Attachment uploads are currently disabled. This is a temporary situation and will resume as normal in the coming days.
UNSOLVED
isilon icap av scanning
we recently implemented an icap configuration with trendmicro as the AV product on our isilon 7.0.2.5 cluster (7 nodes). I have roughly 14TB of content and performed an initial manual scan that took over 3 weeks to complete. A subsequent Scheduled scan against the same content took approximately 30 hours. The scan parameters were the same with the only exclusion being files over 2GB aren't scanned.
I'm a bit skeptical that the initial scan of 3+ weeks can be reduced to 30 hours, I did have EMC/Isilon look into the logs and they did not see any errors and their perception is that the scan was successful.
Does anyone have any experience similar to mine. Or any thoughts whether the initial scan set a 'flag' on each file, and only those changed or new files were scanned on the subsequent scheduled scan?
Thanks.
Unchanged files will also get scanned if the virus database is updated since last scan according to the AV whitepaper listed below. The "Virus database" I believe are the virus definitions (isi avscan config and look for defs) which gets released/updated atleast once a week on the ICAP servers and most likely the weekly/monthly policy based scan will scan all files except those listed in the exceptions list.
"Before ONEFS sends a file to be scanned, it ensures that scan is not redundant. If a file has not been modified, OneFS will not send the file to be scanned unless the Virus database on the ICAP server has been updated since last scan."
docu45800_White-Paper_-Antivirus-Solutions-With-EMC-Isilon-Scale-Out-NAS-.pdf
Peter_Sero
6 Operator
•
1169 Posts
1680
0
Posted September 3rd, 2014 19:00
Good point indeed!
thanks for the replies. I had read that in the guide that once the icap av server had a update to the virus db, it would rescan all the files again. If that was the case, i would have expected to see a much longer scan time than I did. I will have to wait for the next scheduled scan, which is the 3rd saturday of the month and see how long that takes.
Peter_Sero
6 Operator
•
1169 Posts
1680
1
Posted August 21st, 2014 07:00
You're right, unchanged files are not scanned again.