Only doing scheduled scans would leave you with a significant risk of
infection with the rate that viruses spread today. Plus, on a large filer,
a complete file-by-file scan might take hours if not days...that's a long
window of opportunity for viruses to infect files and other clients to pick
them up.
And you're right, the viruses don't know how to infect the filer per se.
The reason you want the virus scanning is to prevent other infected machines
from infecting files on the filer.
In other words, virus scans your network, find the file share, and infects
every doc and exe file it finds on the filer, possibly thousands of infected
files or more in a very short time.
Now, your filer is full of infected files. Some other client, with no a/v
or an insufficiently-updated a/v definition reads those files and gets
infected itself, spreading the infection further.
Before integrated a/v was available for the filers, we did the best we could
with daily virus scans, which took several hours. Even with that, the day I
made the integrated a/v active, it immediately started catching and cleaning
hundreds of infected files.
--
Mike Sphar - Sr Systems Administrator - Remedy, a BMC Software Company
-----Original Message-----
From: SKIP HOFMANN [mailto:SKIP.HOFMANN@ttisg.com]
Sent: Thursday, July 22, 2004 5:04 PM
To: 'Bui, Marcus'; 'Palmer, Jason (EMEA) ';
'owner-toasters@mathworks.com '; ''toasters@mathworks.com' '
Subject: RE: Trend AV with Filers
We are using Trend AV for our FAS 250 and R200. IS there a way to tell Vscan
to do scheduled scans instead of scanning every file that is currently being
accessed? Also is it really necessary to have a AV scanner on the Filler?
Because I would think most viruses wouldn't know what to do with the OS of
the filler
-----Original Message-----
From: Bui, Marcus [mailto:Marcus.Bui@aiminvestments.com]
Sent: Thursday, July 22, 2004 11:00 AM
To: 'Palmer, Jason (EMEA) '; 'owner-toasters@mathworks.com ';
''toasters@mathworks.com' '
Subject: RE: Trend AV with Filers
Check the Windows Domain Controllers listed as having connection with the
Filer. I think the command is > cifs domaininfo
I seen this msg when one of the DC's link with the Filer is broken. Try
stop/restart the virus services.
cheers,
Marcus
-----Original Message-----
From: owner-toasters@mathworks.com
To: 'toasters@mathworks.com'
Sent: 7/22/04 11:59 AM
Subject: Trend AV with Filers
Hi -
We are currently having problems with ou virus scan servers de
registering with the filers...
Extract from Syslogs...
Tue Jul 20 03:00:00 GMT [<filer>: kern.uptime.filer:info]: 3:00am up
19:03 0 NFS ops, 4955185 CIFS ops, 46 HTTP ops, 0 DAFS ops, 0 FCP ops, 0
iSCSI ops
Tue Jul 20 03:01:33 GMT [<filer>: Auth08:warning]: Cannot connect to
server. Session setup error: Called name not present (0x82)
Tue Jul 20 03:02:37 GMT [<filer>: Auth01:warning]: Cannot connect to
server. Socket connect error: Resource temporarily unavailable
Tue Jul 20 03:03:37 GMT [<filer>: Auth05:warning]: Cannot connect to
server. Socket connect error: Resource temporarily unavailable
Tue Jul 20 03:04:37 GMT [<filer>: Auth00:warning]: Cannot connect to
server. Socket connect error: Resource temporarily unavailable
Tue Jul 20 03:05:37 GMT [<filer>: Auth02:warning]: Cannot connect to
server. Socket connect error: Resource temporarily unavailable
Tue Jul 20 03:06:37 GMT [<filer>: Auth03:warning]: Cannot connect to
server. Socket connect error: Resource temporarily unavailable
Tue Jul 20 03:07:37 GMT [<filer>: Auth09:warning]: Cannot connect to
server. Socket connect error: Resource temporarily unavailable
Tue Jul 20 03:12:57 GMT [<filer>:
vscan.server.connecting.disconnect:info]: CIFS: Vscan server <Scanner>
deregistered and will be removed from the list of available vscan
servers.
Tue Jul 20 03:12:57 GMT [<filer>: OffloadWorker06:info]: Connection with
<Scanner> terminated
Tue Jul 20 03:12:57 GMT [<filer>: vscan.dropped.connection:warning]:
CIFS: Virus scan server <Scanner> (123.456.789.123) has disconnected
from the filer.
Tue Jul 20 03:12:57 GMT [<filer>: vscan.server.connectedNone:warning]:
CIFS: Virus scanning is enabled but no vscan (anti-virus) servers are
connected to the filer.
Tue Jul 20 03:13:27 GMT [<filer>: vscan.server.connectedNone:warning]:
CIFS: Virus scanning is enabled but no vscan (anti-virus) servers are
connected to the filer.
Tue Jul 20 04:00:00 GMT [<filer>: kern.uptime.filer:info]: 4:00am up
20:03 0 NFS ops, 5024835 CIFS ops, 46 HTTP ops, 0 DAFS ops, 0 FCP ops, 0
iSCSI ops
There is a bug note (Bug ID: 81237) on the NOW site which states 'This
is believed to be a problem with a vendor's anti-virus software.'
Has anyone else had these issues ? If so, is there a work around or a
fix ?
Thanks,
Jason
-----------------------------------
Jason Palmer <Team Leader>
Messaging & Storage Implementation
MCI [EMEA]
-----------------------------------
[e]: jason.palmer@uk.mci.com
[i]:
http://www.mci.com/uk http://www.mci.com/uk
-----------------------------------
-----------------------------------------
Confidentiality Note: The information contained in this message, and any
attachments, may contain confidential and/or privileged material. It is
intended solely for the person or entity to which it is addressed. Any
review, retransmission, dissemination, or taking of any action in reliance
upon this information by persons or entities other than the intended
recipient is prohibited. If you received this in error, please contact the
sender and delete the material from any computer.
Mike Sphar