A clarification to Michel's excellent information. "...files are always written to disk, whenever they contain a virus or not."
The filer will request a scan for viruses when there is a file extension match and the client request is one of: a) file open b) file rename c) file close (but only if the file was modified)
When a file is created there is no scan. When the newly created file is written to, there is no scan. Scanning after each write would kill performance. However, when the file is closed, a scan will occur. As long as the anti-virus server has been set to clean/quarantine/delete if viruses are detected, any infection will be taken care of right then, not when a second client subsequently opens the file.
-----Original Message----- From: Michel GELDENHUYS [mailto:michel.geldenhuys@danone.com] Sent: Tuesday, December 16, 2003 8:48 AM To: Toasters@mathworks.com Subject: Re: Virus Protection ideas
Hi Jon,
I think you have two options: - the first one is to forget about virus scanning on your Filer and rely on antivirus software installed on your workstations and servers ;-) - the second one is to go with the virus protection for CIFS way implemented in Data Ontap.
Extract from DPG: "CIFS virus protection is a Data ONTAP feature that allows a virus-scanning PC client running Network Appliance-compliant antivirus applications to provide on-access virus scanning of files on a filer. On-access virus scanning means that a file is scanned before a CIFS client is allowed to open it." So files are always written to disk, whenever they contain a virus or not. This is to keep the blasting performance of our Filers at the top. But when an "open file" request is issued, Data Ontap interacts with the antivirus server so that the second scans the file and eventually prevent access to it in case it's infected.
You'll find all the story in DOT's Data Protection Guide (see following URL, requires NOW access: http://now.netapp.com/NOW/knowledge/docs/ontap/rel642p6/html/ontap/dpg/vscan...) For compliant antivirus software, Symantec and Trend have one: Symantec: http://enterprisesecurity.symantec.com/products/products.cfm?ProductID=145 Trend Micro: http://www.trendmicro.com/en/products/file-server/sp-netapp/evaluate/overvie...
Kind regards,
Michel Geldenhuys Danone Belgium SA/NV +32 2 776 68 23 michel.geldenhuys@danone.com
"Jon Kroff" JKroff@hollandhart.com Sent by: owner-toasters@mathworks.com
16/12/2003 17:14
To: Toasters@mathworks.com cc: Subject: Virus Protection ideas
I am about to consolidate all data storage on to a FAS940 using iSCSI LUNs and CIFS. I was wondering what kind of virus protection companies are using on their appliances for their simple CIF shares. We currently own the Trend Micro suite as well as Symantec suite, if either of those would work. Any input is greatly appreciated.
Jon Kroff Network Engineer Holland & Hart LLP 555 17th Street, Suite 3200 Denver, CO 80202 Phone: 303.295.8308 E-mail: jkroff@hollandhart.com
CONFIDENTIALITY NOTICE: This message is confidential and may be privileged. If you believe that this email has been sent to you in error, please reply to the sender that you received the message in error; then please delete this e-mail. Thank you.