Antivirus Exclusions for the SQL PI (Infobright) Repository and FMS embedded repository databases (209121)

Embedded repositories such as PostgreSQL Infobright database used by SQL PI as the database repository and MySQL and PostgreSQL Foglight Management Server (FMS) databases may encounter performance issues or crash due to the presence of running antivirus applications scanning the repository.

The steps detailed here can be used to help identify if an Antivirus application is installed and whether the required exclusions have been set.

• ..\Foglight (for the FMS)
• ..\Infobright        (for the PI Repository)
• ..\Foglight Agent Manager   (for the FglAM)

In some circumstances, conflicts between the embedded databases and the Antivirus or Anti-malware product may require disabling the other product.

Known complications between Infobright (SQL PI) and Antivirus or Anti-malware products

The following products have been found to compete for CPU resources with the Infobright component of SQL PI. It is recommended that the services / processes be disabled on the server running the SQL PI repository.

• Sophos HitmanPro (part of the Sophos Endpoint Protection application)
• Crowdstrike
• Cylance

Identifying the presence of Anti-Virus or Anti-malware software running on the server from Windows Server Desktop.

Users may be able to use the following steps to review the Antivirus configuration on a Windows server.

1. Identify the Antivirus being run on the server.
   Most Windows Antivirus applications run as a Windows Service. Users can review the current running Windows Services from the Windows Control Panel to check for an actively running Antivirus such as "Microsoft Antimalware Service" used by Windows System Center 2012 Endpoint Protection.
   Foglight Agent Manager support bundles also lists services running on the FglAM server are listed in the support bundle \systeminfo\runningservices.log or \system\Windows-system-info.txt files. Running services are indicated in the STATE field.
2. Find the paths where Agent Managers are running
   Check the properties of the Windows Service to locate the installation folder for the FglAM for the "Agent Manager" or "Foglight Agent Manager" services. There may be multiple services running on a server.
   With a FglAM support bundle, this value can be found in the first FglAM log (001) of a series and then looking for the “-Dquest.state.dir” value in the log file.
   
   Or this Powershell query would pull the locations for all FglAMs installed in Windows Services
   
   Get-WmiObject win32_service | ?{$_.PathName -like '*fglAM.exe*'} | select Name, DisplayName, State, PathName 
3. Confirm the location for the FMS embedded database data file directory
   These are typically located in 
   
   MySQL:  $FGLHOME\mysql\data
   Postgress:  $FGLHOME\state\postgresql-data
4. Review the exclusions for the Antivirus software.
   Many running Antivirus application services place an icon in the Windows taskbar. By right clicking this icon, the Antivirus settings and exclusions may be visible.
   
   
   For Windows System Center Endpoint Protection, the following two Powershell queries can be used to retrieve the exclusions
   
   Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths' | select *
   Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Microsoft Antimalware\Exclusions\Paths' | select *

You can also manually check for antivirus software on desktops (Windows 7, Windows 10) using this wmi query.
(From DOS) wmic /NAMESPACE:\\root\SecurityCenter2 PATH AntiVirusProduct Get displayname /Format:List

Windows desktops have these SecurityCenter2 WMI objects, but the namespace doesn’t exist on servers

(from PowerShell) Get-WmiObject -Namespace "root\SecurityCenter2" -Query "SELECT * FROM AntiVirusProduct"

Our deployment guide and product requirements indicate that the entire Infobright folder should be excluded due to know corruption issues that can result when postgresql database files are scanned by AV processes.
"Note: Exclude the SQL PI repository directory (named InfoBright) from real-time scanning (e.g.: Antivirus software)"

Some these actively used extensions include
.rsi
.bht
.cd
.ctb
.dic
.flt
along with several others, but most of the postgresql data files have no extension. 

This lack of extension is because postgresql for Windows was originally ported from Linux and requires a wildcard (*).

For this reason, the request to have the entire Infobright folder is necessary.

This external Wiki article details why it is important to exclude the postgresql folder with all of the files from AV scanning.
https://wiki.postgresql.org/wiki/Running_%26_Installing_PostgreSQL_On_Native_Windows