Thanks for the information! DO you have any information as to a typical user might put on a Celerra? How many file accesses? How many writes? Etc.

Dean Berry, SAIC

SAN/Storage Engineer

256-450-2351

This is too much dependant on the environment, but in a typical file server 60-70% are reads and 30-40% are writes.

Hi,

This is the viruschecker and CAVA scanning process take place :

1. Virus Checker Agent on Data Mover monitors files and when certain conditions are met (such as when writing to a file, access time,other configuration parameters), will initiate Scan check Request to the CAVA Service that runs on the AV engine, using the ONC/RPC interface protocol, and presenting the file name path using UNC (\\Data Mover\$CHECK\filename) (Path includes the default CHECK$ share location)
2. Next, the CAVA service attempts to open the file using RPC and SMB Read
3. Once file is opened, the AV engine antivirus driver detects the activity, and triggers it to run a Scan. At the same time, it blocks the CAVA services “file open” request from completing until the file is properly scanned.
4. CAVA actually passes a file’s signature to the AV Server, which checks its antivirus definition files for a match. For compressed files, the whole content is passed to the AV Server for scanning.
5. Once scan is complete and AV engine has taken it’s action, it then releases the block on the CAVA “open file”
6. CAVA performs a file request, then closes the file and sends response to Data Mover

SUMMARY OF CAVA PROCESS:

1. Data Mover check request to CAVA
2. CAVA opens file
3. CAVA queries file
4. CAVA closes file
5. CAVA sends response back to Data Mover

EXAMPLE OF VIRUS CHECKING PROCESS:

1. Client has file opened for writing and initiates a close on the file
2. Data Mover obtains exclusive lock and places file into virus checker queue, which is serviced by a dispatch thread
3. RPC call is made by VC to AV Server containing UNC path to file to be checked in the Queue
4. AV Server (via Checker Service) receives RPC call & generates ‘file open’ kernel request using rights of EMC V.Checking User
5. Kernel open is intercepted by VC agent and retrieves portions of locked file for inspection & followup action
Note: AV Server actually opens the file twice (Create AndX), once using CAVA agent, and then again using AV Client
6. Kernel call returns & AV Server Checker Service returns RPC call to Celerra.
7. Celerra receives RPC call and unlocks file

Note :

A file signature is data used for identify or verify the content of a file. In particular, it may refer to:

File magic number: bytes within a file used to identify the format of the file; generally a short sequence of bytes (most are 2-4 bytes long) placed at the beginning of the file;
File checksum or more generally the result of an hash function over the file content: data used to verify that the file content integrity, generally against transmission errors or malicious attacks. The signature can be included at the end of the file or in a separate file.

We use a rule of thumb of a minimum of two CAVA servers, and one additional for each 500 simultaneous users.

Gustavo Barreto.

Thanks!

Dean Berry, SAIC

SAN/Storage Engineer

256-450-2351

Hi,

If you do perform multiple writes to a file, do you get multiple scans? Or only on close?

Thanks,

Dean

Dean Berry, SAIC

SAN/Storage Engineer

256-450-2351

Hi,

Every time the file is saved, it is scanned ( if the extension matches the masks setting ).

Remember when a file ( MS office for example ) is opened, a copy is copied to the local client, so it will only be scanned when you save it, or when the application does the "auto saving" if enabled.

Please, see the "Scanning quick glance chart" on "Using Celerra Anti Virus Agent" on Powerlink.

Gustavo Barreto.

Thanks!

Dean Berry, SAIC

SAN/Storage Engineer

256-450-2351

we are using CAVA in a virtual environemt.

about 5000 users spread throughout North America with the Celerra centralized.

2 Cava servers, using mcafee (initially physical then p2v'd)

Using about 30TB on the celerra various disk types (SATA & SCSI)

I don't have specific details on load or performance so this is pretty subjective, but...

my users did not notice any difference between having physical or or virtual CAVA servers.

GB

Thanks for the info!

Dean Berry, SAIC

SAN/Storage Engineer

256-450-2351

Hi GB,

thanks very much for your feedback – always good to hear real life customer data.

Do you scan everything or just specific extensions ?

Regards

Rainer