Best practice questions on MOVE multiplatform

[eg211]

Hi There,

I have some questions regarding MOVE multiplatform:

1, I was told by someone before that files are transferred from MOVE client to SVM for scanning via TCP connection, question is, is there has a max file size threshold send to SVM? or any files that need to be scanned will send to SVM?

2, I have a customer asking they are planning to install MOVE on file servers, do you have best practice suggestions under this scenario?

[YashT]

Hello @eg211 ,

As per your queries :

If a file must be sent to MOVE AV Multi-Platform to be scanned, is it sent encrypted or unencrypted?
In MOVE AV Multi-Platform, there are two ways files are transferred to the scanning appliance (SVM):

• If the file size is smaller than the default threshold (40 MB), the complete file is sent to the SVM unencrypted.
• If the file size is larger than the default threshold, the file is sent in chunks (offset of the file) when requested by the SVM, and then scanned.

This details can be found in KB83964

McAfee MOVE AntiVirus 4.7.0 Product Guide

Above guide will help you to understand how it works and how to configure it.

1. Overview of McAfee MOVE AntiVirus
2. McAfee Management for Optimized Virtual Environments (MOVE)

[eg211]

HI @YashT ,

Thanks for your reply. just to confirm is the threshold(40MB) configurable in MOVE policy? I found this:

But this seems for fie cache settings, not for defining max file size needs to be scanned...

[patrakshar · Accepted solution]

The caching will be happening for the files that we scan. So when you define the max file size for scanning it is also defining the max file to scan and then to cache it. The option you are looking at is correct.

[patrakshar]

To answer the file server question, there is no specific recommendation as such. You need to understand the fact that in MOVE multi platform scan happens over network. So when too many clients access the file server, the MOVE client installed in the file server consider all the I/o operation and send the same to OSS. Now the number of file will be huge. If the OSS has enough capability and proper exclusions has been set within MOVE policy then should not be a problem by installing MOVE on the File server.

[eg211]

Thanks @patrakshar @YashT , much appreciated.