Scaling and Scanning Performance
ESET PRIVATE Static Scanning Engine scales horizontally by increasing replicas/pods/tasks to handle higher scanning throughput, with each scanner instance supporting up to 8 concurrent scanning threads (simultaneous users).
Scaling Model
Scaling depends on the number of scanner replicas to process incoming scan requests from multiple agents/users. A single scanner replica can handle up to 8 simultaneous scanning threads (concurrent users/agents). Higher throughput can be achieved by deploying additional replicas.
Performance Factors
Scanning performance may vary based on file type characteristics:
File Type |
Relative Performance (depending on the deployment setup) |
Comment |
|---|---|---|
Small files (<1MB) |
~ milliseconds |
Minimal CPU/memory; highest throughput |
Documents (PDF, DOCX) |
~ milliseconds |
Standard processing |
Archives (ZIP, RAR) |
~ seconds |
Extraction + nested scanning overhead |
APKs |
~ seconds |
DEX analysis + signature matching |
Executables (EXE) |
~ seconds-minutes |
Behavioral analysis + heuristics |
Large media (videos) |
~ seconds-minutes |
Byte-by-byte scanning; Optimized performance is achieved by subsequent scanning of small parts of the entire file, transfer of the entire file is typically not needed, only in selected cases. |
Variables affecting performance:
•File entropy/complexity
•Nested archive depth
•Cloud reputation lookups
•CPU/memory allocation
Sizing Recommendations
Due to workload variability, ESET recommends running a Proof of Concept (PoC) with representative file types and volumes:
1.Deploy single Scanner replica using on-prem/EKS/ECS guides (see dedicated sections). Typical resource allocation per component is 1vCPU, 2GB memory.
2.Run Scanner Agent with realistic workload (rotate the scanned content to keep utilizing the scanner threads up to 8 active users)
3.Monitor metrics:
a.Scanner scanning performance
b.CPU utilization \ memory usage
c.Time from agent submit -> scan complete
Single Scanner instance scans files with a reference throughput up to ~ 1GB of processed data within one minute.