General recommendations for virus scanner exclusions working with NetBackup

Problem

Processes locked, and slow or relatively poor performance during backups, restores, or other operations.

Cause

Anti-virus or software-based firewall solutions may interfere with NetBackup and MSDP function(s) by blocking process interactions, and quarantining or deleting files due to false-positive malware detection.monly blocked items:

Solution

While this cannot be a definitive list due to the different methods of anti-virus products available, please add exclusions in your anti-virus product for the following com

Windows clients and Servers

1) Exclude on Windows clients

Processes:

• <InstallPath>\Veritas\NetBackup\bin\bpbkar32.exe
• <InstallPath>\Veritas\NetBackup\bin\bphdb.exe
• <InstallPath>\Veritas\NetBackup\bin\bpinetd.exe
• <InstallPath>\Veritas\NetBackup\bin\bpfis.exe
• <InstallPath>\Veritas\NetBackup\bin\bpcd.exe
• <InstallPath>\Veritas\NetBackup\bin\dbbackex.exe
• <InstallPath>\Veritas\NetBackup\bin\dbbackup.exe
• <InstallPath>\Veritas\NetBackup\bin\nbdisco.exe
• <InstallPath>\Veritas\NetBackup\bin\vnetd.exe
• <InstallPath>\Veritas\NetBackup\bin\nbostpxy.exe
• <InstallPath>\Veritas\NetBackup\bin\nbftclnt.exe
• <InstallPath>\Veritas\pdde\mtstrmd.exe
• C:\Program Files (x86)\VERITAS\VxPBX\bin\pbx_exchange.exe (64 bit machines)
• C:\Program Files\VERITAS\VxPBX\bin\pbx_exchange.exe (32 bit machines)

Files/Folders

• <InstallPath>\Veritas\NetBackup (and all sub-directories)
• C:\Program Files\VERITAS\VxPBX  (32 bit machines)
• C:\Program Files (x86)\VERITAS\VxPBX (64 bit machines)
• When using the Accelerator feature, exclude the following files on the root of each drive:
  • *:\VxCJInfo.dat
  • *:\VxCJDelete.dat
  •  *:\VxCJMon.dat
• <InstallPath>\Veritas\NetBackup\online_util\fi_cntl (This directory is empty when no snapshot exists but gets populated when a cache file is created)
• Exclude the NetBackup Accelerator track journals located in the subdirectories of <InstallPath>\Veritas\NetBackup\track\*
• When using MSDP Deduplication Multi-Threaded Agent,exclude the following directory
  • C:\ProgramData\boost_interprocess
• When using an external certificate authority (ECA), exclude the FilePath specified in the following entry. The entry details can be found using bpgetconfig or nbgetconfig command.
  • ECA_CERT_PATH
  • ECA_TRUST_STORE_PATH
  • ECA_CRL_PATH
  • ECA_PRIVATE_KEY_PATH
  • ECA_KEY_PASSPHRASEFILE

Other notes:

Check with antivirus that the archive bit is not changed after a scan as this will affect the incremental backup based on archive bit.
For performance, do not scan files during backup as this would slow the backup.

2) Exclude on Primary/Media servers

All items to be excluded on "Clients" section above must be excluded on Primary and Media Servers as well.

In addition, items in the list below must also be excluded on all Primary and Media Servers.

Processes:

Database services (Primary server only)
Pre 10.2:

• <InstallPath>\Veritas\NetBackupDB\WIN64\dbsrv16.exe - Adaptive Server Anywhere - NetBackup Relational Database Manager  (check service to identify precise binary name as it will change when NBU is updated)

10.2 and later:

• <InstallPath>\Veritas\NetBackupDB\bin\pgbouncer.exe - PostgreSQL connection pooler
• <InstallPath>\Veritas\NetBackupDB\bin\pg_ctl.exe - PostgreSQL control utility
• <InstallPath>\Veritas\NetBackupDB\bin\postgres.exe - PostgreSQL server

Primary server specific services and files (Primary server only)

