Isilon avscan Statistics, Interpretation of efs.bam.av.stats

IHAC with a 5 node X410 cluster. 5 ICAP servers are configured and connected.

nuea-snisi05-4# isi antivirus servers list

Url                          Description    Enabled

----------------------------------------------------

icap://dcew-ificap01.gfk.com McAfee ICAP VM Yes

icap://dcew-ificap02.gfk.com McAfee ICAP VM Yes

icap://nuew-ificap01.gfk.com McAfee ICAP VM Yes

icap://nuew-ificap02.gfk.com McAfee ICAP VM Yes

icap://nuew-ificap03.gfk.com McAfee ICAP VM Yes

----------------------------------------------------

Total: 5

Checking the av statistics I found the following (After clearing the stats and running again for about an hour)

nuea-snisi05-4# isi_sysctl_cluster efs.bam.av.stats

efs.bam.av.stats=

scanned:                475521               scan_on_open:      0

scan_on_read:           0                    scan_on_close:     475521

manual_scan:    0

current_wi_count:       2                    max_wi_count:      6562

timeout:                163963               success:           204994

quarantine:             0                    repair:            0

truncate:               0                    infected:          0

skipped:                224167               failed:            46354

Can anybody help with more information on the shown statistic values?

scanned is the same as scan_on_close . That is the way it should be.

Is skipped the number of files that are scanned, but filtered out? The are a lot of file extensions filtered on this cluster.

Scanned - skipped is 251354. That is about he same as the sum of "Success + failed" .

But does timeout mean. That is a pretty high number

The same for failed , that about 10%.

Customer claims to have latency issues. Just trying to investigate if the av-engine is part of the problem.