MIME-Version: 1.0
References: <CAMon-aQz20Mv12T1RNL1T0eaWg-=nqu0WZuwVsh587rKbdf8aA@mail.gmail.com>
 <aS9NbE6fA6aiSK-l@elch.exwg.net>
In-Reply-To: <aS9NbE6fA6aiSK-l@elch.exwg.net>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Tue, 2 Dec 2025 17:07:41 -0500
Message-ID: <CANzqJaB-emsdnCrhZrs1H5ax1A+89nfwEm7HF22CyHTsQeSwKg@mail.gmail.com>
Subject: Re: wdavdaemon / Microsoft Defender for Endpoint on Linux and slow
 Postgres recovery?
To: PostgreSQL General <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000baf5a00644ff53d5"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaB-emsdnCrhZrs1H5ax1A%2B89nfwEm7HF22CyHTsQeSwKg%40mail.gmail.com>
Precedence: bulk

--000000000000baf5a00644ff53d5
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Dec 2, 2025 at 3:35=E2=80=AFPM Christoph Moench-Tegeder <cmt@burggr=
aben.net>
wrote:

> ## Colin 't Hart (colinthart@gmail.com):
>
> > I wonder if anyone here has any experience with configuring exclusions =
so
> > that the WAL files can be processed faster?
>
> https://learn.microsoft.com/en-us/defender-endpoint/linux-exclusions
> mind this:
>
> https://learn.microsoft.com/en-us/defender-endpoint/linux-exclusions#supp=
orted-exclusion-scopes
> and work from these examples (if you're allowed to):
>
> https://learn.microsoft.com/en-us/defender-endpoint/linux-exclusions#exam=
ple-3-add-or-remove-a-folder-exclusion
>
> > Any advice on what to communicate with their IT department about using
> this
> > on their database servers? I've never encountered it on Linux before...
>
> "Be glad it only slows your database down. All too often, AV/Endpoint
> Protection Products just don't like the access pattern and eat your
> database for breakfast." There is this joke "it has been 0 days since
> Anti-Virus ate a database".
>

Things must have improved, since we had Carbon Black for a number of years,
and now use Coretex XDR.

CB would quite often consume 300% CPU, while XDR "only" uses 100% on
occasion, but have never corrupted or crashed a PG instance.  (This is
standard installations, with no exclusions.)

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--000000000000baf5a00644ff53d5
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Tue, Dec 2, 2025 at 3:35=E2=80=AFPM Ch=
ristoph Moench-Tegeder &lt;<a href=3D"mailto:cmt@burggraben.net">cmt@burggr=
aben.net</a>&gt; wrote:</div><div class=3D"gmail_quote gmail_quote_containe=
r"><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bord=
er-left:1px solid rgb(204,204,204);padding-left:1ex">## Colin &#39;t Hart (=
<a href=3D"mailto:colinthart@gmail.com" target=3D"_blank">colinthart@gmail.=
com</a>):<br>
<br>
&gt; I wonder if anyone here has any experience with configuring exclusions=
 so<br>
&gt; that the WAL files can be processed faster?<br>
<br>
<a href=3D"https://learn.microsoft.com/en-us/defender-endpoint/linux-exclus=
ions" rel=3D"noreferrer" target=3D"_blank">https://learn.microsoft.com/en-u=
s/defender-endpoint/linux-exclusions</a><br>
mind this:<br>
<a href=3D"https://learn.microsoft.com/en-us/defender-endpoint/linux-exclus=
ions#supported-exclusion-scopes" rel=3D"noreferrer" target=3D"_blank">https=
://learn.microsoft.com/en-us/defender-endpoint/linux-exclusions#supported-e=
xclusion-scopes</a><br>
and work from these examples (if you&#39;re allowed to):<br>
<a href=3D"https://learn.microsoft.com/en-us/defender-endpoint/linux-exclus=
ions#example-3-add-or-remove-a-folder-exclusion" rel=3D"noreferrer" target=
=3D"_blank">https://learn.microsoft.com/en-us/defender-endpoint/linux-exclu=
sions#example-3-add-or-remove-a-folder-exclusion</a><br>
<br>
&gt; Any advice on what to communicate with their IT department about using=
 this<br>
&gt; on their database servers? I&#39;ve never encountered it on Linux befo=
re...<br>
<br>
&quot;Be glad it only slows your database down. All too often, AV/Endpoint<=
br>
Protection Products just don&#39;t like the access pattern and eat your<br>
database for breakfast.&quot; There is this joke &quot;it has been 0 days s=
ince<br>
Anti-Virus ate a database&quot;.<br></blockquote><div>=C2=A0</div><div>Thin=
gs must have improved, since we had Carbon Black for a number of years, and=
 now use Coretex XDR.</div><div><br></div><div>CB would quite often consume=
 300% CPU, while XDR &quot;only&quot; uses 100% on occasion, but have never=
 corrupted or crashed a PG instance.=C2=A0 (This is standard installations,=
 with no exclusions.)</div></div><div><br></div><span class=3D"gmail_signat=
ure_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><div d=
ir=3D"ltr">Death to &lt;Redacted&gt;, and butter sauce.<div>Don&#39;t boil =
me, I&#39;m still alive.<br><div><div>&lt;Redacted&gt; lobster!</div></div>=
</div></div></div></div>

--000000000000baf5a00644ff53d5--