LogRhythm Knowledge Base Anti-Virus Exclusions

Applicable Software Versions: 6.x

Solution: When installing and configuring anti-virus scanning software on a LogRhythm

appliance, be sure to exclude the following directories from the virus scan.

LM Appliance:

C:\Program Files\LogRhythm\LogRhythm System Monitor

C:\Program Files\LogRhythm\LogRhythm Mediator Server
D:\Program Files\Microsoft SQL
Server\MSSQL10_50.MSSQLSERVER\MSSQL\Data
D:\LogRhythmArchives (NOTE: This is the default location of the LogRhythm
Archives. If you have specified a different archive directory, please exclude
that directory from real-time AV scanning.)
D:\*.mdf
L:\*.ldf
T:\*.mdf & T:\*.ldf

EM Appliance:

C:\Program Files\LogRhythm\LogRhythm System Monitor

C:\Program Files\LogRhythm\LogRhythm Alarming and Response Manager
C:\Program Files (x86)\LogRhythm\LogRhythm Job Manager
D:\Program Files\Microsoft SQL
Server\MSSQL10_50.MSSQLSERVER\MSSQL\Data
D:\*.mdf
L:\*.ldf
T:\*.mdf & T:\*.ldf

AIE Appliance:

C:\Program Files\LogRhythm\LogRhythm System Monitor

C:\Program Files\LogRhythm\LogRhythm AI Engine
C:\Program Files\Microsoft SQL Server\MSSQL\Data

SLF Appliance:

C:\Program Files\LogRhythm\LogRhythm System Monitor

Scanning these directories will have a major impact on the performance of the LogRhythm
appliance. There are no other known issues with anti-virus software.