Sorry for taking so long to get back to you guys.  I've been on a plane for the last day or so  =).

The problem did not coincide with an ONTAP upgrade.  Our last upgrade was quite a while ago (many months) and the drop-off problem started a few weeks ago.  Looking back at change logs, we can't find anything that was messed with.

One of my colleagues had an interesting theory.  When a filer requests a scan of a file, one of the scanners responds.  While that scanner is taking care of that particular file, it can't do anything else.  Some of our user groups store large numbers of sizeable zip and archive files on our filers.  Yes, we must scan these files per corporate policy.  His guess is that all 6 scanners were busy with this type of file and began to drop off-line.  He found something on McAfee's site describing this scenario but, the details are fuzzy. (I don't have it in front of me as I'm on a different continent from him right now).

In addition, 4 of our scanners were set as primary and 2 (slower systems) were set as secondary.  The secondary boxes wouldn't get hit with *any* requests unless all 4 primaries were busy or off-line at the same time.  He changed the two slower systems to primaries (all 6 systems as primary) which seems to have helped a little.  Any thoughts on why this would have helped?  It seems that if they're only getting hit when the big systems are off-line, it shouldn't matter that they're secondaries, they should kick in either way.

I'll get more details from him today and forward them on to the group.

Thanks,
Jeff Mery - MCSE, MCP
National Instruments

-------------------------------------------------------------------------
"Allow me to extol the virtues of the Net Fairy, and of all the fantastic
dorks that make the nice packets go from here to there. Amen."
TB - Penny Arcade
-------------------------------------------------------------------------


Sto RageŠ <netbacker@gmail.com>
Sent by: owner-toasters@mathworks.com

01/31/2005 10:01 PM
Please respond to
Sto RageŠ  <netbacker@gmail.com>
To
"Merkin, David S" <david.merkin@gs.com>
cc
"jeff.mery@ni.com" <jeff.mery@ni.com>, toasters@mathworks.com
Subject
Re: McAfee A/V config





OK. I should have been clear about the verisons. 6.x and 7 sounded
like the ONTAP versions, but they are not :)
We did have issues when we were running McAfee 4.5 (not 6.x) version
of  AV scanner. Now we are running 7.1 version and have no issues.
Ontap version is 6.5.3.
-G


On Mon, 31 Jan 2005 14:28:31 -0500, Merkin, David S <david.merkin@gs.com> wrote:
>  
> Did this happen when you upgraded to 6.5.2?
>  
>  
> -----Original Message-----
> From: owner-toasters@mathworks.com [mailto:owner-toasters@mathworks.com] On
> Behalf Of jeff.mery@ni.com
> Sent: Monday, January 31, 2005 12:18 PM
> To: toasters@mathworks.com
> Subject: McAfee A/V config
>
>  
>
> The basics:
> -  F940c systems (one cluster)
> -  ONTAP 6.5.2
> -  ~4.4 TB of data (90% CIFS)
> -  McAfee VirusScan 7.1 for NetApps
> -  6 x scanner systems (4 x PowerEdge 650SC, 2 x Precision 420)
> -  All scanners scan both filers
> -  All GbE, all systems & filers on same subnet
>
> We've been having a small problem with our McAfee virus scanners lately;
> they all periodically drop off-line causing much havoc with our pagers.
> Suggestions from McAfee are that the scanners become too busy and when that
> happens, they drop off line and reset themselves.  However, performance
> indicators on the scanners don't indicate any problems:  CPUs almost idle,
> no disk I/O, very little network activity.  From a filer stand-point,
> they're practically idle:  CPU time averages less than 20%, network and disk
> I/O is minimal.
>
> I'd like to hear how some of you have your McAfee environments configured
> and what (if any) issues you've had similar to this one.  As usual, much
> thanks in advance!
>
> Jeff Mery - MCSE, MCP
> National Instruments
>
> -------------------------------------------------------------------------
> "Allow me to extol the virtues of the Net Fairy, and of all the fantastic
> dorks that make the nice packets go from here to there. Amen."
> TB - Penny Arcade
> -------------------------------------------------------------------------