[THIN] Re: Yet Another Anti Virus On Citrix Question (hopeful ly with a twist)
- From: <DOUG.WOOTEN@xxxxxxxxxxxxxxxxxx>
- To: <thin@xxxxxxxxxxxxx>
- Date: Thu, 13 Jan 2005 07:53:38 -0000
Hi
In the case I was mentioning, it was configured correctly, including not
scanning mdb files and other settings suggested by Trend. Trend
obviously works and does work in TS environments so my comments should
not be taken as the failures we saw would affect everyone. However, we
found in our environment something similar to what you are saying
Michael, it was almost like the environment was too fat...
It was not a clash with citrix or in my case terminal servers, it was
simply an issue with the operating system not handling the users and the
software.
As another side point, the way we investigated this issue further was to
use perfmon watching a server. I would be interested to know if you see
the below:
If you watch the counters Objects -> Threads and Process -> Thread
Count, you will notice over (for us a few hours) these counters start to
differ quite substantially and one of them doesn't come down until you
reboot. Without antivirus installed this did not happen. From what I
could gather (and please no flames as I know I could have misunderstood
their meaning), one is a count of all known owned threads and the other
is just all known threads (although trying to find real information on
what counters mean can be difficult). It was almost like something was
leaking threads.
Good luck in your choice, it all comes down to specific environment
settings in the end, this is just my 2c (or by now $2) worth. :-)
________________________________
From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On
Behalf Of Pardee, Michael P.
Sent: 12 January 2005 19:39
To: 'thin@xxxxxxxxxxxxx'
Subject: [THIN] Re: Yet Another Anti Virus On Citrix Question (hopeful
ly with a twist)
You're one of the ones I was waiting to hear from Jim. I believe we do
have it configured for inbound scanning only. I won't dispute config
errors, but we seem to be configured correctly here. Our environment is
just too fat.
________________________________
From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx]
Sent: Wednesday, January 12, 2005 1:20 PM
To: thin@xxxxxxxxxxxxx
Subject: [THIN] Re: Yet Another Anti Virus On Citrix Question (hopeful
ly with a twist)
I doubt that is was just trend mcaffee or whatever product. I HIGHLY
believe that it is USER error and misonfiguration of the products along
with other programs causing the issues. It has been my experience with
AV products for example that if you do not turn off outbound scanning it
will cause you issues. Other than that these products work fine on
Citrix. We used Mcaffee for 6 years and now use Trend SMB Officescan
client on our servers and it works flawlessly. People are quick to
blame one product over another and everyone has their favorites.
Personally I have found that the trend smb client uses the smallest
footprint, is the easiest to implement and has the best console for
implementing out to workstations as well and controlling dissemination
of updates.
JK
":
We boot them all every night! All quads. All 4GB memory.
What I didn't want to hear was what you say about Trend. I was
hoping that
was my solution!
Crap.
-----Original Message-----
From: thin-bounce@xxxxxxxxxxxxx
[mailto:thin-bounce@xxxxxxxxxxxxx]
Sent: Wednesday, January 12, 2005 12:06 PM
To: thin@xxxxxxxxxxxxx
Subject: [THIN] Re: Yet Another Anti Virus On Citrix Question
(hopefully
with a twist)
I have experienced problems like this before. Running a farm of
35 NT
servers (terminal server no citrix), and about 40 users per box
during peak
times. We would get 1450 errors and would have to remove servers
from the
farm. I got to a stage where half the farm was rebooted each
night to keep
it running!!
We found once we removed trend AV, the servers would stay up for
weeks and
handle more users.
We may have hit a resource limit once AV was installed and could
have been
teetering on the edge, however, I still believe it was a trend
thread leak
issue but have been unable to get it resolved so far.
I should mention the servers weren't small either, 4Gig RAM quad
processor
etc. This doesn't mean anything though when NT has hard set
limits for
paged pool and non paged pool memory.
Cheers
Doug
Thanks. We are running 7.1.
)
Over the years we have seen McAffee cause all kinds of stability
and
performance issues. It depends on the version you are using, we
are
doing a
large project now with McAfee 7.1 and it seems okay so far....
Heavy thin client users with published full desktops.
For years we have worked with Microsoft and Citrix
troubleshooting BSOD
issues that have really gone nowhere. As a last ditch attempt, I
had
one of
our guys completely remove McAfee off of one of the servers in
an
at tempt to
eliminate yet another variable.
Not only has that one server stayed up for the past 3 weeks but,
due to
bringing it back in to the load incorrectly, it also had 94
users on it.
Before we would get 1450 errors and would constantly run out of
registry
quota. All of a sudden that one server was handling 1.5 times
its
normal
load.
Email Confidentiality Notice: The information contained in this
transmission is confidential, proprietary or privileged and may be
subject to protection under the law, including the Health Insurance
Portability and Accountability Act (HIPAA). The message is intended for
the sole use of the individual or entity to whom it is addressed. If you
are not the intended recipient, you are notified that any use,
distribution or copying of the message is strictly prohibited and may
subject you to criminal or civil penalties. If you received this
transmission in error, please contact the sender immediately by replying
to this email and delete the material from any computer.
****************************************************************************
SMOKE ALARMS SAVE LIVES
Go to London Fire at www.london-fire.gov.uk/firesafety
This email is confidential to the addressee only. If you do not believe that
you are the intended addressee, do not use, pass on or copy it in any way.
If you have received it in error, please delete it immediately and telephone
the supplied number, reversing the charges if necessary.
Other related posts:
