ESET Shared Local Cache still useful or unneeded?

[da_yoshman 0]

Hi,

i'm still in the process migrating from TrendMicro to ESET and also installed a Shared Local Cache in my virtual environment (Citrix Provisioning e.g.).

But if i understand 

or 

 

right there is no need for Shared Local Cache anymore, because there is no performance impact? Is that right or did i misunderstood something? 

[Marcos 4,704]

Since the whitelist of certificates was implemented in security products some time ago, it's possible that using ESET Shared Local Cache would not improve scanning much unless you use a lot of exe/dll files that are unsigned and are not used by many users outside your company.

[da_yoshman 0]

Thanks for your quick answer

But there is no negative impact of still using the Shared Local Cache?

At this moment i have 47.000 entries stored and 160.000 cache searches after one day - is this a sign for whatever?

Because originally i wanted to ask how to size the Shared Local Cache correctly Is one cpu still enough? Are 100.000 stored entries enough? ...?

[Matus 21]

Hi da_yoshman,

There should be no negative impact in case latency to ESLC is in acceptable numbers. 

Unfortunately, it's not possible to say how much impact did Cache brought to you. All connected endpoints did 160.000 requests to Cache for the result, however, it's not clear how many of them received a valid result of a scan. In case you've same files which are not whitelisted, it could bring benefit. However, it might happen that there are stored scan results of files which don't exist on other computers, so these results did not provide any benefit to other computers.