Does ENSSP/VSES share a global cache like MOVE AV?
No. The storage appliance keeps the clean file cache, if there’s one configured for the storage appliance. ENSSP/VSES sends a notification to the storage appliance when DATs are updated. It's up to the storage appliance to delete its cache when notified and isn’t the responsibility of ENSSP/VSES.
How does ENSSP/VSES scan large files?
Only a small subset of a file is scanned. The engine determines which parts. RPC storage appliances allow ENSSP/VSES to access their file systems directly, greatly enhancing scan request fulfillment speed. ICAP storage appliances must copy the whole file to be scanned to the ENSSP/VSES scanner first, before the engine can then scan. So, scan request fulfillment times are longer than with RPC. So, file size and network saturation are more important in an ICAP scenario.
Does ENSSP/VSES load its own DAT and Engine or does it use what the McShield service loads?
ENSSP/VSES uses the McShield service as its DAT and Engine server.
Does ENSSP/VSES use threads from the McShield service if there’s excessive load?
The McShield service spawns scan threads to serve each ENSSP/VSES scan request it receives. This thread count is irrespective of other scan threads related to local ENS/VSE scanning.
What is the relevance of the ENSSP/VSES scan thread configuration and how does it affect the needed scanner count?
Depending on your environment, you must plan for ENSSP/VSES to handle the expected load. You determine this load as follows:
- You have y number of physical filers.
- You have z number of discrete filer IP addresses that send scan requests.
For ICAP
Deploy
2x(y) scanners. Configure each scanner’s ICAP scan thread count for
20*x(z) threads.
For NetApp
Deploy
2x(y) scanners. Configure each scanner’s NetApp scan thread count for
50*x(z) threads.
IMPORTANT: The filer vendor must fill this number based on how many simultaneously outstanding scans request the filer's operating system version issues from a discrete filer IP address.
ENSSP/VSES ICAP and RPC scanners can each be configured with a maximum of 800 threads. These threads act as buffers for incoming rushes of requests. This thread count doesn’t indicate how many scan threads can be handled in a manner conducive to performance.
Test in the working environment. If the default logs (ENSSP)
ICAPStats_Activity.log / (VSES)
Stats_ICAP.log 'threads used' counter + (ENSSP)
NetAppStats_Activity.log / (VSES)
Stats_NetApp.log 'threads used' counter are greater than or equal to 40 threads consistently in use over many logging increments, it indicates server stress. (Dependent on the robustness of the physical hardware of the ENSSP/VSES scanner.) To distribute the load so that service dropouts don’t occur during peak load periods, consider adding ENSSP/VSES scanners.
NOTE: If the scanner only scans ICAP or NetApp filers, only the (ENSSP)
ICAPStats_Activity.log / (VSES)
Stats_ICAP.log or the (ENSSP)
NetAppStats_Activity.log / (VSES)
Stats_NetApp.log, respectively, need to be considered.
Back to Contents
