Overview:
The purpose of this article is to explore the AntiVirus feature on Versa NGFW.
In today's internet world, it’s a daily affair to access emails/webpages and download files, media from internet. However, there could be harmful files made available with malicious intent. Such malicious software is called malware. Such malware once installed on the system/device can steal the data, encrypt it so it cannot be accessed (without paying up) or delete it entirely.
Therefore, it is very important to have antivirus enabled to prevent such malware from being downloaded in the first place.
Versa OS has AntiVirus feature as part of the NextGenFirewall software bundle.
Fundamentals:
Antivirus software works by detecting the malware and deleting the same before it harms the network devices. Here is the basic flow on how that is carried out:
VOS antivirus inspects the live traffic for any file download/transfer involved. SSL decryption is mandatory to scan encrypted SSL traffic.
- If there is any file download/upload going on, the file data is buffered locally on the VOS as well as forwarded to the destination.
- However, when the last byte of the file is received, AV holds the packet and does not forward it to the client.
- AV engine extracts the file that was buffered during the data transfer and looks up the AV cache DB.
- If no entry is found in the AV cache, the file is scanned against the signatures.
- If there is any malware found, action in the profile is enforced. If the file is safe, then the last byte is transferred to the destination, thus completing the data download.
Malwares can be of multiple types:
Virus - Programs that attach to files and spread by copying themselves
Ransomware - Software that locks the files and demands ransom to obtain them back
Spyware - Secret programs that watch what is going on the system
Trojan - Fake programs that look safe, but allow backdoor entry to hackers
Worm - Harmful code that travels laterally from one machine to another
Versa provides Security Package (SPack) that contains signatures to detect malwares. There are regular SPack updates to provide protection again latest viruses and malwares.
Configuration:
Prerequisites:
--NGFW service is enabled in Service-Node-Group and Limits under Org
--SSL decryption is enabled (For configuration of decryption profile refer https://support.versa-networks.com/now/cwf/agent/kb_view/kb_knowledge/7da024f087028b10389dedf50cbb3559/sub/record/kb_knowledge/7da024f087028b10389dedf50cbb3559 )
There are three components in AV configuration: Antivirus Profile, Storage Profile and finally the Access Policy.
- Antivirus Profile
A profile allows to define context of the malware detection: protocol and file type that will be inspected, the direction of transfer and corresponding action.
Versa OS has few predefined profiles for scanning certain protocols and can be found below as below:
The three profiles are segregated based on web and email traffic. Where the Scan Web and Email Traffic sets the context to inspect attachments and file downloads over all the supported protocols:
Since a predefined antivirus profile cannot be modified, a custom profile can also be created if the action, file type etc needs to be different then what predefined protocol has.
Note: Predefined profiles only scan files upto 512KB.
Custom AV Profile can be created on the following path:
GUI: Configuration > Services > Next Gen Firewall > Security > Profiles
CLI : set orgs org-services Alpha security profiles av name
admin@CPE01-cli> show configuration orgs org-services Alpha security profiles av
Scan_HTTP_pdf_exe {
lef-profile-default true;
file-type [ exe pdf txt ];
direction both;
action deny;
action-on-disk-full deny;
protocol [ HTTP ];
}
Here we have defined
Protocol as http (which includes https)
File type as pdf and exe so only those files will be scanned for malware
Direction as both, which means scan will be performed for both upload and download
Storage profile to provide space for AV engine to buffer and scan the file
Action set to deny
- Storage for Antivirus
A predefined profile has a capacity of scanning just 512KB because that is the memory reserved in memory for AV buffer.
If larger files need to be scanned, or, the traffic pattern through the device is going to be such that its going to be demanded more files to be buffered, it is recommended to configure dedicated storage for AV.
It allows to configure the path. The common pool is shared across all tenants. Max size defines the maximum available size at the system level. Similarly RAM disk also can be defined.
