VSEL uses the following processes:
- nailsd - The key daemon that manages the Anti-Virus (AV) functionality in VSEL. It schedules, creates, and recycles scanner processes for On-Access (OAS) and On-Demand (ODS) scanning, manages reporting of scanning errors and events, and handles configuration settings for AV operations.
- scanner - Interfaces with the AV engine. The nailsd process manages the scanner process. Scanners are recycled based on the number of files scanned as defined in the file nailsd.cfg file. Scanners are created in such a way that the AV engine does not need to be re-initialized each time a scanner is created (unless the DATs change or the configuration changes). A separate scanner is used for detection and cleaning, performance, and security reasons. Scanners are spawned to work with specific user credentials for security reasons when cleaning. This means that cleaning scanners are created per user ID. The nailsd process manages the safe roll-in of newly configured scanners or scanners with different DATs. In other words, an additional scanner is created when the DATs change or the configuration changes, and in-progress scanners can continue while new scans operate with a new scanner process.
- mon - The user interface backend. The mon process services requests from the user interface for real-time DAT and configuration changes, and accepts commands to modify the configuration or provide query results. Communications are secured using SSL.
- nailswebd - A pared-down Apache server that provides the user interface web pages. The VSEL web interface is created using JavaScript to ensure no JRE is required and ensure maximum browser compatibility.
- nailslogd - The configuration, log, and alerting component. Events from other VSEL components are sent to the nailslogd process to forward to the SQLite database, Syslog, SMTP alerting, and ePolicy Orchestrator.
- logepo - This process is used to forward events from VSEL to the McAfee Agent and for received DAT update messages from McAfee Agent.
To check the current status of nailsd, mon, and nailswebd:
Use the following command to check the current status of nailsd, mon, and nailswebd:
# /etc/init.d/nails status
In the output of the command, look for process information similar to the following. If a process died unexpectedly and was not recovered, the process will be absent from the output.
- The following indicates that the nailsd process is running:
root 21036 0.0 0.1 4868 2420 ? Ss May20 0:29 /opt/NAI/LinuxShield/libexec/nailsd -c /var/opt/NAI/LinuxShield/etc/nailsd.cfg
- The following indicates that the mon process is running:
root 21309 0.0 0.2 20388 3960 ? Ss May20 0:12 /opt/NAI/LinuxShield/libexec/mon -p /var/opt/NAI/LinuxShield/etc/monitor.cfg
- The following indicates that the nailswebd process is running:
PID = 21319
no. of HTTP servers = 4
PID TTY STAT TIME COMMAND
21319 ? Ss 0:14 /opt/NAI/LinuxShield/apache/bin/nailswebd -d /opt/NAI/LinuxShield/apache -DSSL
You can use the
ps command to show more specific process relationships:
# ps -efH
Example output:
UID PID PPID C STIME TTY TIME CMD
root 2 0 0 May17 ? 00:00:00 [kthreadd]
root 3 2 0 May17 ? 00:00:00 [migration/0]
…
root 21036 1 0 May20 ? 00:00:29 /opt/NAI/LinuxShield/libexec/nailsd -c /var/opt/NAI/LinuxShield/etc/nailsd.cfg
root 21037 21036 0 May20 ? 00:00:01 /opt/NAI/LinuxShield/libexec/nailslogd -p 6 -l 3 -s 4 -c /var/opt/NAI/LinuxShield/etc/nailsd.cfg
root 21038 21037 0 May20 ? 00:00:50 /opt/NAI/LinuxShield/libexec/nailslogd -p 6 -l 3 -s 4 -c /var/opt/NAI/LinuxShield/etc/nailsd.cfg
root 21142 21038 0 May20 ? 00:00:42 /opt/NAI/LinuxShield/libexec/logepo -c /var/opt/NAI/LinuxShield/etc/nailsd.cfg -p 12 -d EPO=n
root 32427 21036 0 00:00 ? 00:00:09 /opt/NAI/LinuxShield/libexec/scanner -e /opt/NAI/LinuxShield/engine/lib/liblnxfv.so -D /opt/NAI/LinuxShield/engine/dat -L /opt/NAI/LinuxS
hield/engine/lib -p 13 -i 1 -I 0
nails 32439 32427 0 00:01 ? 00:00:14 /opt/NAI/LinuxShield/libexec/scanner -e /opt/NAI/LinuxShield/engine/lib/liblnxfv.so -D /opt/NAI/LinuxShield/engine/dat -L /opt/NAI/Linu
xShield/engine/lib -p 13 -i 1 -I 0
