CAVA not detecting EICAR file

Question

Hello,

our customer has a VNX Unified and we have set up CAVA and it seems to be running OK. But when we copy the EICAR "test-virus" it is not being detected/deleted. We have copied this file to the local C: drive of one of the AV Servers (McAfee VirusScan Enterprise) and it is detected and removed immediately. We copy it to a VNX filesystem and the file is created and the AV does nothing. Any ideas?

[nasadmin@vnx tmp]$ server_viruschk server_2

server_2 :

10 threads started.

2 Checker IP Address(es):

11.22.33.44 ONLINE at Mon Dec 7 14:16:47 2015 (GMT+01:00)

HTTP, CAVA version: 6.7.0.0

AV Engine: Network Associates

Remediation Window: 0 seconds

Server Name: 11.22.33.44

Last time signature updated: Sat Dec 5 02:45:53 2015 (GMT+01:00)

11.22.33.55 ONLINE at Mon Dec 7 14:16:47 2015 (GMT+01:00)

HTTP, CAVA version: 6.7.0.0

AV Engine: Network Associates

Remediation Window: 0 seconds

Server Name: 11.22.33.55

Last time signature updated: Sat Dec 5 02:12:52 2015 (GMT+01:00)

1 File Mask(s):

*.*

4 Excluded File(s):

*.TMP *.VMDK DESKTOP.INI PAGEFILE.SYS

Share \\cava1\CHECK$.

RPC request timeout=25000 milliseconds.

RPC retry timeout=5000 milliseconds.

High water mark=200.

Low water mark=50.

Scan all virus checkers every 10 seconds.

When all virus checkers are offline:

Continue to work with Virus Checking and CIFS.

Scan on read disable.

Panic handler registered for 65 chunks.

MS-RPC User: cava1$

MS-RPC ClientName: cava1.company.com

[nasadmin@vnx tmp]$ server_viruschk server_2 -audit

server_2 :

Total Requests: 4996741.

Requests in progress: 0.

NO ANSWER from the Virus Checker Servers: 0.

ERROR_SETUP: 0.

FAIL: 0.

TIMEOUT: 0.

min=445 uS, max=11609206 uS, average=6679 uS

0 files in the collector queue.

0 files processed by the AV threads.

[nasadmin@vnx tmp]$ cat viruschecker.conf

CIFSserver=cava1

addr=11.22.33.44:11.22.33.55

excl=*.tmp:*.vmdk:desktop.ini:pagefile.sys

masks=*.*

shutdown=no

I suspect it has something to do with the config on the AV servers, but I'm not sure.

Any ideas would be appreciated.

Thanks

Stephen

umichklewis · Answer

You can check the server_log output for messages related to AV cleaning events.  Use 'server_log server_X | grep VC' and you should get messages related to AV events.  Do you have log entries related to your test?

Rainer_EMC · Answer

I would suggest to do a knowledgebase search – there is an article there about testing with EICAR files

For Symantec answer see here https://community.emc.com/message/857048?et=watches.email.thread#857048

SteveK821 · Answer

Might have found the cause.

Looks like the McAfee EPO server overrode the setting on the scan servers to scan network drives. And we can't change it back manually.

Customer has to get this sorted with their AV team before we go any further.

bergec · Answer

Hello

Make sure that the AV engine on AV server is properly configured

Look in the CEE documentation

Most of the time scan network drive and scan on read must be enabled

What often happens is that there is an AV policy which resets the settings

What is strange is that from the audit output it looks like no file was processed by the viruschk on the Data Mover

Claude

Sent from my mobile device

VNX

CAVA not detecting EICAR file

Was this post helpful?