1

Does McAfee virus support Redhat Linux running in an Oracle RAC Cluster?

IF so, what is the configuration, best practice?

4 Answers 4

3

Don't do that... RAC is very complex and the last thing you need is McAfee adding in more variability. Needless to say, from a support perspective, you want to keep as much non oracle stuff away from your RAC nodes as possible.

1
  • +1: ...and why on earth would you want to run AV on database files - these are affectively embedded filesystems with no direct access to the files (tables, indexes etc) they actually hold - even if there was such access, it'd be really dumb to run an AV scanner on them
    – symcbean
    Apr 20, 2011 at 15:07
2

Running McAfee AV on your RAC server will break your system (I have done it first hand). Especially if you have OAS (On Access Scan) enabled. If you HAVE to have AV installed on the system, disable OAS and add any of you shared storage / config directories to the ODS (On Demand Scan) exclusions.

1

Ask yourself what you want to accomplish. The majority of virus threats McAfee will respond to on Linux will be Windows viruses. A virus scanner on Linux is most useful if you use Linux as a file server with Samba. There have been a couple of Linux proof-of-concept viruses in labs in the past, but it never took off.

For the rest: I agree with Rafael. I'm not that familiar with anti-virus stuff on Linux, so I don't exactly know what McAfee does and does not do, but my guess is Oracle will not like another program messing with it's memory and file access.

Honestly: the best anti-virus practice on a high security Linux node that is not a Samba file server, is to update regularly, limit access, be a good admin (don't run weird programs, harden your box), and, if you like, run something like tripwire and rkhunter regularly. Anti-virus software is not in that list for me.

0

Yes, it's supported. Some environments actually require it for compliance with some sort of security checklist. However, it will induce a number of headaches and performance problems that are more difficulty than they are worth, and probably reduce security because having available access to information is part of security. Industry best practice is to exclude the antivirus program itself, and never run any antivirus on Linux.

If people cannot be deterred from wreaking antivirus havoc on you, then you will need to exclude all of your database files (control files, online redo logs, archived redo logs, data files, temp files, block change tracking files, etc.). If you're using ASM, these required files should be safe from antivirus by default, since the OS has no visibility into ASM. You will most likely need to disable antivirus to run any Oracle installer (RAC instructions mention this explicitly).

I would also try to track down all of the log locations to exclude those as well. Oracle has a tendency to close the log files as soon as it's done writing, and re-open them for each new entry (in case a user modifies it). Other locations that would be a good idea: exclude the pfiles used to start the databases, exclude locations used for database backups and exports, and exclude any other directories configured inside the database.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .