Antivirus Scans, SEP, and Commvault Differentials

[Commvaultdude]

Ok,


Here is the problem, wondering if anyone has seen this or knows a way around it.

We have SEP as our antivirus on our servers, the scheduled scan is set for Tuesday night, full system scan.

Once the scan runs our differentials now turn into basically fulls. We are currently renewing support so I cannot get a ticket open with commvault. It appears that commvault is checking the file access date to determine what has changed since the last full(which we run once a week on Saturdays). If this is the case, this is stupid, file access dates can change if you search a server, it should be checking the fiel modification date.

Has anyone seen this behavior and if you have , is there a workaround or a patch? Any help would be appreciated.

 

[dutchtreat]

This could be a solution for you (from Books Online):

"Set the Archive Bit Attribute
To set the archive bit:
From the CommCell Browser, right-click the desired file system backup set node, and then click Properties from the shortcut menu.
From the General tab, select the Check archive bit during backups option.
Click OK to save your change."

 

[Commvaultdude]

Dutchtreat,

I am aware that I can change the scan to classic and set the archive bit but that requires that the next job to be a full, I have over 250 servers that I would have to make this change to. It does not really matter, we just moved the av scans to Friday since I run my fulls then anyway, no harm done. It still does not make any sense at all to check the file access date to determine if a file has changed, this is just bad design on Commvaults part and I actually like commvault a lot.

Thanks for the advice

 

[daverowland]

We had the same issue with SEP where it modifies the change journal that commvault uses to check whtat files to backup. THe note below refers to SEP 11.0 but if you have older versions chech the symantec site


Question/Issue:
You configure backup software to run an incremental backup job that is based on USN change journal entries. After Symantec Endpoint Protection runs a manual scan or a scheduled scan, the backup software performs a complete backup job instead of an incremental backup job. Similarly, DFS (Distributed File System) replicated shares are based on USN change journal, and running Manual or Scheduled Scans against the shared folders will trigger unnecessary replication traffic.


Solution:
The following setting suppresses file modifications for attribute updates, last access dates, and security descriptors.


To fix the problem on 32-bit versions of Symantec Endpoint Protection client, create the following DWORD value and set it to 1:

HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\AV\NoFileMod
To fix the problem on 64-bit versions of Symantec Endpoint Protection client, create the following DWORD value and set it to 1:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\NoFileMod

 

[mrfokker]

Excellent. Have this issue and I will implement changes.