Disable on access scan during network backup?

We also have a similar issue using CommVault, the backups were taking an age to complete with the on-read option set in the AV policy. 

We have had to created a new policy for file servers that uses the on-write option, I know this is potentially less secure but with increased scheduled scans it seems to do the trick.

The only other thing I could do is look at changing the policy each night while the backup runs.  This isnt really an option as it relies on someone remebering and actually changing the policy.

I imagine that there are more people with the same issue so I would be interrested to know how others are working around this issue.

How much longer does it take with on-access scanning?

BTW: Do you (Avatare69 and SyrianHamster) disable access to the server during backups? Just asking 'cause I wouldn't feel comfortable doing so if otherwise I see the need having it turned on.

On some servers we have the data volumes excluded from on-access scanning - the clients have on-access scanning turned on (remote files are not excluded). This might be an option.

A rather crude method to turn off scanning during backups would be stopping the Sophos Anti-Virus (SavService.exe) and the Sophos AutoUpdate Service (ALsvc.exe) the latter because an update could restart SavService.

Christian

There might be another way to do this, which would ensure less time with minimal settings and more automated.

This is what i would try:

Create a script to change the settings before and re-enable them afterwards

(I agree with QC, disabling is a worst case scenario plan)

You can configure Sophos AV settings via a file.

To get the configs in a file -
Export policy using exportconfig.exe (in Enterprise Console foler in Program Files\Sophos) then running configcid.exe

(http://www.sophos.com/support/knowledgebase/article/13111.html)

So you would need two savconf.xml.

savconf A - the during the day config

savconf B - during the backup config

You can the create a script to change then when need.

before script, move savconf B to update location, run configcid, restart services

after script, move savconf A to update location, run configcid, restart services.

more automated, more secure than disabling. Its a possible optoin.

If someone could confirm if it would take the settings immediately or if somehting needs to be restart for the new configs to take effect. not 100% sure on that.

Weird, Cara, we're a hard-core hacker, aren't we :smileywink:

Depends on where the CID is located and how many clients (that's endpoints) update from it 'cause they all would use this settings then. The changed policy should be picked up at the next autoupdate (but one can't be sure when it will happen). There's also the possibility that "someone" or "something" enforces policy compliance from SEC.

Christian

I spoke with Support and they told me to just have the Backup software run a "net stop" and "net start" script to stop/start the Sophos Antivirus service on the server.  That will turn off On Access scanning during a backup and then turn it back on afterwards.  Much easier then messing around with the registery or performing the other actions.  I guess you run into the possibility of it not getting turned back on correctly but the same thing can happen with the on-access scanning.

We use Commvault for our backup solution which includes the ability to run scripts before/after backups.  So far it seems to be working fine and makes our backup MUCH faster!

As I've said it looks like the Sophos Antivirus Service is started when SAVXP is updated. Might be that this is not kind of safeguard but that stopping the service and starting it afterwards is part of the updating process.

Christian