1 2 Previous Next 12 Replies Latest reply on Dec 9, 2010 9:23 AM by root

    VirusScan 8.7 and EMC CAVA on 64 bit

    runcmd

      I am our organization's McAfee system administrator and I am currently working with our server storage system administrator on troubleshooting an EMC Celerra Anti-Virus Agent (CAVA) problem on a Windows 2008, 64-bit server, which is connected to an EMC Celerra (NAS device).  Everything worked fine when the CAVA server was 32 bit; however, it was recently upgrade to a 64 bit server.  Since that time, CAVA is unable to locate the VSE install.  EMC support has indicated that we need a "true" 64 bit version of McAfee VSE installed on the server because CAVA is looking for VSE in the "Program Files" folder but it resides in the "Program Files (x86)" folder.  I contacted McAfee support and the representative that I spoke with indicated that a true 64 bit version of VSE will most likely not be available until v8.8 (but he could not guarantee it) and he did not have a target release date.  Is anyone else using Celerra Event Enabler Framework v4.6.7 with CAVA and VirusScan v8.7 on a 64 bit server?  If so, can you share any tips on what you did to get CAVA to see VSE?  I tried installing VSE 8.7 directly in the "Program Files" folder but it did not work--the install creates the "McAfee\VirusScan Enterprise" folder but most of the application files are missing and I cannot open the VirusScan Console.  Short of reverting the server back to 32 bit, does anyone have any suggestions?  Thanks!

       

      11/02/2010 Edit - Corrected typo "Program Files (x64)" to "Program Files (x86)"

       

       

      Message was edited by: runcmd on 11/2/10 11:48:44 AM EDT
        • 1. Re: VirusScan 8.7 and EMC CAVA on 64 bit

          Hi

           

          Please confirm VSE 8.7i was installed after you fully installed the 64 bit server.

           

          Regards

          • 2. Re: VirusScan 8.7 and EMC CAVA on 64 bit
            wwarren

            I suggest seeking a resolution from EMC.

            A 64-bit product, such as VirusScan is, can/will/does install to the Program Files (x86) folder.

             

            The install folder does not designate the product being 64-bit or not; It is the code in the binaries that execute.

             

            There are only 2 things you need to ensure VSE is configured to do in order to scan the activity of the CAVA agent -

            - network drive scanning must be enabled

            - read scanning must be enabled

            • 3. Re: VirusScan 8.7 and EMC CAVA on 64 bit
              runcmd

              First of all, thank you both for the responses.

               

              >>  Please confirm VSE 8.7i was installed after you fully installed the 64 bit server.

               

              I'm not sure I understand.  How could you install McAfee before?  Or are you stating that the EMC software should be installed prior to VSE?  If it wasn't, what can I do about it now?  Do I have the storage SA reinstall it?  I've already tried uninstalling and reinstalling VSE.  I currently have the most recent release, VSE 8.7 Patch 4, installed.

               

              >>  I suggest seeking a resolution from EMC.

               

              Already did...  They're point the finger at McAfee and saying that there's nothing they can do until we obtain a 64 bit version of VSE that installs in the "Program Files" folder.

               

              >> The install folder does not designate the product being 64-bit or not; It is the code in the binaries that execute.

               

              I've found precious little on what determines whether an application goes to "Program Files" or "Program Files (x86)".  However, this is one quote I did find:  "Windows XP Professional x64 Edition redirects the \Program Files directory for all programs that are 32-bit during the installation to the \Program Files(x86) directory. Programs that 64-bit are installed into the \Program Files directory." [Charlie Russel, "Frequently asked questions about Windows XP Professional x64 Edition," Microsoft,  25 Jul 2005, 3 Nov 2010 <http://www.microsoft.com/windowsxp/using/64bit/russel_x64faq.mspx>]

               

              From what I am able to determine, VSE 8.7 is a 32 bit application with a 64 bit scan engine plugged into it.  According to the installation guide, "The x64 folder contains files required to scan 64-bit operating systems. These files are installed to the engine folder in the installation path. The default location is
              <drive>:\Program Files\Common Files\McAfee\Engine\x64
              "  ["McAfee VirusScan Enterprise software version 8.7i Installation Guide" (Mcafee, 2008) 18.]  Even on 64 bit systems, I still see a 32 bit scan engine.  Additionally, Task Manager shows shstat.exe, FrameworkService.exe, VsTskMgr.exe, and naPrdMgr.exe suffixed with *32 on the server in question.  I think it's safe to say that only the 64 bit scan engine is truly 64 bit.

