Virus Scan

The Virus Scan service will scan for viruses at the filesystem level. When a file is accessed from any protocol, the Virus Scan service will first scan the file, and both deny access and quarantine the file if a virus is found. Once a file has been scanned with the latest virus definitions, it is not rescanned until it is next modified. Files accessed by NFS clients that have cached file data or been delegated read privileges by the NFSv4 server may not be immediately quarantined.

Properties

Property	Description
Maximum file size to scan	Files larger than this size will not be scanned, to avoid significant performance penalties. These large files are unlikely to be executable themselves (such as database files), and so are less likely to pose a risk to vulnerable clients. The default value is 1GB.
Allow access to files that exceed maximum file size	Enabled by default, this allows access to files larger than the maximum scan size (which are therefore unscanned prior to being returned to clients). Administrators at a site with more stringent security requirements may elect to disable this option and increase the maximum file size, so that all accessible files are known to be scanned for viruses.

Changing services properties is documented in the BUI and CLI sections of services. The CLI property names are shorter versions of those listed above.

File Extensions

This section describes how to control which files are scanned. The default value, " * ", causes all files to be scanned. Scanning all files may impact performance so you can designate a subset of files to scan.

For example, to scan only high-risk files, including zip files, but not files with names that match the pattern "data-archive*.zip", you could configure the following settings:

Action	Pattern
Scan	exe
Scan	com
Scan	bat
Scan	doc
Scan	zip
Don't Scan	data-archive*.zip
Don't Scan	*

Note: You must use "Don't Scan *" to exclude all other file types not explicitly included in the scan list. A file named "file.name.exe.bat.jpg123" would NOT be scanned, as only the "jpg123" portion of the name, the extension, would be compared against the rules.

Do NOT use exclude settings before include settings. For example, do not use a "Don't Scan *" setting before include settings since that would exclude all file types that come after it. The following example would not scan any files:

Action	Pattern
Don't Scan	*
Scan	exe
Scan	com
Scan	bat
Scan	doc
Scan	zip
Don't Scan	data-archive*.zip

Scanning Engines

In this section, specify which scanning engines to use. A scanning engine is an external third-party virus scanning server which the appliance contacts using ICAP (Internet Content Adaptation Protocol, RFC 3507) to have files scanned.

Property	Description
Enable	Use this scan engine
Host	Hostname or IP address of the scan engine server
Maximum Connections	Maximum number of concurrent connections. Some scan engines operate better with connections limited to 8.
Port	Port for the scan engine

Logs

Log	Description
vscan	Log of the Virus Scan service

To view service logs, refer to the Logs section from Services.

Tasks

The following are example tasks. See the BUI and CLI sections for how these tasks apply to each interface method.

Virus Scan Tasks

Configuring virus scanning for a share

Go to Configuration->Services->Virus Scan.
Set desired properties.
Apply/commit the configuration.
Go to Shares.
Edit a filesystem or a project.
Select the "General" tab.
Enable the "Virus scan" option.

Skip Navigation Links
Exit Print View
	Oracle ZFS Storage Appliance Administration Guide