NetBackup™ Security and Encryption Guide

The following steps depict the workflow for malware scanning for OST and AdvancedDisk.

1. Using the On Demand Scan APIs, the backup image is added to the worklist table on Primary server.

   Primary server identifies the available scan host from the specified scan host pool.

2. As part of processing the work list:

   (2.1) Create media server for instant access:

   • From the backup images, it finds out the storage server.

   • From the storage server it finds out the eligible media server.

     Media server with instant access capability.

     Media server with NetBackup version 10.3 or later.

   • Sends the instant access API request to the selected media server.

   • If multiple media servers are eligible for an instant access mount request, it selects the media server with minimum number of ongoing instant access requests. This way it can distribute the instant access requests and achieve the load balance.

   (2.2) Get IM & TIR

   • On the selected media server, in the context of instant access API, it fetches the IM and TIR information from the primary server. It stores the information in the same format that the OS requires for mounting the backup image by VPFSD.

   • After instant access mount, for IO file, VPFSD uses OST API to read backup image from storage server.

   • Update worklist with images for which instant access was performed with mountId, exportPath, storageserver, and status.

3. The primary server identifies the available MSDP media server and instructs the media server to initiate the malware scan.

   Note:

   The media server that is selected for the instant access mount and the server that is selected for communication with the scan host can be the same server or a different server.

4. When it receives the scan request, the scan manager from the media server initiates the malware scan on the scan host using thin client (nbmalwareutil) through remote communication using SSH.

   Note:

   In NetBackup 10.5 or later, the hash values (SHA-256) of infected files are computed when infected files are found by the NetBackup Malware Scanner. The values can be viewed when exported through Export infected files list.

5. Depending on the configuration of scan host, from the scan host it mounts the export using either NFS or SMB from the media server. This media server is where the backup image is mounted using instant access API.

6. Scan is initiated using the malware tool that is configured in the scan host pool.

   Note:

   VPFSD on the media server, uses STS_XXX APIs to open and read the backup images from the OST or AdvancedDisk storage server.

7. After the scan is completed, the scan host unmounts the export path from the media server where backup image is mounted using instant access API.

8. Malware scan status is updated to the media server over SSH. Scan logs are copied to the media server log directory.

9. Media server updates the scan status and the infected file list (if there are any infected files) to the primary server.

10. Primary server updates the scan results and deletes instant access request to the selected media.

    Note:

    In NetBackup 10.5.0.1 or later, the hash values (SHA-256) of infected files are maintained in the Enterprise Media Manager (EMM) database. The hash values are submitted to the triggered file hash search job request.

11. Malware scan status notification is generated.