Using a McAfee VirusScan 8.x with Windows Clustering or a SAN? Take note! Special exclusions needed!

I'll write more about this when I have more time but essentially the low level kernel filters that come with McAfee are not very cluster aware. If you seem to have a lot of excessive I/O and/or contentions on your SAN, make sure you exclude "\Device\HarddiskVolume*" from scanning if you do not want McAfee scanning on a particular SAN drive.

Real world example of why this is important: Exchange information stores on a SAN. Most likely you have already excluded the logical drive paths to the information stores, but if you check the VirusScan On-Access Scan Statistics, you will notice a lot of activity on "\Device\HarddiskVolumeXX\EXCHSRVR\MDBDATA\*".

Why is this bad? It is a great way to corrupt your information store due to .LOG files getting yanked out and put into quarantine, and is practically the equivalent of the old "scanning the M: drive" problem that a lot of people using Exchange 2000 had, except much more dangerous.

Also noteworthy, any version of 8.0i before patch 11 has a very nasty non-paged pool memory leak that can and will eventually take down a server given enough time. The behavior will vary depending on the role of the server but typically you end up with event logs from the Srv source complaining about not enough memory available.