Error 13158645764: server_2 : ERROR: Virus checker NOT started.

And .. i keep entering the start command every time when i need to check virus_checker information. Can it be automated or is this a bug?

Can you post your viruschecker.conf file?  That's the most important component of CAVA.

Hi, below is the output

[nasadmin@SWOEF203-CTRL1 tmp]$ cat viruschecker.conf

CIFSserver=SWOEF203-CAVA

RPCRequestTimeout=85000

addr=53.8.60.146:53.8.60.86:53.8.60.145

masks=*.001:*.002:*.386:*.3GR:*.??_:*.ACE:*.ACM:*.ADE:*.ADP:*.ADT:*.AP?:*.ARC:*.ARJ:*.ASA:*.ASD:*.ASP:*.AX?:*.B64:*.BA?:*.BIN:*.BMP:*.BO?:*.BZ?:*.CAB:*.CC?:*.CDR:*.CEO:*.CGI:*.CHM:*.CL?:*.CMD:*.CNV:*.CO?:*.CPL:*.CPT:*.CPY:*.CRT:*.CSC:*.CSS:*.CSV:*.D?B:*.DAT:*.DEV:*.DIF:*.DL?:*.DO?:*.DOC:*.DOT:*.DQY:*.DRV:*.EE?:*.EFV:*.EML:*.EX?:*.EXE:*.FDF:*.FMT:*.FO?:*.FPH:*.FPW:*.GF?:*.GIM:*.GIX:*.GMS:*.GNA:*.GW?:*.GWI:*.GZ?:*.HDI:*.HHT:*.HLP:*.HT?:*.HWD:*.ICE:*.ICS:*.IM?:*.IN?:*.IQY:*.ISP:*.ITS:*.JAR:*.JP?:*.JS?:*.LGP:*.LIB:*.LNK:*.LWP:*.LZH:*.M3U:*.MB0:*.MB1:*.MB2:*.MBR:*.MHT:*.MOD:*.MPD:*.MPP:*.MPT:*.MRC:*.MS?:*.MSG:*.MSO:*.NAP:*.NEW:*.NWS:*.OB?:*.OC?:*.OFT:*.OL?:*.OTM:*.OV?:*.PCD:*.PCI:*.PD?:*.PDF:*.PF?:*.PHP:*.PI?:*.PLG:*.POT:*.PP?:*.PPZ:*.PRC:*.PWZ:*.QLB:*.QPW:*.QQY:*.QTC:*.RAR:*.REG:*.RMF:*.RQY:*.RTF:*.SCR:*.SCT:*.SH?:*.SIS:*.SKV:*.SLK:*.SMM:*.SPL:*.SRF:*.SWF:*.SYS:*.TAR:*.TAZ:*.TBZ:*.TD0:*.TFT:*.TGZ:*.TLB:*.TSP:*.TXT:*.UNP:*.URL:*.UUU:*.VB?:*.VBS:*.VS?:*.VVV:*.VWP:*.VXD:*.WBK:*.WIZ:*.WMV:*.WP?:*.WRI:*.WRL:*.WRZ:*.WS?:*.X32:*.XL?:*.XML:*.XRF:*.XSL:*.XTP:*.XX?:*.Z0M:*.Z??:*.ZI?:*.ZIP:*.ZL?:*.ZZZ

maxsize=0x8000000

shutdown=viruschecking

If you have to start CAVA to get information, that means the CAVA service is stopped.  Since you have shutdown=viruschecking set in your viruschecker.conf, that means the NAS will stop the viruschecking service automatically, when the CAVA servers fail to respond. 

Also, that might be exacerbated by the high RPCRequestTimeout value you've got set.  85000 milliseconds means you're waiting more than three times longer than expected before trying to contact the next CAVA server in the pool.

There are a few things you do.  First, are you observing the server_log for any virus checker warnings?  You will see errors with the VC facility in your logs.  You can try "server_log server_2 | grep VC" to see what I mean.  Second, if you're getting errors, are they low watermark / high watermark messages?  If so, this is because the CAVA servers are not keeping up with the scanning workload.  You'll need to add more CAVA servers to spread the workload out.  If you aren't encountering high watermark issues, you might see other messages in the server_log that could be useful.

Let us know if that helps!

