Question for Sophos users

[Quatermass]

Do you guys have On-Access scanning turned off on your servers for performance reasons, or do you simply turn it off temporarily during crunch periods such as backups? Opinions seem to differ but the latter would seem safer. And if you do temporarily turn it off what method do you use?

[network41]

Switched off on all servers , exclusions set on Exchange server

[psydii]

Off on the servers. Overnight full scans run after the backups. We've had a couple of vendors report that we also need to disable the real-time web scanning as there are various issues with the way it hooks into the network stack.

 

That said, it does appear that even disabled the file system element is remains in the path between memory and disk as evidenced by procmon et al.

Edited October 18, 2013 by psydii

[speckytecky]

Is Sophos Support aware of this issue I wonder?