Both hard disk space as well as ram disk space can be allocated in storage profiles:
admin@CPE01-cli> show configuration system parameters storage
hard-disk {
path /tmp;
common-pool-size 25600;
max-size 51200;
}
Storage profile can also be configured per tenant level like seen below:
admin@CPE01-cli> show configuration orgs org Alpha storage-profiles Alpha_Storage
hard-disk-size 4096;
This storage profile can then be called in AV profile. Since predefined profiles cannot be edited, a storage profile can only be called in custom AV profiles:
admin@CPE01-cli> show configuration orgs org-services Alpha security profiles av
Scan_HTTP_pdf_exe {
lef-profile-default true;
file-type [ exe pdf txt ];
direction both;
action deny;
action-on-disk-full deny;
storage-profile Alpha_Storage;
protocol [ HTTP ];
}
- Access policy
This is required to define the L3/L4/L7 match criteria for the traffic that needs to be permitted/denied by the NGFW. We call the AV profile in the access policy to scan the required traffic only.
For eg, in the below example, we are configuring a policy to allow any traffic from Trust Zone and scan for malware only in the http traffic flows:
AV profile is then called in the Enforce > Action > Apply Security Profile page:
We can see the custom profile as well as the predefined profiles available in there.
admin@CPE01-cli> show configuration orgs org-services Alpha security access-policies Default-Policy rules Allow_From_Trust
rule-disable false;
match {
source {
zone {
zone-list [ Intf-LAN-Zone W-ST-Alpha-LAN-VR-Internet ];
}
user {
user-type any;
}
}
}
set {
security-profile {
antivirus {
user-defined-av-profile Scan_HTTP_pdf_exe;
}
}
action allow;
tcp-session-keepalive disabled;
lef {
profile-default true;
event both;
options {
send-pcap-data {
enable false;
}
}
}
}
Validation and Troubleshooting:
With the above configuration in place, we will test an affected file download and a regular file download.
On the test system:
The system is having Versa certificate installed for SSL proxy to be successful
Trying to download a test malware file from eicar webpage can be seen blocked (by timeout)
On the Versa device:
Initial steps of troubleshooting always incorporate Validation. Hence, we first validate the configuration based on the session and policy hit:
- Look for the session extensive on the Versa device. Note the access policy rule, dropped counters, dropped module etc.
admin@CPE01-cli> show orgs org Alpha sessions extensive | select source-ip 172.20.2.10 | select destination-ip 89.238.73.97 | match-all
sessions extensive 0 2 111292
source-ip 172.20.2.10
destination-ip 89.238.73.97
source-port 36154
destination-port 443
protocol 6
natted Yes
sdwan No
application http/(predef)
forward-pkt-count 12
forward-byte-count 3120
reverse-pkt-count 15
reverse-byte-count 9203
dropped-forward-pkt-count 0
dropped-forward-byte-count 0
dropped-reverse-pkt-count 2
dropped-reverse-byte-count 135
session-age 00:00:05
idle-for 00:00:00
idle-timeout 240
drop-module av
nat-direction C2S
rx-wan-ckt vni-0/1.0
tx-wan-ckt vni-0/1.0
tx-branch -
forward-ingress-ckt vni-0/1.0
forward-egress-ckt Internet
reverse-ingress-ckt Internet
reverse-egress-ckt vni-0/1.0
access-policy Allow_From_Trust
- Validate the config of the access policy and its corresponding AV profile: Check the protocol, file types, direction etc and confirm if the traffic satisfies those conditions.
- Explore the AV counters in statistics while trying to perform the file download/upload: Note which counters are incrementing.
