Veeam and McAfee 8.7

[msorn]

Have any of you gotten Veeam and McAfee Virusscan 8.7 to play well together?

Every night a few backups are failing with error messages like "The specified network name is not available." Veeam backups are done with hotadd on two different Veeam servers, and are all stored on the same server accessed via a Windows file share, and I'm reasonably sure that this is some sort of false alarm, since I have a couple jobs run concurrently and one succeeds while the other fails, and nothing from our monitoring system indicates a problem with the target server.

I suspect McAfee VirusScan because it has given us similar problems with our TSM system; it simply seems to do strange things with large files coming in from or going out to the network (which, as far as I can tell, are going to be scanned anyway regardless of scan exclusions), without leaving much in the logs to indicate what happens or when (all I can see of interest is a lot of "would be blocked" messages in the Access Protection log). A retry the following morning practically always succeeds.

Have any of you seen similar problems with McAfee or another virus scanner, and if so, did you identify a way around the problem that did not involve uninstalling the scanner altogether?

[Gostev]

Does it have settings to drop files with specific extensions from monitoring? Or specific folder (that is being shared)? I have these settings in NOD32. If McAfee has them too, then you could simply exclude Veeam backup files (or the whole folder) from real time monitoring. May be this will help? Thanks.

[tsightler]

Well, we used McAfee 8.7 until a few weeks ago (now mostly upgraded to 8. and we never really experienced this issue on any of our servers (~70 or so). I don't know if that tells you much, but I guess it might answer your question regarding "paying well together", in our case they've always managed to get along without us doing anything special.

[Bunce]

If its blocking anything it will be in the McAfee logs...

[msorn]

The .vbk files, et. al., are excluded already.

I don't think McAfee is blocking anything per se... but what I've seen before is the fact that it is scanning files coming in over the network occasionally seems to make the destination server appear to be unavailable from the perspective of the source server (with the "network name is not available" message I mentioned). This has happened with large Robocopy jobs I've done over the network as well, and I don't observe this behavior when McAfee is disabled. (To be fair, this could only be a symptom of some other problem in our environment).

For now I have McAfee uninstalled on the backup target, and I haven't had any trouble so far. I'll keep plugging away at it, and if I find anything useful I'll make a note of it here.

@tsightler - do you have Veeam backing up to disks mounted locally on the server, or is it dropping its files on a network share as it is in my case?

Thank you all.

[jgremillion]

I've had this happen with Windows 2008 and Windows 2008 r2 servers were the Veeam console was running and stream files to a file share on another server. Apparently W2k8 and higher will disconnect maps drives automatically to "save resources." It is suppose to reconnect them really quick when you access them (click on the drive letter and the big red X disaapears.)

This KB helpped: http://support.microsoft.com/kb/297684.

[tsightler]

@tsightler - do you have Veeam backing up to disks mounted locally on the server, or is it dropping its files on a network share as it is in my case?

In my configuration none of my systems are doing this today, but in the relatively recent past we did have this and we had no issues.

[nguyent]

It happened the same for me with Trendmicro 7.0 that the veeam server restarted itself anytime I did sure backup. I did exclude all veeam folders and backup files, but it still happened. I have to disable real time scan for sure backup working for now.

[nguyent]

It works fine now. I have to exclude all veeam and backup files folders from Trendmicro Real Time Scan.

[msorn]

Uninstalling McAfee was clearly not a complete solution; the target file server appears to be leaking memory. Back to the drawing board...