Where to use Shared Cache?

[rekun 43]

Hi

I am thinking about deploying an Eset Shared Local Cache appliance in out VMware enviroment, however i am a bit confused about what the scope of the deployment would be.

In the manual you start explaining that virtual machines often shared a high amount of duplicate files (true), and that because of the traffic not leaving the host, the lookups would have a very low latency. Does this mean i should have a local cache appliance for each VMware host, or can i just deploy one for each cluster?

Later on you go on explaining how to configure this on Windows Endpoints (I know theese can be virtual), and Mac computer (which are most likely not virtual), so does this mean that i should use the shared cache for all computers at the same LAN?

Do anyone have any experience with this? Are the performance improvements even noticeable?

Thanks in advance

[foneil 342]

When you say "documentation," where do you mean exactly? Have you read through the VM FAQ? 

Using ESET version 6 Business products on virtual machines—FAQ

http://support.eset.com/kb3674/

I would like to make sure that questions such as yours are addressed in the FAQ, so I will monitor this thread to see if there's any additional content we can include there. 

[rekun 43]

Hi

When you look here:https://www.eset.com/int/business/server-antivirus/shared-local-cache/#download (under "How ESET Shared Local Cache works"

"As communication happens over the same physical hardware, there is practically no delay in scanning, resulting in considerable resource savings"

However this can only be true, when the VMs and the shared cache are stored on the same server. So should it be used for all clients in the LAN or only for VMs on that specific host?

[Matus 21]

Hi Rekun,

If you deploy ESLC per server, you'll get rid off latency, however database of scanned files is big as # of VMs. If sample was scanned with modules 3 version older than actual, new scan is performed (to avoid that because of lack of information we marked some file as clean, however it's malicious).

If you deploy ESLC per location (datacenter/cluster...), some lag will be introduced, however # of VMs in grid will be much higher and thus benefit is higher too. Only hash with reputation is transferred so network load will be minimal. I'd recommend this solution. (configuration in ERA will be easier as well)