Cellera antivirus software

Please take a look at the EMC Support Matrix, there are all supported Antivirus versions listed

Hello,

You can use CAVA (celerra antivirus agent) with third-party antivirus software to scan files on Celerra.

I think that there is currently support for Symantec, McAfee, Sophos, Trend and some others.

There is an excellent PDF called "Using Celerra AntiVirus Agent" in the docs section of Powerlink which will tell you everything you need to know about setting this up.

HTH,
Sheppie

For a simple scan you can use any AV product that supports scanning network drives

If you want on-access AV scanning that works through the CAVA/CEE interface - basically the Celerra blocks and tells an external AV server to scan the file

see attached for an overview

For this you also need a Celerra license based on the number of CAVA servers.
Plus the correct version of the AV software (see support matrix or CAVA/CEE releases notes on Powerlink)

Rainer

Powerlink (powerlink.emc.com) would be a good starting point.
Or try google, searching for "EMC support matrix" gives you http://elabnavigator.emc.com/

Tell me please, where I can take this support matrix or CAVA/CEE releases notes? I can't find them.
Thanks.

And Tell me please:

I have Cellera NS500G? what about CAVA... I must to turn on it or CAVA allready turn on?

Cava is a windows software which needs to be installed on the same windows server, where the antivirus software is.

The celerra needs to be configured to send scanning requests to the prepared windows antivirus server.

For details please read the "Using EMC Celerra AntiVirus Agent" (CAVA) manual, which is also available on powerlink.

is Celerra have any integrated antivirus software?

no

Hi All,

I will be implementing the antivirus software of celerra which is the CAVA with CEE.

I already read some procedures on how to install that software. Can you explain further how CEE will work with CAVA?

How can i test the CEE during the implementation?

Thanks in advance!

Regards,

shiela

Hi Shiela!

CAVA with CEE incorporates a new client, which allows CAVA to now use MS-RPC over SMB instead of third-party software that used to provide ON-RPC.  Basically, the new installation is much more streamlined and in my limited experience (two months or so), more stable.  Others here can correct me, but it appears that CAVA now uses Microsoft's MSRPC framework entirely for message passing and desinations, making it more robust.  In my observation, there's nothing to 'test' with CEE, but with CAVA or CEPA, if you're implementing that.  The document Using Celerra Event Enabler has the all the installation and testing steps necessary to ensure that CAVA is working.  You can always download a test virus file from EICAR, http://www.eicar.org/anti_virus_test_file.htm, and see if CAVA detects it and responds appropriately.

The most common CAVA implementation problems I've seen are: not configuring the CAVA domain user with correct login rights, not putting the CAVA user in the right group on the data mover and not setting the AV client to scan network drives (there used to be an old version of Trend that needed a registry hack to scan network shares).

Hope this helps!

Karl

for the AV purpose CAVA is the same as CEE

CEE is the newer framework that includes CAVA

Hi Shiela,

that is all a function of the AV software and not of CAVA/CEE - so it depends on the particular AV vendors capabilities.

CAVA/CEE is just an interface that tells the AV scan engine that there is file that needs scanning (i.e. because it hasnt been scanned before, has changed or the AV patterns were updated)

It doesnt do any cleaning/deleting - it merely blocks the client IO - lets the AV software do its job and waits for a response that its ok to continue the client IO

Rainer

Hi Karl,

Thanks for the explanation.

One more question. After the CAVA detects the virus, where we can found the logs stating that said event?

What will be the behavior of cava when it detects the virus? Last time i tried to test the eicar virus, and then when the cava detects the virus, it automatically delete the virus file.

Is this the behavior of CAVA? or I can set it to not delete and just heal the file.

Can i set the notifications through their email?

Thanks a lot,

Regards,

shiela

Thanks Rainier,

Can you give some points to consider/ best practice  when implementing CAVA/CEE with trend Micro?

The setup will be using only 1 CAVA server. Is there a limitation of users to be considered? Normally,  how long the scan will take?

Thanks!

Regards,

shiela