Network Attached Storage​

 View Only

 HNAS AV MAX FILE SIZE

  • Network Attached Storage
  • Hitachi Network Attached Storage NAS
Data Conversion's profile image
Data Conversion posted 06-03-2019 13:10

We have set 25 MB max file size limit to be scanned by AV scan engine.

File >25 MB will be excluded from scanning.

In addition to that we are using MacAfee AV configured with ICAP on HNAS 4080.

Any suggestions from Hitachi on Max file size to be excluded from scanning. 


#HitachiNetworkAttachedStorageNAS
Albert Hagopian's profile image
Albert Hagopian

Nathan Kingor Simon Croslandmay have thoughts, but I do not recall any "best practice" recommendation for the max file size to exclude from scanning.

There is white paper that should be available via knowledge connect entitled "Hitachi VSP Gx00 Unified Storage with McAfee VirusScan Enterprise for Storage Using ICAP and RPC Protocols" that might be of use.

Simon Crosland's profile image
Simon Crosland

We don't usually make any specific recommendations about this setting because there are so many different scenarios that could be encountered. Some of the anti-virus software vendors do make recommendations based on what their scanning engine has been optimised for, so it may be worth checking their documentation.

Nathan King's profile image
Nathan King

I agree. I have seen customers use a variety of different settings here.. some as high as 100MB, some as low as 10MB. There are a lot of variables in play here.. the reason that most customers introduce the limit is to decrease the file sever latency (since the end user file open is delayed by the time it takes for the AV scan to complete).

The quicker the total AV scan time, the lower the latency. There's many variables that affect this - the time it takes to read the file from disk, the time it takes to send across the network and the time it takes to scan the actual file. The read from disk, read across network are items related to general performance - so things like storage configuration/setup, hw, AV protocol used, current workload all play into that. The time it takes to actually process the file (scanning), depend more on the HW characteristics of the AV scanner, its current workload/overhead, the file type (zip files typically take longer due to extraction) and the AV algorithm itself.  There's just too many variables in that equation to say that "x MB" is your perfect answer - the customer is going to have to experiment to find the optimal size for their use case/environment. 

Peng Yu's profile image
Peng Yu

Check AV software vendor and they should have the suggestion. For example Mcafee suggest to set 256MB for the limitation. If it too large, it will impact HNAS performance and if it is too small, then more chances on leaving files on risk.

https://kc.mcafee.com/corporate/index?page=content&id=KB81761&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US