Possible causes of poor performance when using Symantec AntiVirus Scan Engine

Article:TECH81335  |  Created: 2003-01-24  |  Updated: 2007-01-01  |  Article URL http://www.symantec.com/docs/TECH81335
Article Type
Technical Solution



This document describes what to check if performance seems slow when passing information to Symantec AntiVirus Scan Engine 4.0 (AVSE).


The following are some common factors that may cause slow performance for AVSE.
  • Scan Threads
  • Scanning All Files
  • Environment

Scan Threads
The recommended number of scan threads is equal to or slightly greater than the number of configured connections. When scan threads are less than this number, AVSE performance slows. Increase the number of scanning threads when the number is less than the number of configured connections.

Scanning All Files
Scanning all files, regardless of extension. This can be very time-consuming and may not be necessary. Try setting AVSE to scan all files except the default extensions.

Network problems
Any network problem can affect the performance of AVSE. Verify that communication between the AVSE servers, the caching server, and the clients is performing acceptably independent of the AVSE software.

Connected clients
Too many clients connecting at one time slows down scan performance.

Note: If your are using ICAP 0.95b, there is no load balancing capabilities. ICAP 1.0 now allows multiple ICAP servers to be attached to one client, so AVSE can scale with the load.

We recommend updating to the most current version of AVSE. If you are in need of AVSE 4.04 or later, please contact Technical Support.

Technical Information
Additional information.
  • In AVSE 4.04 an issue was addressed where ICAP 1.0 was slower than ICAP 0.95.
  • Symantec AntiVirus for Bluecoat Security noticed poor performance when using ICAP 1.0 due to delays in transmitting small packets during two-way "chats" that can occur in the protocol.
  • AVSE contains a new (unpublished/hidden) configuration file option, named: SetTcpNoDelay. This option turns on the TCP_NODELAY setting in the socket used for ICAP and Native protocol communications. Setting this option to one (1) (SetTcpNoDelay=1), disables the Nagle algorithm i thereby avoiding delays incurred when small packets are exchanged.By default this option is set to zero (0). When this option is set to zero, sockets continue to behave as in the past.

Legacy ID


Article URL http://www.symantec.com/docs/TECH81335

Terms of use for this information are found in Legal Notices