Antivirus Exclusions
NetFlow Optimizer (NFO) writes continuously to disk while it is running. Logs and configuration database updates generate sustained write activity.
On-access antivirus scanning inspects each of those writes. This adds CPU overhead and I/O latency, and on busy collectors it can cause NFO to fall behind. Because NetFlow, IPFIX, and sFlow arrive over UDP, records that arrive while NFO is stalled are lost rather than delayed, and the loss is silent.
On Linux hosts, on-access scanners can also consume large numbers of file descriptors.
We recommend excluding the NFO installation directories and processes from on-access scanning on every host running NFO.
Paths below assume a default installation. If you installed NFO to a different location, substitute your installation path.
Linux
Directories
Exclude these directories and all of their subdirectories.
| Component | Path |
|---|---|
| NetFlow Optimizer | /opt/flowintegrator/ |
| External Data Feeder (EDFN) | /opt/nfi-updater/ |
Processes
Exclude these processes by full path. Do not exclude by process name alone.
| Component | Path |
|---|---|
| NFO Server | /opt/flowintegrator/server/bin/nfc_svr |
| Web interface (Tomcat) | /opt/flowintegrator/tomcat/bin/jsvc |
| External Data Feeder (EDFN) | /opt/nfi-updater/bin/jsvc |
| Configuration database (HSQLDB) | /opt/flowintegrator/java/jre/bin/java |
Windows
Exclude these directories and all of their subdirectories.
| Component | Path |
|---|---|
| NetFlow Optimizer | %ProgramFiles%\NetFlow Logic\NetFlow Integrator |
| External Data Feeder (EDFN) | %ProgramFiles%\NetFlow Logic\NetFlow Integrator Updater |
%ProgramFiles% is a system environment variable, normally C:\Program Files.
Example: Microsoft Defender for Endpoint on Linux
# Folders
mdatp exclusion folder add --path /opt/flowintegrator/ --scope global
mdatp exclusion folder add --path /opt/nfi-updater/ --scope global
# Processes
mdatp exclusion process add --path /opt/flowintegrator/server/bin/nfc_svr --scope global
mdatp exclusion process add --path /opt/flowintegrator/tomcat/bin/jsvc --scope global
mdatp exclusion process add --path /opt/nfi-updater/bin/jsvc --scope global
mdatp exclusion process add --path /opt/flowintegrator/java/jre/bin/java --scope global
# Verify
mdatp exclusion list
Additional considerations
Scheduled scans. The guidance above applies to on-access, real-time scanning. Scheduled scans that target other parts of the file system do not affect NFO.
File output. NFO does not write flow records or SNMP data to disk by default. If you have configured a file output, exclude the output directory as well, as write volume there is substantially higher than normal operation.
Multi-node deployments. Apply the same exclusions on every node, including NFO Central and all Peers.
Verifying the impact. If you suspect scanning is affecting performance, check the Status page for dropped flows and compare CPU utilization before and after applying exclusions.