Performance tips for anti-malware

To improve utilization of system resources by Deep Security Agent, you can optimize performance-related settings according to best practices.

Minimize disk usage

Reserve an appropriate amount of disk space for storing identified malware files. The space that you reserve applies globally to all computers: physical machines, virtual machines, and Deep Security Virtual Appliances. The setting can be overridden at the policy level and at the computer level.

Open the policy or computer editor that you want to configure.
Click Anti-Malware > Advanced.
Under Identified Files, clear Default.
In the Maximum disk space used to store identified files field, specify the disk space to use.
Click Save.

Alerts are raised when there is not enough disk space to store an identified file.

Optimize CPU usage

Exclude files from real-time scans if they are usually safe, but have high I/O, such as databases, Microsoft Exchange quarantines, and network shares (on Windows, you can use procmon to find files with high I/O). See Exclusions.
Do not scan network directories. See Scan a network directory (real-time scan only).
Do not use Smart Scan if the computer does not have reliable network connectivity to the Trend Micro Smart Protection Network or your Smart Protection Server. See Smart Protection in Deep Security.
Reduce the CPU impact of malware scans by setting CPU Usage to Medium (recommended; pauses between scanning files) or Low (pauses between scanning files for a longer interval than the medium setting):
1. Open the properties of the malware scan configuration.
2. On the Advanced tab, select the CPU Usage during which scans run.
3. Click OK.
Create a scheduled task to run scans at a time when CPU resources are more readily available. See Schedule Deep Security to perform tasks.
Reduce or keep small default values for the maximum file size to scan, maximum levels of compression from which to extract files, maximum size of individual extracted files, maximum number of files to extract, and OLE Layers to scan. See Scan for specific types of malware.

Most malware is small, and nested compression indicates malware. But if you do not scan large files, there is a risk that anti-malware does not detect some malware. You can mitigate this risk by using other features, such as integrity monitoring. See Set up Integrity Monitoring

Enable multi-threaded processing

Use multi-threaded processing for manual and scheduled scans (by default, real-time scans use multi-threaded processing). Multi-threaded processing is effective only on systems that support this capability. To apply the setting, enable it and then restart the computer.

Go to Policies.
Double-click to open the policy where you want to enable multi-threaded processing.
Go to Anti-Malware > Advanced.
In the Resource Allocation for Malware Scans section, select Yes.
Restart the computers on which you enabled multi-threaded processing for the setting to take effect.

Enabling multi-threaded processing may impact CPU usage:

Multi-threaded processing can reduce the number of CPU cores available at a given time to the computer's other processes.
On Linux, when Resource Allocation for Malware Scans is enabled, the CPU usage setting is ignored even if set to Medium or Low.

Do not enable multi-threaded processing if resources are limited (for example, CPU-bound tasks) or they must be held by only one operator at a time (for example, IO-bound tasks).

Optimize RAM usage

Reduce or keep small default values for the maximum file size to scan, maximum levels of compression from which to extract files, maximum size of individual extracted files, maximum number of files to extract, and OLE Layers to scan. See Scan for specific types of malware.
Most malware is small, and nested compression indicates malware. But if you do not scan large files, there is a risk that anti-malware does not detect some malware. You can mitigate this risk by using other features, such as integrity monitoring. See Set up Integrity Monitoring