Managing Antivirus Servers

You can specify how infected files are handled and suspend antivirus scanning.

To configure how infected files are handled:

1. In the global administration view, select Services > Antivirus in the navigation pane.
   The Antivirus page is displayed.
   

2. Click Settings to configure antivirus scanning.
   The Antivirus Settings window is displayed.
   
   When a threat is detected – Specify how to handle infected files:

   • Log Only – An email is sent to the portal listing the file that might be infected and the file is copied to quarantine. It is still possible to download or preview the infected file.
   • Block Viruses – The infected file is not downloaded and it is quarantined.
     
     

   Maximum content size to scan – The maximum size of a file to be scanned. Since most viruses are found at the beginning of the file, CTERA does not recommend changing this value. Increasing the value will adversely impact scanning performance.
   Retain quarantine files for – The number of days that files are kept in quarantine before being removed.
   Connections per ICAP Server – The maximum number of connections allowed per each ICAP server that is configured either as an application server or as a background scanner. For example, If the connection count is set to 20, the recommended default, and there are 5 application servers and 2 scanning servers configured in the portal cluster (7 servers in total), the maximum total number of concurrent connections to each ICAP server is 140 connections (7*20).

   Note

   CTERA recommends that the background scanning servers are not application servers.

To suspend or resume antivirus scanning for all servers:

1. In the global administration view, select Services > Antivirus in the navigation pane.
   The Antivirus page is displayed.
2. In the status bar, click Suspend to suspend antivirus scanning or Resume to resume antivirus scanning for all servers.

To suspend or resume antivirus scanning for a specific server:

1. In the global administration view, select Settings > Antivirus in the navigation pane.
   The Antivirus page is displayed.
2. Select the server row in the list of ANTIVIRUS SERVERS.
3. Click Suspend to suspend antivirus scanning or Resume to resume antivirus scanning for the server.
   The status for resumed servers is Connected and for suspended servers it is Disabled

Deleting an Antivirus Server

To delete an antivirus server:

1. In the global administration view, select Services > Antivirus in the navigation pane.
   The Antivirus page is displayed.
   

2. Either,

   1. Select the row of the antivirus server to delete and click Delete.
      A confirmation window is displayed.
   2. Click DELETE SERVER to confirm.
      
      

   Or,

   1. Click the antivirus server’s name in the list of ANTIVIRUS SERVERS.
      The antivirus server window is displayed with the server name as the window title.
   2. Click DELETE.
      A confirmation window is displayed.
   3. Click Yes to confirm.