Is the VMFS5 datastore 1 MB blocksize supported for Symantec EDR?

Products

• Endpoint Detection and Response

Issue/Introduction

You have installed Symantec EDR on a new VMware datastore that is is using VMFS5.

Environment

All versions of EDR 4.x installed on VMware virtual machines.

Cause

The default block size in a new VMFS5 datastore is 1 MB and cannot be reconfigured.

Resolution

New VMware datastores using VMFS5 support the disk and partition sizes supported by EDR.  This means that if it is a new VMFS5 datastore it will have a block size of 1 MB and the larger disk sizes are in fact supported on this datastore.  This block size and this datastore version are supported for use with EDR.

 

 

IMPORTANT NOTE:

A different block size should only be seen for datastores upgraded from VMFS3 to VMFS5 or any version of VMFS older than VMFS5.  In those situations the block size should be set according to what the EDR documentation has traditionally stated in

System requirements for the virtual appliance which is included here below.

• Use the proper block size, depending upon the VMFS version of your system. If your ESXi server is using VMFS-2, then set block size to 4MB or greater.
• If you are using a file system later than VMFS-2, then set block size to 8MB or greater.*

*If you have upgraded your VMFS datastore from VMFS3 to VMFS5 the block size should be set to 8 MB in order for it to be a supported EDR platform.