Anti-virus scanning will always add a bit of latency but if that latency increases over time, it could be because of a more serious problem.
The most likely cause of this would be the connections between the SG and the proxy AV getting misused. For example, if there are 50 connections available between the ProxySG and the ProxyAV (or other AV engine), it's possible that some of those are used by streaming media, stock tickers, or other downloads that never end.
To know if the ProxySG has to queue ICAP objects, we must open the SysInfo and look for the following :
; Connection info
queued-actions 166 <----
max-queued-actions 183 <----
In this example here, only 5 connections are available between the ProxySG and the ICAP server (which is very low, normal values are between 50 and 100), and we can also see that "queued-actions" is not zero. "max-queued-actions" shows a high watermark of 183 objects which will cause latency.
To fix this type of problem, the first step is to make sure that the code for the ProxyAV's best practice is installed. It can be downloaded here. This code is valid for other ICAP servers, not just ProxyAV.
(only for SGOS vers. 5.5 and 6.x, in order to prevent the "warning error", please use the CPL code in attachment where the depreciated command "patience_page(no)" has been replaced by 'response.icap_feedback.interactive( no )'
With that in place, most streaming media and the known user-agents will not be sent to the ICAP server so it won't clog the available connections. This will speed things up and help prevent queuing.
NOTE: This was published in 2009, for the most up-to-date best practice policies, see the SG/AV integration guide