Setting Definitions for Real-Time Access
To set definitions for real-time access, select 2. Real-Time ("on access") from the Antivirus & AntiRansomware (ATP) Configuration menu (STRAV> 81). The "On Access" Definitions screen appears:
| "On Access" Definitions 24/12/24 11:32:20 RLDEV Scan during open/close . . . . . . 1 0=No, 1=Both, 2=Open, 3=Close 1 is recommended. 0 enables scan by SCANSTMF command, or by AVAPIAV API. Scan only file server accesses. . . N Y=Yes, N=No Scan only changes made by NFS, SMB etc. Y sets SysVal QSCANFSCTL(*FSVRONLY). Scan only if object has changed . . N Y=Yes, N=No Y is recommended Avoid unnecessary scans. Y sets SysVal QSCANFSCTL(*USEOCOATR). Scan the object up to the size of . 4096 Size in KB Preventing performance issues before first activation 1. Set your excludes in 21, 2. Follow the instructions there. 2. During off-peak hours, repeat daily until finished (check log): Set on 81,1 Log to 1; Set on 81,2 Scan only if object has changed to Yes Activate On-Access Run SCANAV OBJ('/') WAIT(*NO) Before regular hours, de-activate On-Access F3=Exit F12=Cancel |
The screen contains these fields:
Scan during open/close
This setting determines when Antivirus scans files in the IFS during real-time access. Files can be scanned at specific points of interaction with the system, such as when they are opened or closed. These points correspond to typical system operations: open, when the file is accessed , and close, when the interaction with the file ends.
Possible values are:
- 0: No. Disables scanning for real-time access.
- 1: Both. Scans files both when they are opened and when they are closed.
- 2: Open. Scans files only when they are opened.
- 3: Close. Scans files only when they are closed.
NOTE: During activities such as copying files from the IFS to a Windows system via NetServer, the file is opened when the operation begins and closed when it completes. For systems experiencing performance issues, it is recommended to select scanning on either Open or Close (but not both) to reduce the scanning frequency while maintaining security.
Scan only file servers accesses
Determines whether Antivirus scans access attempts via the WRKLNK and EDITF commands or only accesses via the file server. This option modifies the system value QSCANFSCTL (Scan file systems control). Possible values are:
- Y: Only scan accesses via file servers
- N: Also scan access attempts via the WRKLNK and EDITF commands
Scan the object up to the size of ____
A size in KB. If this is set, objects larger than this size are not scanned in real time. They are marked as clean and a message appears in a log file showing that they would have been scanned.
This setting helps to prevent lengthy scans. It should be used with caution. Scan large files in advance with the SCANAV command. If SCANAV has been used and the system value setting is QSCANFSCTL(*USEOCOATR), larger objects only require rescans after they are changed.
Preventing performance issues before first activation
Read carefully the notes in this section and follow them to avoid performance problems.