Virus scanners
To ensure security, TrendMiner allows the installation and running of virus scanners next to the TrendMiner application, only on single node deployments and with certain conditions.
While antivirus software is an important security measure, it is crucial to note that TrendMiner's performance is closely tied to I/O performance as the application builds a time series index using many small local files, grouped into time-based structures. Virus scanners, particularly those that scan all disk I/O, may still cause performance degradation or failures in some cases.
Important Considerations:
Performance Impact: Antivirus processes that scan disk I/O can introduce delays, potentially affecting TrendMiner’s responsiveness. In extreme cases, it may cause system failures, such as:
User experience degradation due to slower I/O performance and CPU/Memory spikes caused by the antivirus software.
Delays in monitoring events, due to slower indexing, related to slower I/O performance
TrendMiner upgrades failing due to permission checks timing out or other delays.
Troubleshooting: In the event of performance issues or system failures, virus scanners should be temporarily disabled to rule them out as a potential cause.
Exclusions: To minimize performance impact it is strongly advised to exclude the
/mnt/datavolume from being scanned.
Security Risks
The risk of malware exposure on a TrendMiner installation is minimal. It is not possible to upload random files to the TrendMiner applications, let alone executables. The only attack vector is uploading a TrendMiner install/update package, but an attacker who has admin access is already considered a security breach.
To allow TrendMiner admins to validate the integrity of the upgrade packages checksums for these packages are provided on the TrendMiner download site.
Recommended antivirus configuration
For customers where security policies require running antivirus software, please ensure the following:
The
/mnt/datavolume is excluded from scanning.In case of any performance degradation, disable the antivirus to rule it out as cause.
Contact TrendMiner support for further assistance and potential mitigation strategies.
Virus scanners on virtual appliances
Virus scanners are not supported for virtual appliance deployments. Virtual appliance deployments are considered a TrendMiner controlled environment and therefore do not support console access for customers, and by extension do not support the installation of virus scanners or other software.
In case your company requires a virus scanner we advise to switch to a single node deployment.