              • 4. Re: VirusScan 8.7 and EMC CAVA on 64 bit

                I was trying to establish what order software was installed in and there seems to be no issue with that.

                 

                As to the matter of VSE 8.7i being 64-bit, I have nothing to add to what has already been pointed out previously.

                 

                I would personally log a case with McAfee support and push for it to be escalated.

                 

                HTH

                • 5. Re: VirusScan 8.7 and EMC CAVA on 64 bit
                  wwarren

                  VSE 8.5i and later are x64 products.


                  They do _not_ install to the \Program Files folder - they don't have to.

                   

                  Escalating this through Support will only get shut down with the same response.
                  EMC need to come up with a better answer than "You didn't install to the right folder". That's ridiculous.

                  • 6. Re: VirusScan 8.7 and EMC CAVA on 64 bit
                    runcmd

                    As a last ditch attempt, I tried creating a hard directory junction of "McAfee" inside the "C:\Program Files" folder which points to "C:\Program Files (x86)\McAfee", using mklink, and that didn't work either.  I'm going to request that my McAfee support case be reopened and then try to setup a conference call between McAfee support and EMC support, in conjunction with my storage guy's EMC support case.  I'm not sure what else I can do at this point.

                    • 7. Re: VirusScan 8.7 and EMC CAVA on 64 bit
                      runcmd

                      I held a conference call to get McAfee Support and EMC Support together on this, yesterday, and the guy from EMC was a no-show.  In speaking with the McAfee Support Representative, he indicated that it shouldn't matter in which folder VirusScan is installed because CAVA should be able to identify where it resides.  I can understand both sides of this argument...  I agree with CAVA that VirusScan, although it may include a 64 bit engine, is not a true and complete 64 bit application.  However, I also agree with McAfee that CAVA should be able to identify where VirusScan is installed by querying the registry (rather than assuming it is in the "Program Files" folder).  At this point our storage SA and I are trying to decide if we should reschedule the conference call and press forward, or just rebuild the CAVA server as 32 bit and be done with it.  To be continued...

                      • 8. Re: VirusScan 8.7 and EMC CAVA on 64 bit
                        wwarren
                        I agree with CAVA that VirusScan, although it may include a 64 bit engine, is not a true and complete 64 bit application. 


                        This is false.

                        VirusScan 8.5i and later are native 64 bit applications.

                         

                        The aspects of the product that you see are not 64-bit have no need to be.

                        • 9. Re: VirusScan 8.7 and EMC CAVA on 64 bit
                          runcmd

                          I'd say that VSE 8.7 is *kind of* 64 bit.  Yes, both the "McAfee McShield" (mcshield.exe) and the "McAfee Engine Service" (engineserver.exe)--probably the meat of VSE--are running from the VSE\x64 folder and Task Manager does not show them as 32 bit.  Additionally, if I launch scan32.exe from the CLI, it immediately cuts over to the scan64.exe in the VSE\x64 folder.  However, the following executables are still running 32 bit:  shstat.exe (VirusScan Tray Icon) and vstskmgr.exe (McAfee Task Manager).  If VSE 8.7 is 64 bit native, then why the 32 bit processes at all and why deviate from Microsoft's standards by installing your 64 bit application in the 32 bit "Program Files (x86)" folder?  Why do you need a 32 bit and a 64 bit scan engine on the "About" screen?  ...Is it so that VSE can support scanning of 32 bit applications that run on 64 bit machines?  Why is it that the McAfee support representative I initially spoke with on my case told me that a true 64 bit version of VirusScan would most likely not be available until the release of v8.8?

                           

                          Please understand, I'm not saying that EMC is right and McAfee is wrong...  Neither am I saying that McAfee is right and EMC is wrong.  I just see valid points on both sides of this argument and some conflicting information on both sides as well.  Perhaps rather than debating whether VSE is truly 64 bit or not, it would be better to ask:  Is there anyone out there that currently *does* have VSE 8.7 working with CAVA on a 64 bit Windows server?  I can't believe I'm the only person in the world that's attempting to run VSE 8.7 with CAVA on a 64 bit server.  If someone has this working in their environment, then at least I know it *IS* possible and that I'm most likely looking at a CAVA configuration issue.  Knowing that it does work in this configuration may also give me leverage to push harder on EMC Support and end the current McAfee vs. EMC standoff.

                           

                          Thanks.

                          1 2 Previous Next