• <InstallPath>\Veritas\NetBackup\bin\nbim.exe - NetBackup Indexing Manager
• <InstallPath>\Veritas\NetBackup\bin\nbkms.exe - NetBackup Key Management Service
• <InstallPath>\Veritas\NetBackup\bin\nbemm.exe - NetBackup Enterprise Media Manager Service
• <InstallPath>\Veritas\NetBackup\bin\nbpem.exe - NetBackup Policy Execution Manager Service
• <InstallPath>\Veritas\NetBackup\bin\nbrb.exe - NetBackup Resource Broker Service
• <InstallPath>\Veritas\NetBackup\bin\bprd.exe - NetBackup Request Manager Service
• <InstallPath>\Veritas\NetBackup\bin\bpjobd.exe - NetBackup Job Daemon
• <InstallPath>\Veritas\NetBackup\bin\bpdbm.exe - NetBackup Database Manager Service
• <InstallPath>\Veritas\NetBackup\bin\nbstserv.exe - NetBackup Storage Lifecycle Manager
• <InstallPath>\Veritas\NetBackup\mqbroker\bin\erl.exe - NetBackup Message Queue Broker Component
• <InstallPath>\Veritas\NetBackup\mqbroker\bin\install\setupMQ.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\bin\nbmqbroker.exe - NetBackup Message Queue Broker Component
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\bin\ct_run.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\bin\dialyzer.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\bin\erl_call.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\bin\erlc.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\bin\escript.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\bin\typer.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\bin\werl.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\ct_run.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\dialyzer.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\epmd.exe - NetBackup Message Queue Broker Component
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\erl_call.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\erl_log.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\erlc.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\erlsrv.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\escript.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\heart.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\inet_gethost.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\start_erl.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\typer.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\yielding_c_fun.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\lib\erl_interface-*\bin\erl_call.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\lib\os_mon-*\priv\bin\nteventlog.exe
• <InstallPath>\Veritas\NetBackup\wmc\bin\install\nbwmc.cmd
• <InstallPath>\Veritas\NetBackup\wmc\bin\nbwmc.exe - NetBackup Web Management Console
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\bin\erl.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\erts-*\bin\erl.exe
• <InstallPath>\Veritas\NetBackup\mqbroker\erlang\lib\os_mon-*\priv\bin\win32sysinfo.exe

Other services (Primary and media servers)

