cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Vs 8.5 oas

I've added several exclusions to the OAS on our backup servers. One excludeds files within a certain directory from being scanned on read and write. However, when you look at the OAS stats files in this directory are being scanned?

To test this I created a txt document in the directory and monitored the OAS stat. Sure enough the file was scanned and the counter increased by one.

Anyone have any ideas how I can completely exclude files in this directory? I've followed the McAfee suggested way but it is still happening!

Regards
8 Replies
ePONinja
Level 7
Report Inappropriate Content
Message 2 of 9

RE: Vs 8.5 oas

I believe the On-Access Scan Statistics are not an indication of the file scanning process, but more an indication of the "monitoring" process.

Even though the files/folders are excluded, something is always running to "observe" file open/read/write access. That is what the statistic are actually reporting as the "Last file scanned"

Hopefully, someone else will confirm.
dustrho
Level 7
Report Inappropriate Content
Message 3 of 9

RE: Vs 8.5 oas

I believe the ePONinja is correct with his statement. All files on all drives are constantly under watch by VirusScan's OAS technology, but it doesn't necessarily mean they're being scanned for threats. I've had a hard time proving this to upper management before, as I don't believe that's documented on paper (I could be wrong about that though).
frpatter
Level 7
Report Inappropriate Content
Message 4 of 9

extended logging for validation?

is there a way to get an extended log to validate the files were not actually scanned? i am having a debate with a vendor regarding their app and file exclusions, but i have nothing with any teeth to give them.

as a test to satisfy myself here is what i did.

1. created a directory c:\dir\subdir
2. added an exclusion of \subdir\
3. pasted a file from elsewhere to c:\dir\subdir\
4. on access count went up 1
5. added complete path exclusion "c:\dir\subdir\"
6. pasted a file, count did not go up.

my problem is that we have certain directories that may be on different drives. Support and prof services asured me that using the \subir\ will work as a "blanket" exclusion of that folder name no matter where it resides.

Thanks in advance for any help.
tonyb99
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 5 of 9

RE: extended logging for validation?

frpatter
Level 7
Report Inappropriate Content
Message 6 of 9

Thanks, one more thing...

well if this information was easier to find i would not hava had a problem!!! Both Support and the onsite PSE set these exclusions and it just burned me good.

Thanks for the info. i will try it.

is there a way to export-->modify-->import the oas and scheduled scan exclusions?
frpatter
Level 7
Report Inappropriate Content
Message 7 of 9

RE: Thanks, one more thing...

also, my original question....

is there a way to turn on extended logging for a period of time to see the on access files being scanned?
tonyb99
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 8 of 9

RE: Thanks, one more thing...

no you cant eport ( pain!!)
you CAN switch on file logging with the command line scanner so I guess its possible with switches for a scheduled scan with comand line scan32.exe not sure it works with OAS though
frpatter
Level 7
Report Inappropriate Content
Message 9 of 9

RE: Thanks, one more thing...

Thanks again....


Note to MCAFEE!!!!

Please make ALL configurations exportable/importable!!! this only makes good sense in any app!!!

Let's get with it guys!!!!
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community