Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 6 down vote favorite
2

Some implementations of antivirus software are known to Microsoft to cause a variety of problems for SQL Server, and Microsoft has a support article dedicated just to picking the right antivirus software for your SQL Server hosts.

From your experience, is it safe to run antivirus software on your database servers?

Given all the required antivirus exclusions and caveats to consider, is it practical?

share|improve this question

2 Answers

up vote 6 down vote accepted

For me, personally, I have not found it practical. But for 15+ years I have worked in environments that were dedicated to isolating and protecting the database servers. All of the activity that can lead to virus and malware infestation on a SQL Server machine can be prevented IMHO. Extremely limited access, no browsing from the server, no hosting of file shares, rigorous firewall protection, principle of least privilege, etc. Some of these lines get blurred a bit depending on the functionality of your server, for example filestream/filetable.

In my experience anti-virus is often a false security blanket. It is either responding as a post-mortem correction or, in some cases, doesn't have the signature yet for the new threat - either because it is not kept up to date by the system administrator or by the vendor (or both). Since rules and exceptions can change over time, if sysadmins can't keep anti-virus signatures up to date, how will they keep the rules and exceptions up to date?

Your goal should be to secure SQL Server so that you aren't concerned about anti-virus. If you're not having sex, you don't need to buy condoms. :-)

share|improve this answer
3  
I tend to agree with this train of thought. If your server is dedicated to SQL Server, you can make the surface area of that machine extremely small. Strict and conservative firewall, limited direct access, and your above opinions make anti-virus software unnecessary. SQL Server should never be an internet facing machine anyways. +1 – Thomas Stringer Jun 26 '12 at 1:08
up vote 3 down vote

Yes, as long as you are excluding folders where SQL Server Data, Log and backup files are kept fron antivirus scanning. Make sure you also exclude certain known file extensions like .mdf, .ndf, .bak, .log, .trn etc.

You should also exclude SQL Server Exe sqlservr.exe from antivirus scanning.

Microsoft Support KB 304922 provide in-depth information related to consideration for running antivirus software on SQL Server machines.

share|improve this answer
1  
I am aware of the required antivirus exclusions (and I linked to that KB in my question). I'm interested in hearing if, from your experience, you've found it practical to setup and run antivirus with all these rules. – Nick Chammas Jun 26 '12 at 0:28
In our environment we do run anti-virus software on SQL Server machines. There is a central server that take of necessary exclusions. Although answer "depends" on your company's overall security policy, personnel who has access to your servers and permissions assign to them etc. – SQL Learner Jun 26 '12 at 0:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.