メインコンテンツまでスキップ

ログで Vscan サーバレポートファイルをスキップしました

Views:
92
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
nas
Last Updated:

環境

  • アンチウィルス
  • すべての ONTAP バージョン

問題

Vscan サーバレポートファイルがログに記録されている場合、 Vscan ポリシーに含まれているボリュームでファイルがアクセスされると、要求が AV コネクタに送信されます。

* パケットトレース *

No.     Source                Destination           Time        Protocol Stream
    262 10.73.xx.xx          10.73.xx.xx          70.359527   VSCAN2   11         Session Setup Request (test_svm)
    263 10.73.xx.xx          10.73.xx.xx          70.362714   VSCAN2   11         Session Setup Reply
    264 10.73.xx.xx          10.73.xx.xx          70.362750   SMB2     11         Write Response
    265 10.73.xx.xx          10.73.xx.xx          70.363930   SMB2     11         Read Request Len:2048 Off:0 File: vscan
    266 10.73.xx.xx          10.73.xx.xx          70.363962   SMB2     11         Read Response, Error: STATUS_PENDING
    268 10.73.xx.xx          10.73.xx.xx          71.366315   VSCAN2   11        Scan Request: \volB\New folder\a.txt
    269 10.73.xx.xx          10.73.xx.xx          71.369419   SMB2     11         Read Request Len:2048 Off:0 File: vscan
    270 10.73.xx.xx          10.73.xx.xx          71.369451   SMB2     11         Read Response, Error: STATUS_PENDING


AV コネクタは要求を Trend Macro ソフトウェアに送信します。

* AV コネクタ・ログ *

71.417: [pipe: xxxx.xxx.xxxxx.xxx]Server: Received 110 bytes, ofsPartReq: [0]
71.417:

[Pipe: xxxx.xxx.xxxxx.xxx]
 magic_num    : [4e74417041760002]
 session_id   : [efefbbe7642b6820]
 len          : [110]
 reqId        : [362917]
 type         : [4, req_SCAN]

71.417: Sending id 1 (rsrv-id: 0) for \?\UNC\xxx_xxx.xxx.xxx.xxx\ontap_admin$\volB\New folder\a.txt
71.417: Sent!


Trend Macro ソフトウェアは要求を受信したがスキャンをスキップして AV コネクタに応答を送信したことを報告します。

5632: 4868:0722095301482:SPNT(00000800):* CheckScanTimeOutThread schedule checking ...
5632: 4868:0722095301482:SPNT(00000800):RemoveTimeOutRequest() Now[1469195581], TimeOut[24000]
5632: 4868:0722095301482:SPNT(00000800):RemoveTimeOutRequest() Now[1469195581], TimeOut[24000]
5632: 4868:0722095301482:SPNT(00000800):RemoveTimeOutRequest(), submit time[1469195560] ==>

5632: 4868:0722095307482:SPNT(00000800):* CheckScanTimeOutThread schedule checking ...
5632: 4868:0722095307482:SPNT(00000800):RemoveTimeOutRequest() Now[1469195587], TimeOut[24000]
5632: 4868:0722095307482:SPNT(00000800):RemoveTimeOutRequest() Now[1469195587], TimeOut[24000]
5632: 4868:0722095307482:SPNT(00000800):RemoveTimeOutRequest(), submit time[1469195560] ==>
5632: 4868:0722095307482:SPNT(00000800):File [24][\test_svm.na.bayer.cnb\ontap_admin$\volB\New folder\a.txt] been skipped <<<<<***
5632: 4868:0722095307482:SPNT(00000800):SendScanResultBackToFiler, send result back to Shim
5632: 7912:0722095310201:SPNT(00000800):Receive VS_ScanRequest(25, \?\UNC\xxx_xxx.xxx.xxx.xxx\ontap_admin$\volB\New folder\a.txt) from filer [MOQZ34]
5632: 7912:0722095310201:SPNT(00000800):GetFilerByName: pszFilerName=MOQZ34, bAddFiler=0
5632: 7912:0722095310201:SPNT(00000800):GetFilerByName: g_FilerList.GetCount()=1
5632: 7912:0722095310201:SPNT(00000800):VS_ScanRequest, Type is SCANTYPE_rpc_cluster


このスキップイベントに対する AV コネクタからの応答はありません。
Filer は、同じ結果で要求を再度送信します。

* パケットトレース *

    340 10.73.xx.xx          10.73.104.xx          105.377182  VSCAN2   11         Scan Request: \volB\New folder\a.txt
    341 10.73.xx.xx          10.73.104.xx          105.380104  SMB2     11         Read Request Len:2048 Off:0 File: vscan
    342 10.73.xx.xx          10.73.104.xx          105.380134  SMB2     11         Read Response, Error: STATUS_PENDING
    382 10.73.xx.xx          10.73.104.xx          120.909309  VSCAN2   11         Set Extended Stats
    383 10.73.xx.xx          10.73.104.xx          120.909346  SMB2     11         Write Response
    476 10.73.xx.xx          10.73.104.xx          135.624036  VSCAN2   11         Scan Request: \volB\New folder\a.txt
    477 10.73.xx.xx          10.73.104.xx          135.627476  SMB2     11         Read Request Len:2048 Off:0 File: vscan
    478 10.73.xx.xx          10.73.104.xx          135.627518  SMB2     11         Read Response, Error: STATUS_PENDING


応答が再度受信されないと、 Vscan セッションが切断され、ファイラーが Vscan サーバとの接続を切断します。

* パケットトレース *
       503 10.73.xx.xx          10.73.xx.xx          142.483259  VSCAN2   11         Session Teardown Request
    504 10.73.xx.xx          10.73.xx.xx          142.485052  VSCAN2   11         Session Teardown Reply
    505 10.73.xx.xx          10.73.xx.xx          142.485112  SMB2     11         Write Response, Error: STATUS_END_OF_FILE
    506 10.73.xx.xx          10.73.xx.xx          142.485870  SMB2     11         Close Request File: vscan
    507 10.73.xx.xx          10.73.xx.xx          142.485901  SMB2     11         Close Response, Error: STATUS_FILE_CLOSED
    543 10.73.xx.xx          10.73.xx.xx          162.783746  SMB2     11         Tree Disconnect Request
    544 10.73.xx.xx          10.73.xx.xx          162.783775  SMB2     11         Tree Disconnect Response
    545 10.73.xx.xx          10.73.xx.xx          162.783783  SMB2     11         Session Logoff Request
    546 10.73.xx.xx          10.73.xx.xx          162.783805  SMB2     11         Session Logoff Response

 

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.