Search <book_title>...

NetBackup™ Security and Encryption Guide

Last Published: 2024-09-30

Product(s): NetBackup & Alta Data Protection (10.5)

About malware scanning

NetBackup finds malware in supported backup images and finds the last good-known image that is malware free. This feature is supported for Standard, MS-Windows, NAS-Data-Protection, Cloud, Cloud-Object-Store, Universal shares, Kubernetes and VMware workloads.

Malware scanning provides the following benefits:

You can select one or more backup images of the supported policy-types for an on-demand scan. You can use a predefined list of scan hosts.
If malware is detected during the scanning, a notification is generated in the Web UI.
In case files are skipped due to not being accessible to scanner or failure from malware scanner, then following respective notifications are generated with information about number and list of skipped files:
- Critical severity: In case malware is found in the backup image and some of the files were skipped during scan.
- Warning severity: In case no malware found in the backup image but some of the files were skipped during scan.
This information can be obtained by clicking on Actions > Export unscannable files list.

Note:

The malware scan job in Activity monitor takes few minutes to reflect the final state of the scan operation running for multiple backup images.

For example, if scan operation runs for 5 backup images in a single request, then the malware scan job in Activity monitor would take 5 minutes to reflect the final state which is after completing the last (fifth) backup image scan job.

Note:

During recovery if user starts recovery from a malware-affected backup image, a warning message is shown and confirmation is required for proceeding with recovery. Only users with permission to restore from malware-affected images can proceed with recovery.

For more information on best practices for malware scanning, refer to Smart use of Malware Scanning in NetBackup.

Malware scanning before recovery

User can trigger malware scan of the selected files/folders for recovery as part of recovery flow from Web UI and decide the recovery actions based on malware scan results.
Catalog entry for the backup image is not updated after recovery time scan as only subset of files are scanned in the backup. Notification would be generated if malware is found as part of recovery time scan.
During recovery time scan all the images in the start and end date are scanned for malware. Malware scanning of backup image may take long time depending on the number of files selected for recovery. It is recommended to set the Start /End date to include only images which are intended to be used for recovery.
User can trigger multiple recovery time scan for same backup image.
Malware scan as part of recovery may take minimum 15-20 minutes for small size backup based on availability of scan host and number of scan jobs in progress. User can track the progress using Activity monitor > Jobs. Scan results would be displayed incrementally in the malware detection page. List of backup images in start and end date would be picked up for malware scan incrementally in batches.
Supported policy types for recovery time scan: Standard, MS-Windows, Cloud-Object-Store, Universal Share, and NAS-Data-Protection.
Note:
For successful recovery time malware scan operation, the media server version must be 10.4 or later.