Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Seems like a waste of resources to me, but our team is currently discussing. What is generally considered the best practice here?

share|improve this question

migrated from stackoverflow.com Nov 11 '11 at 3:36

This question came from our site for professional and enthusiast programmers.

    
Not related to programming. Voted for migration to Server Fault. –  rightfold Oct 22 '11 at 21:47
add comment

10 Answers

up vote 14 down vote accepted

Please see Guidelines for choosing antivirus software to run on the computers that are running SQL Server for help.

share|improve this answer
1  
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Mark Henderson Jan 23 '13 at 20:26
add comment

Obviously some machines need AV but if you need help explaining why some machines might not, here's my favorite XKCD comic...

alt tex

share|improve this answer
add comment

Anti-virus software is typically aimed at end-user PCs, or for scanning emails on servers. I can't imagine any scenario where normal anti-virus software would help on a DB server, since it usually only monitors HTTP connections and does on-access scans of files the user accesses.

For protecting your servers, you need something different, mainly a firewall and perhaps also an intrusion detection system (IDS).

share|improve this answer
add comment

Is it exposed to the internet? Can the system run processes that start executables?

Typically virus scanning systems are something you want on all systems. Worms that can go from PC-to-PC over the network can still attack systems that are not normally exposed to the internet are one of the common justifications for this.

edit another important part is who as Remote Desktop access? These are poential risk points as well if they go out to the internet for anything. Granted you would hope they would know better, but it is still a potential concern

share|improve this answer
    
Exposure to the internet is a bad metric, I've seen internal servers get infected, keep in mind a good AV protects from service based infections, network packets, etc. Malware goes way beyond an EXE the user runs. –  TravisO Dec 15 '08 at 17:40
    
I know, it was just one of the few questions. My second paragraph gets into this. It is just that if it is exposed to the internet, that is typically an immediate ticket to getting AV installed, even to those that are not "fond" it if being on a db server. –  Mitchel Sellers Dec 15 '08 at 18:56
add comment

Answering this in isolation is hard. You need to consider your overall security strategy of your network. And how exposed the server is. How many staff have access to it and what are their security levels? What other antivirus do u have on the network, is it external facing or just internal? Is antivirus really a performance hit on it if it is just running queries all day long anyway?

All of these are important considerations.

share|improve this answer
add comment

You should run a virus scanner on your servers, but then go into the AV exceptions settings and exclude the folder/files that contain the database files, this way the machine is safe from infection, but it won't rescan the massive database files everything they read & written too, which is all the time.

Also I recommend a lean AV package, like NOD32 by ESET, light on ram, very fast, great multicore support, it will make the least impact on performance.

share|improve this answer
add comment

Frankly, I think anyone who installs AV on ANY application/DB server is flat-out irresponsible. AV is for end-user desktops and file servers. Both of these contexts cannot be tightly controlled and therefore you need prophylactics like AV, SpyWare and DEP.

On average, Windows admins are a group that believe AV on ALL servers means they are protected. This tells me that they are of a lineage that never worry about STDs because they always wear condoms! Both are incredibly and ridiculously irresponsible!

Last week, my orgnaization caused thousands of servers to die because they released an update to McAfee.

In my opinion, the average Windows administrator does not have sufficient education about how malware infects systems and what services make Windows vulnerable. They simply use lots of condoms and hope for the best. When they make a baby or get a devastating STD, they use their get-out-of-jail-free-card and blame the failed condom.

You want more? Raise your hand if you install all of Microsoft's patches without understanding whether or not it even fixes a vulnerability you have or services/software you use. I thought so! (You cannot hide!) Once again, this is an approach like using plenty of condoms and hoping for the best.

Educate yourself and understand WHY your systems are vulnerable and then determine whether or not AV is providing value. If not, you are wasting CPU cycles, wasting MONEY and lowering service levels because you DON'T TAKE YOUR JOB SERIOUSLY.

Don't be fooled by the AV companies. They WANT you to buy thousands of licenses because it's a GREAT, consistent revenue stream for them.

share|improve this answer
add comment

I'm in favor of having anti-virus on the SQL Server but you must be sure to exclude the mdf, ndf, and ldf files from scanning or you'll hurt your performance. A reasonable compromise if your system has limited exposure is not using the real-time virus scanner and just schedule one check a day.

Another consideration is ensuring that there's some way to notify a sys-admin that there is a virus. Servers don't always get that kind of attention.

HTH Andy

share|improve this answer
add comment

I certainly wouldn't risk no anti-virus, but it is a big performance hit. Making the assumption that no-one will ever use that machine is dangerous (because you might need to install updates etc.), I guess a good compromise would be:

  1. Install the Antivirus.
  2. Lock the machine down - e.g. no Windows File Sharing, small set of authorized users, etc.
  3. Turn the antivirus resident shield off.
  4. When you copy something onto the machine update the AV and scan the file before opening it.

This is based heavily on the assumption that the people who you allow to log into the machine are responsible. And as always, make sure you are backing up often onto disconnected media (e.g. tapes/DVDs/Internet etc.) - you never know when the next blaster is going to strike.

share|improve this answer
add comment

I completely agree with Rob, I personally see the need for AV on end user systems but not systems that are administered by professionals. If you get a virus on a server of any sort, its because you failed as an admin, NOT because you didn't install some bloated out resource sucking anti-virus.

I don't care what antivirus you work with, they're all a bad idea for servers. On the other hand, Workstations that you can't baby sit all the retarded users at, every hour of the day... then a good AV is worth its weight in gold. I would stay away from Trend / Mcafee and Norton. The high end names of yesteryear are nothing but bloat/malware themselves these days.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.