ESET scans generating massive disk writes - causing Hyper-V replication issues

[CraigF 0]

Hi,

We run monthly malware scans on our servers. From our Hyper-V replication log (*.hrl), we've observed that these scans result in 40+ GB of disk writes on the System volumes. These writes need to be replicated to the Hyper-V Replica server, which is problematic for remote Replica servers.

From this post - https://forum.eset.com/topic/12397-what-data-eset-writes-to-ssd-and-how-to-minimize-it/ - it appears that ESET pages a lot of its scan processing to disk, which probably explains this phenomenon.

Given that article is over 6 years old, I thought it worth checking whether ESET has any new settings that we can adjust to reduce the amount of disk write activity it generates when scanning.

Thanks,

Craig

[Marcos 5,071]

Please try disabling scanning of archives. If you have many iso files or other disk images on the disk, it takes time to unpack and scan the files inside and it generates a lot of disk writes too.

[CraigF 0]

Thanks for the prompt response, Marcos.

To clarify, I should disable this setting:
Detection engine, Malware scans, Threatsense parameters, Objects to scan, Archives
but not Self-extracting archives.

I will give your suggestion a go and report back once I've re-tested the scan.

[Marcos 5,071]

Well, if you have a lot of bigger executable installers then you might want to try disabling SFX archives to minimize writes during a scan.

[CraigF 0]

Hi Marcos,

running a scan overnight after disabling scanning of Archives and Self-extracting archives still resulted in a 5GB HRL file, but that's a big improvement on 40+GB, so your hunch was correct.

Thanks,
Craig