Scan Times Doubled / Will Thread Count Help? (Full Version)

All Forums >> [Networking & Security] >> GFI LANguard



Message

mblinde -> Scan Times Doubled / Will Thread Count Help? (25.Jun.2009 9:09:06 AM)

Hello,

We have recently moved one of our GFI LANGuard installations from a 2003 x64 server to a 2008 x64 server. We are working out some of the quarks if you will after moving. We also moved GFI EventsManager and during the move of that product I've noticed that it didn't copy all of the settings we had set within EventsManager. We've resolved all of our outstanding issues with that product and I'm now focusing on LANGuard. Early this morning was the first full run of our normal daily scheduled scans with LANGuard and our daily full scan of our servers at our core data center took twice as long as it normally does. Instead of taking 2 hours to scan 74 servers it took 4 hours. I checked the scheduled scan settings and the profile settings match that of same scheduled scan and profile on our old server and nothing appears to be different. The thread count on all of our scans is set to 3. Although increasing the thread count will shorten the time of the scan is this really the only solution or is there something else I'm not thinking about that could be causing the scans to run twice as long? Could a setting have been missed during the export/import of the settings?

On a side note even if someone doesn't have and answer and reads this it would be good to know what everyone is using for a thread count.



DrewE -> RE: Scan Times Doubled / Will Thread Count Help? (25.Jun.2009 10:22:52 AM)

When scanning 74 machines a thread count of 5 or 6 may not be a bad idea. It really depends on what else this Server 2008 machine is used for, especially during the hours you are scanning.  Also, the amount of network congestion you want to deal with during scans needs to be considered. 

If your scheduled scans occur in the middle of the night, a higher thread count would work great. If you scan during business hours, keeping the thread count at 3 may be necessary.



mblinde -> RE: Scan Times Doubled / Will Thread Count Help? (25.Jun.2009 10:41:17 AM)

DrewE,

Thanks for the info, I'll give it a try tonight. I kind of figured that wouldn't be a bad idea but I thought I'd check. Yes we are scanning at night if you will or very early morning for this particular scan. I'll turn it up to 5 and see if there is any improvement. Are there any other changes I can do besides increasing the thread count?



DrewE -> RE: Scan Times Doubled / Will Thread Count Help? (25.Jun.2009 1:00:21 PM)

The scans that take the longest are also the TCP and UDP port scans. Scanning entire port ranges is very time consuming, and can also depend on the firewall (software or hardware) between the two machines. For the best scan times, disabling the TCP and UDP port scans would be ideal.  More often, a balance of the number of ports scanned and how fast you want the scans to complete is determined.



Page: [1]