Search <book_title>...

NetBackup™ Web UI Administrator's Guide

Last Published: 2024-01-16

Product(s): NetBackup (10.3.0.1)

Malware scanning workflow for OST and AdvancedDisk

The following figure displays the workflow of malware scanning for OST and AdvancedDisk.

The following prerequisites exist for malware scanning of OST and AdvancedDisk:

MSDP component for example, SPWS, VPFSD are required for an instant access mount. Hence for OST and AdvancedDisk storage, any one of the media servers must be configured as MSDP storage server so that it can serve the instant access API.
Primary servers and media servers must be upgraded to NetBackup version 10.3.
Media servers must be accessible to the OST or AdvancedDisk storage server.
OST plug-in must be deployed on instant access (host with MSDP components) hosts. No new version of OST plug-ins is required.
Compatible instant access host (RHEL).
The throttling limit on concurrent instant access from OST and AdvancedDisk STU is same as instant access from MSDP.

For a complete list of supported OST devices, see the NetBackup Software Compatibility List or NetBackup Hardware Compatibility List.

The following steps depict the workflow for malware scanning for OST and AdvancedDisk.

Using the On Demand Scan APIs, the backup image is added to the worklist table on Primary server.
Primary server identifies the available scan host from the specified scan host pool.
As part of processing the work list:
(2.1) Create media server for instant access:
- From the backup images, it finds out the storage server.
- From the storage server it finds out the eligible media server.
  Media server with instant access capability.
  Media server with NetBackup version 10.3 or later.
- Sends the instant access API request to the selected media server.
- If multiple media servers are eligible for an instant access mount request, it selects the media server with minimum number of ongoing instant access requests. This way it can distribute the instant access requests and achieve the load balance.
(2.2) Get IM & TIR
- On the selected media server, in the context of instant access API, it fetches the IM and TIR information from the primary server. It stores the information in the same format that the OS requires for mounting the backup image by VPFSD.
- After instant access mount, for IO file, VPFSD uses OST API to read backup image from storage server.
- Update worklist with images for which instant access was performed with mountId, exportPath, storageserver, and status.
The primary server identifies the available MSDP media server and instructs the media server to initiate the malware scan.
Note:
The media server that is selected for the instant access mount and the server that is selected for communication with the scan host can be the same server or a different server.
When it receives the scan request, the scan manager from the media server initiates the malware scan on the scan host using thin client (nbmalwareutil) through remote communication using SSH.
Depending on the configuration of scan host, from the scan host it mounts the export using either NFS or SMB from the media server. This media server is where the backup image is mounted using instant access API.
Scan is initiated using the malware tool that is configured in the scan host pool.
Note:
VPFSD on the media server, uses STS_XXX APIs to open and read the backup images from the OST or AdvancedDisk storage server.
After the scan is completed, the scan host unmounts the export path from the media server where backup image is mounted using instant access API.
Malware scan status is updated to the media server over SSH. Scan logs are copied to the media server log directory.
Media server updates the scan status and the infected file list (if there are any infected files) to the primary server.
Primary server updates the scan results and deletes instant access request to the selected media.
Malware scan status notification is generated.