We're starting to ramp up our Virtual Machine operations and are increasingly running more and more Windows guests. As far as I can tell traditional antivirus programs are not a scalable solution for large deployments because of the load they put on the guests and the storage while they're running. At best we would be able to get away with a couple of dozen Windows guests, running staggered scans at nights and on the weekend..

Most traffic to the Virtual Machines is in the form of email and remote desktop sessions - however, some people do map drives to the virtual machine to transfer files.

What is the best way to handle antivirus scanning for Virtual Machines in the general case? We're using RHEV so product specific options like vShield Endpoint aren't an option.


first of all, there is no reason not to treat a virtual machine the same you would a physical one. still, since these are servers we're talking about, the traditional solution would be to keep only the virus-prone file and email servers constantly protected, and run periodic sweeps on the rest, while keeping the client machines as secure as possible - they are the entry point for the viruses after all.

If you keep the VM v-disk configurations optimal (raw/preallocated disks, on fast LUNs, snapshots kept to minimum, and of course virtio, using the latest drivers) the VMs should be quite OK with antivirus sweeps.

  • Thanks, I guess the only way to find out is to give it a try and monitor performance. I was concerned mostly because of the shared bandwidth to the iSCSI SAN we're using, and the relatively high density of VMs on each physical host. Some of the VMs are not using VirtIO disks because of some issues we had when we rolled RHEV out - are there any relevant features of VirtIO I'm not aware of beside increased performance? – Beerey Apr 27 '11 at 4:04
  • well, virtio is just more efficient – dyasny Apr 30 '11 at 20:57

We're not seeing any problems running a standard Sophos Endpoint deployment across 200+ Virtual machines on 5 hosts and dual iSCSI GbE connections to each host. Real-time scanning certainly adds some overhead but it's not a showstopper.

You need to do some obvious stuff like excluding file types that are going to cause you hassle (mdf ldf, \WinSXS, \NTDS etc) and disable AV scanning entirely when you're backing up/restoring (use pre/post op commands).


Thus far we haven't seen any more problems with scanning virtual machines than with physical ones. If you have lots of machines then staggering is more important. We generally scan at night and don't have any clients who work overnight so it doesn't matter.

We use both CAetrust and ESet


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.