Manual Pages for UNIX Operating System command usage for man vscand

System Administration Commands                         vscand(1M)



NAME
     vscand - vscan service daemon

SYNOPSIS
     /usr/lib/vscan/vscand


DESCRIPTION
     vscand is the daemon that handles virus scan  requests  from
     file  systems on file open and close operations. A file sys-
     tem may support enabling and disabling of virus scanning  on
     a per dataset basis, using that file system's administrative
     command, for example zfs(1M).


     If the file state or scan policy (see vscanadm(1M)  requires
     that  a  file  be scanned, vscand communicates with external
     third-party virus scanners (scan engines) using the Internet
     Content  Adaptation  Protocol  (ICAP,  RFC 3507) to have the
     file scanned.


     A file is submitted to a scan engine if it has been modified
     since  it  was  last  scanned, or if it has not been scanned
     with the latest scan  engine  configuration  (Virus  defini-
     tions).  The  file's modified attribute and scanstamp attri-
     bute are used to store this information. Once  the  file  is
     scanned, the modified attribute is cleared and the scanstamp
     attribute is updated.


     If the file is found to contain a virus, the virus is logged
     in  syslogd(1M), an audit record is written, and the file is
     quarantined (by setting its quarantine  attribute).  Once  a
     file is quarantined, attempts to read, execute or rename the
     file will be denied by  the  file  system.  The  syslogd(1M)
     entry  and the audit record specify the name of the infected
     file and the violations detected in the file. Each violation
     is  specified  as  "ID  -  threat description", where ID and
     threat description are  defined  in  the  X-Infection-Found-
     Header in ICAP RFC 3507; Extensions.


     By default, vscand connects to scan engines  on  port  1344.
     The  port  and other service configuration parameters can be
     configured using vscanadm(1M).


     The vscan service is disabled by default, and can be enabled
     using svcadm(1M).





SunOS 5.11           Last change: 6 Nov 2007                    1






System Administration Commands                         vscand(1M)



EXIT STATUS
     The following exit values are returned:

     0           Daemon started successfully.


     non-zero    Daemon failed to start.


ATTRIBUTES
     See attributes(5) for descriptions of the  following  attri-
     butes:



     ____________________________________________________________
    |       ATTRIBUTE TYPE        |       ATTRIBUTE VALUE       |
    |_____________________________|_____________________________|
    | Availability                | service/storage/virus-scan  |
    |_____________________________|_____________________________|
    | Interface Stability         | Uncommitted                 |
    |_____________________________|_____________________________|


SEE ALSO
     ps(1),   svcs(1),   logadm(1M),   svcadm(1M),   syslogd(1M),
     vscandadm(1M), zfs(1M), attributes(5), smf(5)

NOTES
     If a file is accessed using a protocol which does not invoke
     the  file  system  open  and  close  operations, for example
     NFSv3, virus scanning is not initiated on the file.


     File content is transferred to the scan engines as cleartext
     data.


     Administrative actions for the vscan service, such  as  ena-
     bling,  disabling, or requesting a restart, can be performed
     using svcadm(1M). The vscan service status  can  be  queried
     using the svcs(1) command.


     The vscan service  is  managed  by  the  service  management
     facility, smf(5), under the service identifier:

       svc:/system/filesystem/vscan







SunOS 5.11           Last change: 6 Nov 2007                    2