Hello SymTeam!
I have a few questions regarding the funtioning or SAV for NAS.
Background:
I have have a pair of Scan Engine servers configured to scan a pair of NetApp filers. It is expected that this setup will allow for load balancing and failover for scanning. Currently each Scan Engine server is scanning the same Filer even though both Filers are meant to be scanned. The second Filer is not being scanned at all. When an error is encountered the same error shows up on both Scan Engine servers.
1. I need some more info on how a Scan Engine pair work together.
a. Alerts are logged when a Scan Engine cannot scan a file (cause to be determined). The same error is being logged on both Scan Engine servers. I am GUESSING that when such an error does occur on one Scan Engine then it may ask the another Scan Engine to try to scan the file. This MAY BE why I am seeing the same errors for the same files across both Scan Engines. Can I get this functionality confirmed please?
2. I need more info on how the Scan Engines work with multiple NetApp Filers.
a. All the alerts/logs I observe I seem to focus on just ONE Filer IP – never across both Filer IPs. Is this normal?
c. Do the Filers automatically load balance across the two Scan Engine servers or are the Scan Engine servers listed in the NetApp console configured as a "primary" and "secondary"? If so, how do you set the second Scan Engine server to be a "secondary"? Can I get this functionality confirmed please?
From the NetApp, the current setup can be seen below:
Virus scanners(IP and Name) P/S Connect time (dd:hh:mm) Reqs Fails Curr. Reqs.
-------------------------------------------------------------------------------------------
203.15.191.118 \\ScanEngineServer1 Pri 06:16:59 391937 273 0
203.15.191.119 \\ScanEngineServer2 Pri 05:21:37 391936 295 0
3. I need more info on how the Scan Engines work with client PC Network AV scanning.
a. The current architecture implemented has both the Scan Engines and SEP clients setup to scan network files. This means that when a network file is accessed via a client PC, the Scan Engine(s) first scan the file – then, the PC SEP client will also attempt to scan the file.
This does not seem very efficient & doubles up on scanning that perhaps could be considered overkill. It is suggested in some knowledgebase articles that this could be a possible cause of the scanning errors I am observing, ie. because of a conflict between the Scan Engine & the local PC AV tool both trying to scan the file. Some articles recommend disabling the PC Network file AV scanning capabilities if Scan Engines are employed. Not sure if this can be done on a per share/UNC/Filer basis or not.
4. When can I get an admin guide for NetApp so I can see what commands are available?
Cheers,