Hi disk I/O from NOD32 scanning NODxxx.tmp files

Discussion in 'NOD32 version 2 Forum' started by ethos, Jun 19, 2009.

Thread Status:
Not open for further replies.
  1. ethos

    ethos Registered Member

    Joined:
    Aug 26, 2008
    Posts:
    30
    Hi

    I've noticed our exchange server (running NOD32 2.7 with exchange plugin) has occasions with very high disk I/O.

    Everytime this happens NOD32 is scanning ALOT of NODxxx.tmp files. When it stops/slows down disk I/O returns to normal.

    I've searched the HDD and can only find 4-5 tmp files related to nod32.

    My question is where are the NOD tmp files (are they being created/deleted on the fly- if so why) and what is it up to?

    Thanks
     
  2. YeOldeStonecat

    YeOldeStonecat Registered Member

    Joined:
    Apr 25, 2005
    Posts:
    2,345
    Location:
    Along the Shorelines somewhere in New England
    What exclusions do you have in AMON?
    Also in AMON, I uncheck "scan all files".
    Did you also uncheck "background scanning" in XMON?
    How many users in Exchange...how big is the infostore?
    How much RAM in system, and what kind of hard drives?
     
    Last edited: Jun 19, 2009
  3. ethos

    ethos Registered Member

    Joined:
    Aug 26, 2008
    Posts:
    30
    Xmon has:

    Scan all files unticked
    Scan extensionless files ticked

    Folder exclusions are:

    C:\PROGRAM FILES\EXCHSRVR\
    C:\WINDOWS\SYSTEM32\INETSRV\
    C:\PROGRAM FILES\SURFCONTROL E-MAIL FILTER\

    60~ or so users in Exchange and the store is around 10GB.

    4GB of ram and 3 x 146GB 10k SAS drives in raid5.

    I disabled scanning of TMP files and it didn't make as big a difference as it did earlier today, so maybe i'm barking up the wrong tree for I/O performance.

    Either way, would be interested to know what these .TMP files are.
     
  4. YeOldeStonecat

    YeOldeStonecat Registered Member

    Joined:
    Apr 25, 2005
    Posts:
    2,345
    Location:
    Along the Shorelines somewhere in New England
    Is this server also a DC? If so...I'd add some more exclusions..
    http://www.sbsfaq.com/Lists/FAQs/DispForm.aspx?ID=137

    Having both OS and Infostore on same volume will beat up your disks with hard usage, I try to separate infostore and other database related stuff on separate spindles from the OS.

    Latest version of XMON installed?
     
  5. ethos

    ethos Registered Member

    Joined:
    Aug 26, 2008
    Posts:
    30
    Nope, it's not on a DC.

    It's running 2.71.9 which I believe is the latest version.

    Ideally we'd have a couple more drives and it seperated like mentioned...

    Thanks for the link, I've got a feeling it isn't set up as best practice at present.

    Any ideas on the .TMP files? :)
     
  6. YeOldeStonecat

    YeOldeStonecat Registered Member

    Joined:
    Apr 25, 2005
    Posts:
    2,345
    Location:
    Along the Shorelines somewhere in New England
    May want to try unchecking that "Background scanning" in XMON
    I'm pretty sure all that does is automatically kick in a full scan of all messages in the infostore immediately after each definition update. So if you go through several updates per day.....
     
  7. BFG

    BFG Registered Member

    Joined:
    Oct 27, 2004
    Posts:
    482
    Location:
    San Diego
    Hello,

    When scanning an archive NOD32 unpacks them in the TMP folder to do so. When finished, the files would no longer show up.

    But, the TMP extension should be excluded from AMON's scanning using XMON.

    Could that be the case here?

    BFG
     
Thread Status:
Not open for further replies.