• <InstallPath>\Veritas\NetBackup\bin\nbars.exe - NetBackup Agent Request Server
• <InstallPath>\Veritas\NetBackup\bin\nbaudit.exe - NetBackup Audit Manager
• <InstallPath>\Veritas\NetBackup\sec\at\bin\nbatd.exe - NetBackup Authentication
• <InstallPath>\Veritas\NetBackup\sec\az\bin\nbazd.exe - NetBackup Authorization
• <InstallPath>\Veritas\NetBackup\bin\bmrd.exe - NetBackup Bare Metal Restore Master Server
• <InstallPath>\Veritas\NetBackup\bin\nbcssc.exe - NetBackup CloudStore Service Container (Not present beyond NetBackup version 8.1.2)
• <InstallPath>\Veritas\NetBackup\bin\bpcompatd.exe - NetBackup Compatibility Service
• <InstallPath>\Veritas\pdde\spoold.exe - NetBackup Deduplication Engine
• <InstallPath>\Veritas\pdde\spad.exe - NetBackup Deduplication Manager
• <InstallPath>\Veritas\pdde\mtstrmd.exe - NetBackup Deduplication Multi-Threaded Agent
• <InstallPath>\Veritas\NetBackup\bin\nbdisco.exe - NetBackup Discovery Framework
• <InstallPath>\Veritas\NetBackup\bin\nbevtmgr.exe - NetBackup Event Manager
• <InstallPath>\Veritas\NetBackup\bin\nbjm.exe - NetBackup Job Manager Service
• nbnos.exe - NetBackup Notification Service (on NetBackup 6.x and earlier)
• <InstallPath>\Veritas\NetBackup\bin\nbrmms.exe - NetBackup Remote Manager and Monitor Service
• <InstallPath>\Veritas\NetBackup\bin\nbsl.exe - NetBackup Service Layer Service
• <InstallPath>\Veritas\NetBackup\bin\nbostpxy.exe - NetBackup Proxy Service
• <InstallPath>\Veritas\NetBackup\bin\nbsvcmon.exe - NetBackup Service Monitor Service
• <InstallPath>\Veritas\NetBackup\bin\nbvault.exe - NetBackup Vault Manager Service
• <InstallPath>\Veritas\NetBackup\bin\nbftclnt.exe - NetBackup SAN Client Fibre Transport Service
• <InstallPath>\Veritas\NetBackup\jre\bin\java.exe – Tomcat
• <InstallPath>\Veritas\NetBackup\bin\vnetd.exe - NetBackup Legacy Network Service
• <InstallPath>\Veritas\Volmgr\bin\vmd.exe - NetBackup Volume Manager Service
• <InstallPath>\Veritas\NetBackup\bin\bpcompatd.exe - NetBackup Compatibility Service
• <InstallPath>\Veritas\NetBackup\bin\bpinetd.exe - NetBackup Client Service
• <InstallPath>\Veritas\Volmgr\bin\ltid.exe - NetBackup Device Manager Service
• <InstallPath>\Veritas\NetBackup\bin\bpbkar32.exe - NetBackup Backup Engine
• <InstallPath>\Veritas\NetBackup\bin\bpbrm.exe - NetBackup Backup and Restore Manager
• <InstallPath>\Veritas\NetBackup\bin\bpcd.exe - NetBackup Connection Daemon
• <InstallPath>\Veritas\NetBackup\bin\bptm.exe - NetBackup Tape Manager
• <InstallPath>\Veritas\NetBackup\bin\bpdm.exe - NetBackup Disk Manager
• <InstallPath>\Veritas\NetBackup\bin\tar32.exe - NetBackup Restore Engine
• cmd.exe - this is called by NetBackup nbproxy.exe, nbpem.exe and nbjm.exe
• <InstallPath>\Veritas\NetBackup\bin\admincmd\bpduplicate.exe - NetBackup Duplication Engine
• <InstallPath>\Veritas\NetBackup\bin\admincmd\bpimport.exe - NetBackup Import Engine
• <InstallPath>\Veritas\NetBackup\bin\admincmd\nbreplicate.exe - NetBackup Replication Engine
• <InstallPath>\Veritas\NetBackup\bin\bpbackup.exe - NetBackup Backup Command
• <InstallPath>\Veritas\NetBackup\bin\nbanomalymgmt.exe - NetBackup Anomaly Management

Files/Folders

• <InstallPath>\Veritas\\Volmgr (and all sub-directories)
• <InstallPath>\Veritas\NetBackupDB
• <InstallPath>\Veritas\pdde
• C:\Windows\Temp\vmware-SYSTEM  (when used as a mount point for vmware hotadd backups)
• <MSDP storage path>
• <DSU storage path>
• <DSSU storage path>
• <Other storage LUNS>

Other notes:

If possible, set the scanner to scan inbound traffic only, this will help to avoid any performance/degradation for the backup when it takes place. 
The virus scanner will see files as being opened when NetBackup accesses them during a job. By setting the scanner to scan inbound traffic the scan will not take place during a backup.
However, the performance hit is usually negligible when scanning inbound and outbound traffic. A lot of this depends on the specification of the client.

Unix clients and servers:

Veritas has some general recommendations for Antivirus exclusions on a Master server, Media servers, and Clients. For specific exclusion details, please contact the Antivirus Software vendor.

It is recommended that you exclude the following directories from scans:

• <install>/openv/db                                          
• <install>/openv/java  
• <install>/openv/NetBackup                                               
• <install>/openv/runtime_data (existing on NetBackup Appliances)
• <install>/openv/share
• <install>/openv/kms   
• <install>/openv/pack                                                    
• <install>/openv/lib   
• <install>/openv/pdde                                                    
• <install>/openv/tmp
• <install>/openv/logs  
• <install>/openv/var
• <install>/openv/volmgr
• <install>/openv/msg   
• <install>/openv/resources      
• (Essentially, everything under <install>/openv )
• /tmp/vmware-root/ (for servers used as Vmware backup hosts)
• /opt/VRTSpbx
• <MSDP storage path>
• <DSU storage path>
• <DSSU storage path>
• <Other storage LUNS>

Related Knowledge Base Articles

How to deploy NetBackup Media Server Deduplication on Windows systems - special considerations