I've determined that only local files get cached by Symantec. This means that if you are accessing a file on a shared drive on a server, it will not be cached, and Symantec will have to scan it every single time it is accessed. What I am trying to determine is whether putting AV on the servers would improve speed. Right now, no data comes in through the servers, so AV was only installed on the clients. The catch is that the servers handle many files. For caching to be advantageous, the cache would need to be very large. If it's going to be large, we need to know where it gets stored. So...
Where does Linux put the file cache?