Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question is a little opinion based, but I think it can be based in fact and I would prefer answers backed up with a link to a reputable company if possible.

The problem is at my job, we have "okay" hardware for the developers, laptops running Windows XP (I know) with dual core 2.3 Ghz processor, 2GB of memory and 60 GB hard disk @7200 rpm however, the amount of virus scan and security agents and big brother software on these make them unusable when scans are running. My company insists on running full disk virus scans every monday and "smart scans" every other day.

I appreciate the concern for viruses as much as the next guy, however it is hindering our work and we are looking for a new setup that allows the developers to work unimpeded by scans, yet provides virus protection et al that the company is looking for.

Keep in mind my company is not really willing to change antivirus vendors, so we're looking at a developer oriented solution because most of the business users do not experience these issues.

UPDATE:
Company policy requires that all laptops (which I have) are taken home each evening unless you have an office to lock it in. Because I am office-less, I have to take it home each evening.

I am willing to listen to any scenario, switch to a desktop, switch to a different OS, any of the above. Just looking for setups that people currently use, that seem to work for their developers, in particular java developers.

We also run a lot of software on our laptops, an applicatoin server, a database, email client, developer IDE, database IDE and other random things as required.

END UPDATE.

Any suggestions?

share|improve this question

closed as not a real question by voretaq7 Jan 25 '12 at 6:36

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Is disconnecting the computers from the network or running Linux an option? –  3dinfluence Jul 15 '09 at 17:29
    
The company is unwilling to switch antivirus vendors, but willing to buy new laptops? Is the antivirus that expensive? –  Ernie Jul 15 '09 at 17:35
    
@3dinfluence - We are willing to listen to any OS switch, I'm just looking for possible ideas to alleviate the problem. @Ernie We are currently on a 2 or 3 year lease cycle with hardware and the cycle end is fast approaching. –  Nick Jul 15 '09 at 17:51

10 Answers 10

up vote 0 down vote accepted

I don't think you're going to find any economical level of hardware platform that won't show some signs of stress during virus scanning, especially in the realm of laptop computers. Workstation-class machines with 10K or 15K-RPM SAS drives and multi-core processors (to give you faster IO, more IO parallelism, and processing parallelism) are your best bets, but that's going to be expensive.

This is one of those classic "tradeoff triangles". In this case, the points of the triangle are probably "Virus Scanning Frequently", "Users Not Impacted", and "Inexpensive Computers". You can optimize however you want in that triangle, but you're not going to get all 3 things.

You don't want to hear it, but I'd argue that a rethinking of your antivirus strategy is in order.

share|improve this answer

First suggestion would be to switch to a desktop so the scans can be run while the developers aren't trying to work on the machines.

If that doesn't work, next would be to see if it is possible for the developers to remotely connect, over a VPN, to the network late Sunday night from home for a scan to run from say 12:01am Monday morning that should finish by the time they would need to disconnect the laptop from the remote network to bring it in to the office. I'm not sure how well some of the corporate folks would like this idea but it would have the scans run on the schedule and the laptops are out of the office when the scan is done.

share|improve this answer

Why has nobody questioned the fact that the scans are running during developer work hours yet? Why can't they run overnight? Your problem is most certainly a people one, not a technology one.

share|improve this answer

The last time a virus nuked my Windows system at work (completely in spite of our antivirus, I might add!), I switched to Ubuntu. It mostly works well and considering that I'm a Unix sysadmin it's well suited to me. Ubuntu comes with a free SSH client and a terminal program that uses tabs for the multiple remote logins I have going at any given moment in time. That, plus some standard internet apps, basic word processing, and Kdevelop for a nice multi-language (including Java) IDE gets me by 90% of the time.

The first big, fat caveat comes from our database client, which neither has a Unix version, nor does it run under the WINE "emulator". This may happen to you. Try dual-booting Ubuntu on your work computer, or using your own laptop to experiment with. This is the only way of knowing if such a solution is right for you or any of the other developers where you work.

