McAfee Virus Scan and Oracle RAC

Question

We're experiencing a strange problem with Oracle RAC and McAfee antivirus.

As part of the installation of the Oracle RAC we disable antivirus as directed. We have had our RAC running fine, but when we came to re-enable the AV and reboot we got the BSOD:

Abnormal Program Termination (BugCheck, STOP: 0x00000035 (0x8E984678, 0x00000000, 0x00000000, 0x00000000

NO_MORE_IRP_STACK_LOCATIONS

Following the standard process of raising this problem with Microsoft, they identify the problem and also a fix. Microsoft talk about too many file filter drivers being present and pushing the DFS upper limit beyond the default size. Upping this value, as per MSDN, has no impact.

We're able to recover from this BSOD by disabling AV. We don't have the problem if we run the AV service manually whilst the system is up. However, if we make the service automatic, we fail to boot.

Tech details

• 2 Node Oracle 10g Cluster
• 2 * Windows 2003 SP2, 16GB RAM, Quad Core 3ghz Processor
• SAN attached storage
• McAfee VirusScan Enterprise 8.5.0i, Scan Engine (5300.2777), DAT Version (5536.0000)

Answer 1

when we came to re-enable the AV and reboot we got the BSOD.

Don't do that, then!

You don't want AV running on your servers. It'll only cause weirdo compatibility problems like this, and occasionally cripple your apps when it detects a false positive. Meanwhile it won't actually protect you from the kind of exploits that are likely to be aimed against live servers. Total waste of time.

Answer 2

Look at http://stackoverflow.com/questions/321618/where-can-i-ask-questions-that-arent-programming-questions - there are lots of sites for asking IT questions.

Thanks.