search cancel

Is the VMFS5 datastore 1 MB blocksize supported for Symantec EDR?


Article ID: 228756


Updated On:


Endpoint Detection and Response


You have installed Symantec EDR on a new VMware datastore that is is using VMFS5.


All versions of EDR 4.x installed on VMware virtual machines.


The default block size in a new VMFS5 datastore is 1 MB and cannot be reconfigured.


New VMware datastores using VMFS5 support the disk and partition sizes supported by EDR.  This means that if it is a new VMFS5 datastore it will have a block size of 1 MB and the larger disk sizes are in fact supported on this datastore.  This block size and this datastore version are supported for use with EDR.
A different block size should only be seen for datastores upgraded from VMFS3 to VMFS5 or any version of VMFS older than VMFS5.  In those situations the block size should be set according to what the EDR documentation has traditionally stated in
System requirements for the virtual appliance which is included here below.
  • Use the proper block size, depending upon the VMFS version of your system. If your ESXi server is using VMFS-2, then set block size to 4MB or greater.
  • If you are using a file system later than VMFS-2, then set block size to 8MB or greater.*

*If you have upgraded your VMFS datastore from VMFS3 to VMFS5 the block size should be set to 8 MB in order for it to be a supported EDR platform.