Karl

extend the command from Karl, use:

server_log server_2 -i -s |grep VC

Ok, I disabled shutdown=viruschecking so now able to run the virus_checker command and services are running. I checked the CAVA server event logs Found the below ,i will enable the option latter.

From the CAVA server Event Log :

Error :

The AUDIT facility is enabled, but not configured.

The EMC CAVA service will not process events for this facility.

Possible Causes: The required vendor information is not present.

Or a required component is not installed.

Solutions: Check Endpoint entry in registry for AUDIT facility for vendor names.

Install the needed component for the AUDIT facility if applicable and restart the EMC CAVA service.

For the above error followe KB https://support.emc.com/kb/425428   From the KB i have followed 2 step and restarted the CAVA services After which got the below Output

[nasadmin@SWOEF203-CTRL2 ~]$ server_viruschk server_2

server_2 :

10 threads started.

3 Checker IP Address(es):

53.8.60.145                                    ERROR_AUTH 5 at Thu Apr 14 16:47:27 2016 (GMT+02:00)

                                               MS-RPC over SMB, CAVA version: 6.8.0.0, ntStatus: SUCCESS

                                               AV Engine: Network Associates

                                               Server Name: SWOEMWVVT001.dewoe.corpintra.net

                                               Last time signature updated: Sat Mar 19 22:35:12 2016 (GMT+01:00)

53.8.60.86                                     ERROR_AUTH 5 at Thu Apr 14 16:47:27 2016 (GMT+02:00)

                                               MS-RPC over SMB, CAVA version: 6.8.0.0, ntStatus: SUCCESS

                                               AV Engine: Network Associates

                                               Server Name: SWOEAWV00003.dewoe.corpintra.net

                                               Last time signature updated: Thu Apr 14 05:27:47 2016 (GMT+02:00)

For Error_Auth issue Followed the KB https://emcservice.force.com/CustomersPartners/kA2j0000000QeJRCA0

When tried to access \\swoef203\check$ getting the error as

Output From : server_log server_2 -i -s |grep VC

2016-04-14 16:44:18: VC: 3: Invalid access from client 53.8.60.145 to CHECK$

2016-04-14 16:44:18: VC: 3: User does not have the VirusChecking/CEPP privilege:

2016-04-14 16:44:18: VC: 3: Invalid access from client 53.8.60.86 to CHECK$

2016-04-14 16:44:18: VC: 3: User does not have the VirusChecking/CEPP privilege:

EMC VChecking user account is which i am using for server CAVA services logon as well. I am able to access \\swoef203\c$

just stuck here now, what permission am i missing and how to make Account must be local Admin on the Windows ScanEngine Server and on the VNX CIFS Server for CAVA (SxxxFnnn-CAVA) What should be done?

Please check the "Using VNX™ Event Enabler" manual. You will find it at http://support.emc.com

There is a chapter with detailed descriptions how to configure the viruschecker user account.

I can't stress this enough - restarting the CAVA service will not fix your issue.  You need to review the documentation and set the right privileges on the Domain Account for the CAVA service.  This is well-detailed in the documentation - just follow the outlined steps and you'll be okay.

Let us know if that helps!

Karl

The reason i mention CAVA services is because i wanted to let you as a FYI, i am aware it does not fix the issue. I have gone through the document i am stuck here --> Assign the EMC virus-checking right to the group, in the document it is mentioned to use Celerra Management

Download EMC celerra management tool, I downloaded CelerraCifsMgmt_7.1.72.1 and installed it, the machine which I installed is a 64-bit but the software supports only 32-bit. I tried searching and getting the 64-bit support tool but couldn’t find any.. can you help me get the 64-bit tool?

https://emcservice.force.com/CustomersPartners/kA2j0000000QyKKCA0 this is the KB link I referred. Basically using this tool I am trying to Assign the EMC virus-checking right to the group or can this be done via command let me know i can give a try.

AFAIK there is no 64bit version – the 32bit one should work on 64bit OS as well

In a pinch, you can install the MMC on any workstation to perform this step.  I've installed the MMC on older Windows 7 desktops, and I keep a VirtualBox image with many EMC-specific tools and certain Java versions for this very reason.

I've run the 32-bit tool on Win2003 through Win2008.  If you need to install it on Windows Server 2012, you'll need to set compatibility mode during the installation to Windows 7.  Without this, the installation fails with permissions errors and does not install the service in a way that it can be started.