Search <book_title>...

NetBackup™ Security and Encryption Guide

Last Published: 2023-03-31

Product(s): NetBackup (10.2)

About malware scanning

NetBackup finds malware in supported backup images and finds the last good-known image that is malware free.

Malware scanning provides the following benefits:

You can select one or more backup images of the supported policy-types for an on-demand scan. You can use a predefined list of scan hosts.
If malware is detected during the scanning, a notification is generated in the Web UI.

Note:

During recovery if user starts recovery from a malware-affected backup image, a warning message is shown and confirmation is required for proceeding with recovery. Only users with permission to restore from malware-affected images can proceed with recovery.

The following steps depict the workflow for malware scanning:

Figure: Workflow for malware scanning

Primary server identifies the available scan host from the specified scan host pool.
Note:
The backup images that fail validation are ignored.
After the backup images are queued for an on-demand scan, the primary server identifies the storage server. An instant access mount is created on the storage server of the configured share type that is specified in scan host pool.
Note:
Currently primary server starts 50 scan threads at a time. Once the thread is available it processes next job in the queue. Until then the queued jobs are in pending state.
From NetBackup version 10.2 onwards, large backups are scanned in batches of 500k files. Each batch is scanned by a separate scan thread. This feature is supported for Standard, MS-Windows and NAS-Data-Protection workloads.
Primary server identifies available MSDP media server and instructs the media server to initiate the malware scan.
MSDP media server deploys the thin client on the scan host over SSH.
Thin client mounts the instant access mount on the scan host.
Scan is initiated using the malware tool that is configured in the scan host pool.
After the scan is completed, the scan host unmounts the instant access mount from the scan host.
Malware scan status is updated to the media server over SSH. Scan logs are copied to the media server log directory.
Media server updates the scan status and the infected file list (if there are any infected files) to the primary server.
Primary server updates the scan results and deletes instant access.
Malware scan status notification is generated.

Malware detection performs an automated cleanup of scan jobs that are older than 30 days.

See MALWARE_DETECTION_CLEANUP_PERIOD.

Note:

You can download a malware scanner from the Microsoft Azure Marketplace and the AWS Marketplace. Follow the instructions on how to install, configure, and use the malware scanner for AWS and Azure.

Refer to the following for more information:

AWS: AWS Marketplace and NetBackup Marketplace Deployment on AWS Cloud

Microsoft Azure: Microsoft Azure Marketplace and Microsoft Azure Marketplace