nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Inode map of BStore

raaj

I’m just trying to improve the Virus Scan process speed or otherwise reduce the amount of time that it is currently taking to scan our production server. The TeamSite5.5 server is running on Solaris 8 and its backing store size is 25GB. The virus scanner takes more than 48 Hrs (and still it is running) to scan the entire /iwmnt filesystem.

While going through some interwoven technical articles and forums, one suggestion was to run the virus scan on the unix filesystem (.ie /local/iw-store/default/d0 folder). Also it was mentioned that it would be enough to scan the file names that end with “-1”. In fact there was much time difference in scanning the /iwmnt and /local/iw-store/default/d0 when it was tested on a small backing store of 2GB.

Now the question is, how to get the relevant filename of the infected “-1” files that the virus scanner would report. I couldn’t find any CLT of TS for this. Under /local/iw-store/default/inodes there are some .pag and .dir database files, will that be of any use. If it is, then how to read the .pag files. Only after finding the filename we can fix or replace with good version of that file.

Say for eg. /local/iw-store/default/d0/d0/d9/f3a-1 is the infected file. So how to find its related file in /iwmnt. In the article it was suggested to look for any broken links or missing files in the web pages and to replace with the correct one. But, this is not a good idea for larger sites and neither it sounds good by any way.

All your help would be highly appreciable and thanks in advance.

Find more posts tagged with

Comments

jed

If you find a virus in the backingstore, your best bet is to contact support. They should be able to help you with the proper course of action.

--
Jed Michnowicz
jedm@sun.com
Content Management Engineering
Sun Microsystems

james1

It is wasteful to run a virus scanner on /iwmnt, as you are finding. You should run the virus scanner on your backing store (/local/iw-store, not /iwmnt).

-- James

--
James H Koh
Interwoven Engineering

raaj

Thanks James. Yes I too prefer scanning the /local/iw-store area. But my concern is, when you get the list of infected file names (file names ending with "-1"). Say if the virus scanner is not able to fix it, then that file should be removed and replaced with any previous good ones. For that i need know its relavant file name under /iwmnt, how to get that.

I need some help to find the file to file map/link between /local/iw-store and /iwmnt. As already pointed, will the *.pag and *.dir database files under inodes folder be of any use here?

gzevin

in order to reduce the time of the virus scan I'd intgerate the scanner with the workflow, so the content that goes to the live site is scanned, and give up the idea of loading the server with the scan process of the whole backing store....

there are command line tools for Unix that could do this. (McAfee, for example)

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU

raaj

Yeah, we already have McAfee virus scanner integrated with workflow and the virus scanner is also regularly updated with latest informations. Inspite of that we do find some file infected by some virus while doing a complete scan on the backing store. So only we want to have this in place. Moreover, this task is scheduled only on the week-end. Hence, server load is not a problem but time is a constraint as it should be finished before monday morning.

gzevin

I am not sure Interwoven will provide you the inside view of their backing store structure..

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU

Migrateduser

Greg's idea about having the virus scan be a part of workflow is a very good one -- concerning an infected sector, I assume you're backing up the backing store regularly? I HAVEN'T TESTED THIS, BUT I wonder if you could simply copy a "good" version of f31a, for instance, and overwrite the infected copy. I also wonder if your virus scan is taking so long because some TS files change frequently so your virus scan needs to rescan them again and again. Just an idea...

Dave

Current Environment(s):
(1) TS 6.5 on W2K3
(2) TS 6.1 SP1 on W2K3
By the way, I miss Unix terribly.

james1

For auditing purposes, isn't it valuable to maintain the virus in the backing store? i.e., if somebody wants to know if a virus was on the web site on October 1, 2003, then you'd be able to say yes or no.

Perhaps you want to scan the most recently published edition, or staging area, of each branch that gets deployed to production?

-- James

--
James H Koh
Interwoven Engineering

Copy of cascade.rptdesign

raaj

Yes we do take backing store backup regularly.
Yes it is possible to copy a good version over the infected one. I have checked this and there wasn't any problem.
The server which i'm using for this R&D is not accessed by any one else.

Migrateduser

In that case -- and only in that case -- after backing up EVERYTHING (yes, even the infected backing store), see if that works. From what I'm reading, it doesn't seem that anyone will quite know how this would turn out so the worst case scenario of this is that it will be an education for everyone.

Dave

Current Environment(s):
(1) TS 6.5 on W2K3
(2) TS 6.1 SP1 on W2K3
By the way, I miss Unix terribly.

gzevin

This is what I also suggested.. a kind of.. But to no avail....

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU

Migrateduser

Maybe it's the hypnotic stare of your photo!

Current Environment(s):
(1) TS 6.5 on W2K3
(2) TS 6.1 SP1 on W2K3
By the way, I miss Unix terribly.

gzevin

Man, the photo is not mine...Do you suggest that the image of ghoti is also a true one?

the hypnosis is, BTW, to make you feel less miserable while you keep missing Unix

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU

Migrateduser

I didn't mean to say that it was a photo of you, but it is your DevNet photo, buddy! I figured it wasn't you, anyway. The photo looks as though it was taken 10-20 years ago. I figure you to be much younger (and less intense-looking) than that guy.

You mean ghoti ISN'T a 3D-rendered fish in real life??? What's going on with the world?!

Current Environment(s):
(1) TS 6.5 on W2K3
(2) TS 6.1 SP1 on W2K3
By the way, I miss Unix terribly.

gzevin

That guys is actually a great French comedian actor -Louis de Funès ....

about ghoti - hm.. he is a 3D fish, as a matter of fact,,

Greg Zevin, Ph.D. Comp. Sc.
Independent Interwoven Consultant/Architect
Sydney, AU

Adam Stoller

Hey! - I resemble that remark! ;-)
(actually I'm a 4D-fish ;-)

--fish
Senior Consultant, Quotient Inc.
http://www.quotient-inc.com