Applies to: MariaDB Enterprise Server, MariaDB MaxScale, Linux
Summary
Deploying Microsoft Defender for Endpoint (MDE) or other real-time antivirus scanners on MariaDB and MaxScale servers in a default state can cause severe performance degradation, unexpected failovers, and data corruption.
Symptoms
- Severe query latency or database lock wait timeouts.
- Unexpected node evictions or service failovers in high-availability clusters (such as Galera Cluster or MaxScale proxies).
- Database corruption.
Cause
If real-time scanning is active on a database server, the mdatp agent intercepts file system calls at the kernel level. This introduces significant hazards in active MariaDB and MaxScale environments:
- Interrupting real-time flushes to data files (
.ibd), binary logs, and transaction logs causes disk queue spikes. - Micro-delays caused by file scanning can trigger heartbeat timeouts across high-availability clusters.
Steps to Resolve
Microsoft Defender for Endpoint (MDE) is a third-party product and is not officially supported or validated by MariaDB. To ensure the safety of your data, follow these guidelines:
- Do not enable real-time scanning on production database servers in a default state.
- Contact Microsoft Support directly to request their official best practices for safely deploying MDE on highly transactional Linux database servers.
- Configure exclusions: Implement the correct procedure to completely exclude MariaDB and MaxScale processes, data directories, and log directories from Real-Time Protection and scheduled scans.