(Had to run for a train, so didn't really finish above.)

Should have said: ". . . only seems to scan files created or replaced". McAfee must get its hooks somewhere into the OS file handling.

We didn't find a need to exclude any directories (that was in our early days - 7.3.4 with noarchivelog). I'll now try excluding the archlogs - I don't expect any noticable effect, except perhaps in over-night "batches", when there's no one to notice it.

My ex-SA found out the hard way what scanning outgoing files does to OS backup times. And I found out how slow a restore is, if you forget to switch off the scanning!

Tamil, I've never tried Norton on a DB server of any kind.