Required Antivirus Software Configuration for the EdgeSight Agent

Symptoms

If you do not configure your antivirus software properly, the performance of the device (desktop, laptop, Citrix Presentation Server) may suffer. Below is a list of symptoms that may indicate the antivirus software is interfering with the normal operation of the EdgeSight agent, and in turn affecting the end user’s performance and/or productivity.

The device seems sluggish or generally slower than normal after installing the EdgeSight agent or upgrading your antivirus configuration.
You see prolonged high CPU utilization or a significant increase in the Thread Queue Length associated with the following EdgeSight agent processes:

o Rscorsvc.exe

o Fbserver.exe

You see prolonged high CPU utilization or a significant increase in the Thread Queue Length associated with any of the AV software processes.
You see a significant change in the Disk I/O Performance. For example, if the % Disk Write time or Disk Write Queue Length increase significantly.

Regardless of whether you are currently experiencing any of these symptoms, you should follow the steps outlined in the Resolution section below. Ideally, this procedure should be executed before any EdgeSight agents are deployed.

Cause

The EdgeSight agent is continuously monitoring every process that is running on the monitored device. In turn, it is continuously writing performance data to its local Firebird SQL database. The problem is that most antivirus products are configured to scan all files on disk. If an antivirus program scans the continuously active EdgeSight database it impedes the normal operation of EdgeSight.

In extreme cases, the EdgeSight agent can become sluggish and consume more resources than necessary. This can potentially lead to a negative impact on the overall performance of the device being monitored.

Resolution

Configure your antivirus software (TrendMicro, Symantec, Norton, McAfee and so on.) to NOT scan the EdgeSight data folder or processes. This should be done on all of the devices that are or will be running the EdgeSight agent. You may need to contact your security administration team to put these exceptions in place enterprise wide. Use the following procedure:

Note: Citrix recommends that you follow this procedure before the deployment of any EdgeSight agents.

1. Exclude the following agent folders from being scanned. Check a few agent devices to confirm the exact folder locations in your environment. These folders contain the EdgeSight agent database file as well as many log files. Below is the default installation location:

\Documents and Settings\All Users\Application Data\Citrix\System Monitoring\Data

Note: If the above folder does not exist, you may have set a non-standard folder location during the installation. If you are currently running the EdgeSight 4.1 agent or have upgraded from a 4.1 agent the following may be the correct folder:

\Documents and Settings\All Users\Application Data\Reflectent\Data

2. Exclude the following EdgeSight agent executables (processes) from being scanned. Listed below are the default installation locations:

\Program Files\Citrix\System Monitoring\Agent\Core\rscorsvc.exe
\Program Files\Citrix\System Monitoring\Agent\Core\Firebird\bin\fbserver.exe

Note: If the above folder does not exist, you may have set a non-standard folder location during the installation. If you are currently running the EdgeSight 4.1 agent or have upgraded from a 4.1 agent, the following may be the correct folders:

\Program Files\Reflectent\Agent\Core\rscorsvc.exe
\Program Files\Reflectent\Agent\Core\Firebird\bin\fbserver.exe

More Information

For more information about antivirus configuration settings, see the EdgeSight Installation Guide.

CTX114906 – Required Antivirus Software Configuration for the EdgeSight Server