Malware scanning workflow for OST and AdvancedDisk
For a complete list of supported OpenStorage servers, see the 'OST Storage Servers' section in NetBackup Hardware and Cloud Storage Compatibility List (HCL).
The following figure displays the workflow of malware scanning for OST and AdvancedDisk.
The following prerequisites exist for malware scanning of OST and AdvancedDisk:
MSDP component for example, SPWS, VPFSD are required for an instant access mount. Hence for OST and AdvancedDisk storage, any one of the media servers must be configured as MSDP storage server so that it can serve the instant access API.
Primary servers and media servers must be upgraded to NetBackup version 10.4 or later.
Media servers must be accessible to the OST or AdvancedDisk storage server.
OST plug-in must be deployed on instant access (host with MSDP components) hosts. For more information on the supported versions of OST plug-ins, refer to the NetBackup Hardware Compatibility List.
Compatible instant access host (RHEL).
The throttling limit on concurrent instant access from OST and AdvancedDisk STU is same as instant access from MSDP.
The following steps depict the workflow for malware scanning for OST and AdvancedDisk.
Using the APIs, the backup image is added to the worklist table on Primary server.
Primary server identifies the available scan host from the specified scan host pool.
As part of processing the work list:
(2.1) Create media server for instant access:
From the backup images, it finds out the storage server.
From the storage server it finds out the eligible media server.
Media server with instant access capability.
Media server with NetBackup version 10.3 or later.
Sends the instant access API request to the selected media server.
If multiple media servers are eligible for an instant access mount request, it selects the media server with minimum number of ongoing instant access requests. This way it can distribute the instant access requests and achieve the load balance.
(2.2) Get IM & TIR
On the selected media server, in the context of instant access API, it fetches the IM and TIR information from the primary server. It stores the information in the same format that the OS requires for mounting the backup image by VPFSD.
After instant access mount, for IO file, VPFSD uses OST API to read backup image from storage server.
Update worklist with images for which instant access was performed with
mountId,exportPath,storageserver, andstatus.
The primary server identifies the available MSDP media server and instructs the media server to initiate the malware scan.
Note:
The media server that is selected for the instant access mount and the server that is selected for communication with the scan host can be the same server or a different server.
When it receives the request, the scan manager from the media server initiates the malware scan on the scan host using thin client (
nbmalwareutil) through remote communication using SSH.Note:
In NetBackup 10.5 or later, the hash values (SHA-256) of infected files are computed when infected files are found by the NetBackup Malware Scanner. The values can be viewed when exported through Export infected files list.
Depending on the configuration of scan host, from the scan host it mounts the export using either NFS or SMB from the media server. This media server is where the backup image is mounted using instant access API.
Scan is initiated using the malware tool that is configured in the scan host pool.
Note:
VPFSD on the media server, uses STS_XXX APIs to open and read the backup images from the OST or AdvancedDisk storage server.
After the scan is completed, the scan host unmounts the export path from the media server where backup image is mounted using instant access API.
Malware scan status is updated to the media server over SSH. Scan logs are copied to the media server log directory.
Media server updates the scan status and the infected file list (if there are any infected files) to the primary server.
Primary server updates the scan results and deletes instant access request to the selected media.
Note:
In NetBackup 10.5.0.1 or later, the hash values (SHA-256) of infected files are maintained in the Enterprise Media Manager (EMM) database. The hash values are submitted to the triggered file hash search job request.
Malware scan status notification is generated.