12 pm

I will test with "parallel" scans using Instant secure restore.

The idea was to use Surebackup with A/V enabled, but regardless of your "process simultaneously up to X VMs" setting, the A/V option reduces it to one VM (and one volume).

I was hoping to hear from other customers using this option; their configs and experience.

Thanks, Ned

PetrM
Veeam Software
Posts: 438
Liked: 59 times
Joined: Aug 28, 2013 8:23 am
Full Name: Petr Makarov
Location: Prague, Czech Republic
Contact:

Re: Surebackup A/V scan extremely slow

Post by PetrM » May 18, 2020 9:30 pm

Hi Ned,

While we're waiting for results of test proposed by Hannes, you may take a look at this thread because there are some interesting ideas and may be it's worth trying to run a quick scan?

As far as I understand from this article, "-1" should be passed as the value of "ScanType" argument to perform quick scan, just edit .xml file accordingly.

Thanks!

ned
Enthusiast
Posts: 25
Liked: 5 times
Joined: Dec 09, 2014 9:13 pm
Full Name: Ned Thomas
Contact:

Re: Surebackup A/V scan extremely slow

Post by ned » May 18, 2020 10:30 pm

I'm running 3 Instant secure restores now. One VM is scanning and the other two are in a "waiting for antivirus resource to become available: ..." state.

5/18/2020 5:11:46 PM [Windows Defender] Waiting for antivirus resource to become available: currently in use by "VM name" restore job...

HannesK
Veeam Software
Posts: 5439
Liked: 738 times
Joined: Sep 01, 2014 11:46 am
Location: Austria
Contact:

Re: Surebackup A/V scan extremely slow

Post by HannesK » May 19, 2020 6:47 am

ah good point, so my idea with parallel instant restore was not good (at least not for Windows defender).

No further ideas from my side, but I'm still not convinced that parallel scanning would improve the overall speed.

ned
Enthusiast
Posts: 25
Liked: 5 times
Joined: Dec 09, 2014 9:13 pm
Full Name: Ned Thomas
Contact:

Re: Surebackup A/V scan extremely slow

Post by ned » May 19, 2020 6:11 pm

I am hoping to hear from other customers using this option; their configs and experience.

michael.strine
Veeam Software
Posts: 6
Liked: 2 times
Joined: Oct 21, 2013 3:43 pm
Full Name: Michael Strine
Contact:

Re: Surebackup A/V scan extremely slow

Post by michael.strine » May 24, 2020 12:24 am

PetrM wrote:
May 18, 2020 9:30 pm
As far as I understand from this article, "-1" should be passed as the value of "ScanType" argument to perform quick scan, just edit .xml file accordingly.
I just want to point out, don't use ScanType -1 permanently in the Veeam AntivirusInfos.xml

From the link:
"ScanType are: 0 Default, according to your configuration, -1 Quick scan, -2 Full scan, -3 File and directory custom scan. "

Veeam uses the -3 option to scan only files in the backup (by feeding MpCmdRun.exe the path to the volume mounted in VeeamFLR)

-1 sets a quick scan for the entire system. The secure restore will be scanning the mount server; and likely not the backups, if ScanType -1 is used.

r2d2
Veeam Software
Posts: 2
Liked: 1 time
Joined: May 10, 2011 1:30 pm
Full Name: arth
Contact:

Re: Surebackup A/V scan extremely slow

Post by r2d2 » May 27, 2020 4:14 pm

ned wrote:
May 15, 2020 6:00 pm
I'm running Surebackup with VBR v10 (P1), which is running fine. I'm now trying to leverage the A/V scan option using Microsoft Windows Defender. This works but is extremely slow. The Windows Defender scan runs sequentially - one VM at a time and only one volume at a time. This is a major bottleneck and basically makes it unusable in my current environment.

Is anyone leveraging Surebackup with the A/V option? What A/V tool are you using? Any recommendations in general to optimize this process?

Thanks, Ned


[ID# 04165665] Surebackup A/V scan slow and sequential one VM at a time
Back to My Cases
Product: Veeam Backup & Replication
Severity: 3
Opened: May 8, 2020 22:54
VBR v10 (P1), VMware ESXi 6.7u3, Windows 2016, Windows Defender A/V scanner
SOBRs on EMC VNX5700 hybrid storage array
Sorry for letting you down. This functionality depends on command lines of antiviruses. Unfortunately it's an infrastructural limitation and couldn't be resolved by Veeam's programming code.

Post Reply

Who is online

Users browsing this forum: allynz, bytewiseits and 26 guests