The other big, fat caveat is that Linux is NOT immune to viruses. It's not likely that you'll get infected, but it's entirely possible that you can get one through the network, especially if you're running an application and database server locally that is accessible from the network (one of several included firewall solutions would prevent this however). But it is certainly less prone to viruses, and its small market share means that Linux isn't a high priority target for virus writers, and infections are pretty rare. But then, so is the H1N1 Flu. It doesn't mean you have no reason to worry at all.

share|improve this answer

I'd suggest some really fast SSDs to alleviate some of the seek overhead from the scans. Obviously, this would help even more if you could exclude your dev folders from the scan (though I bet IT policy won't allow that).

share|improve this answer

I've gone with a sort of combination of what the others here have said.

Our weekly Full scans run weekly on Monday's at 3 AM. They should be long done before anyone shows up to start the week.

As for the on-access scan, configure the AV client to ignore the directory structure containing the source code. If the client is also scanning network shares -and- your file servers are also running AV, be sure to exclude share scanning from the clients as well.

share|improve this answer
1  
Thanks for the suggestion, however, the company policy requires us to take the laptops with us at close of business, because we work in cubes. We've thrown around the idea of getting desktops, which I believe someone else mentioned. –  Nick Jul 15 '09 at 17:53
    
How about cable locks for the laptops? –  Carl Campos Jul 16 '09 at 2:15

How about changing the scan time to 5:00 PM or whatever time the developers generally go home? Alternatively, how about 12:00 PM, and the Devs all take lunch exactly at noon every Monday? This assumes that the full scan is worse performance-wise than the Smart scan.

share|improve this answer
    
The are doing a lunch time scan, but they insist on doing a full scan on Mondays which take on the order of 4 hours, roughly. I'm a java developer, so we have lots of jar files, that it tries to scan each file inside of. –  Nick Jul 15 '09 at 17:52
    
@Nick I suggested the same in a comment below - but how about getting cable locks for the laptops, so they can be left in the building at night? That should make them no more or less enticing than the desktops that are already sitting there. Once you leave the laptops, the scans can be run overnight. –  Carl Campos Jul 16 '09 at 2:18

Maybe a software solution would be better. Does the virus scanner have the option of shutting down the computer when it's done? Maybe at the end of the day the developer can run the virus scanner in lieu of shutting down. When the scanner is done, the user comes in the next day to a freshly scanned computer that's ready to boot up.

share|improve this answer

There is no good solution to this problem that I can see- if management insists on auditing that often, you're stuck with it. However, a possible fix could be making it so that developer stations that can't access the internet, only the company intranet, and exempting them from the daily scans, letting only the weeklies run. If there's an infection loose on the intranet, quarantine the developer subnet and lock it down, and thoroughly disinfect before reconnecting it.

share|improve this answer

Having an on-access should make it unnecessary to run a scan, though I realise many IT departments insist on using a scheduled scan, possibly because they might be fired if there was a virus outbreak!

All I can suggest is to try and convince your support guys that an on-access scanner alone is adequate. I strongly advise you have at least an on-access scanner. Any modern AV on-access scanner shouldn't cause a significant slowdown. i use AVG here and only notice it when doing big directory replications.

JR

share|improve this answer
    
Just a minor nit: "Having an on-access should make it unnecessary to run a scan [...]" -- That's true as long as the AV solution is always more current than the virus creators... Since that's rarely the case, it makes sense to "re-scan" files periodically to ensure a new virus wasn't missed on the first access scan. –  Chris_K Jul 15 '09 at 17:34
    
@Chris: I would (indeed I do) run a full scan occasionally e.g. over a lunch break. Whether you could trust developers (a race related to Orcs but less evolved :-) to do the same is debatable. –  John Rennie Jul 15 '09 at 17:38
    
@John Did I forget to mention that I'm a developer? Its funny, we have a similar opinion of our IT counterparts on the hardware side. –  Nick Jul 15 '09 at 17:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.