admin@CPE01-cli> show orgs org-services Alpha security profiles av statistics user-defined-profile Scan_HTTP_pdf_exe
security profiles av statistics user-defined-profile Scan_HTTP_pdf_exe
av-profile-hit-cnt 85
av-action-allow-cnt 67
av-action-alert-cnt 0
av-action-reject-cnt 0
av-action-block-cnt 1
av-action-on-disk-full-cnt 0
av-file-in-queue-cnt 0
av-eof-rcvd-cnt 68
av-flow-bypass-cnt 17
av-filetype-mismatch-cnt 17
av-nio-file-enqueue-cnt 5
av-nio-file-dequeue-cnt 5
av-sio-file-enqueue-cnt 0
av-sio-file-dequeue-cnt 0
av-file-cache-hit-cnt 63
av-file-cache-miss-cnt 5
av-fd-not-available-cnt 0
av-disk-space-full-cnt 0
av-file-io-error-cnt 0
av-nio-req-queue-full-cnt 0
av-nio-resp-queue-full-cnt 0
av-nio-api-error-cnt 0
av-nio-thrd-ctx-change-cnt 0
av-sio-req-queue-full-cnt 0
av-sio-resp-queue-full-cnt 0
av-sio-api-error-cnt 0
av-sio-thrd-ctx-change-cnt 0
Flows Flows Num ctx
Protocol Blocked Allowed switches
--------- ------- ------- --------
http 1 67 0
ftp 0 0 0
smtp 0 0 0
Block Scan
File Type Count Count
-------------- ------- --------
Unknown 0 0
avi 0 0
bat 0 0
doc 0 0
docx 0 0
txt 0 67
elf 0 0
zip 1 0
html 0 0
- If the disk space full counter is seen incrementing, examine the storage profile on the AV profile alongside the disk space and memory on the device. If smaller files are being scanned, but larger files are being bypassed then the AV profile needs to be inspected.
[admin@CPE01: ~] $ df -kh
Filesystem Size Used Avail Use% Mounted on
udev 3.2G 0 3.2G 0% /dev
tmpfs 854M 4.2M 850M 1% /run
/dev/mapper/system-root 78G 29G 45G 40% /
tmpfs 4.2G 12K 4.2G 1% /dev/shm
tmpfs 5.0M 0 5.0M 0% /run/lock
tmpfs 4.2G 0 4.2G 0% /sys/fs/cgroup
tmpfs 16M 0 16M 0% /mnt/versa_ramdisk
tmpfs 854M 0 854M 0% /run/user/1001
[admin@CPE01: ~] $
- Notice if the Spack and AV version on the device are latest or relatively older:
admin@CPE01-cli> show security av information
REF APPLIED
VERSION FLAVOR VERSION VERSIONS
-----------------------------------------
202604171325 Full - -
admin@CPE01-cli> show security security-package information
Version 2335
API Version 11
Flavor premium
Release Date 2026-04-17
Update Type full
- Clear av cache to rule out false positives. It is probable that a specific file was blocked due to false positive, and got flagged as malicious, but was safe. In such scenarios, clearing the cache and or SPack upgrade helps.
Note, upgrading SPack does not clear the AV cache entry. Therefore, if a specific version of SPack was triggering false flag for a file, perform Spack upgrade and clear the av cache:
vsh connect vsmd
vsm-vcsn0> show av cache-db statistics
Max permitted entries : 50000
Entries in cache : 182
Entries added to cache : 182
Entries deleted from cache : 0
Entries updated in LRU : 62
Cache Hit count (approx) : 80
Cache Miss count (approx) : 287
vsm-vcsn0> clear av cache-db entries
Cleared the 182 cache-db entries
vsm-vcsn0> show av cache-db statistics
Max permitted entries : 50000
Entries in cache : 0
Entries added to cache : 182
Entries deleted from cache : 182
Entries updated in LRU : 87
Cache Hit count (approx) : 106
Cache Miss count (approx) : 365
- In addition to the above validation, we can set up AV debugs to check why the file block/bypass is happening.
Caution: AV debugging is a global setting which can cause disk space/performance issue, hence should be enabled for very short duration in the presence of Versa TAC engineer and used wisely.
admin@CPE01-cli> config
Entering configuration mode private
admin@CPE01-cli(config)% set debug av all-flags level all send to file name /var/log/versa/av_debug.log
[edit]
admin@CPE01-cli(config)% commit
Commit complete.
admin@CPE01-cli(config)%
Message from VMOD-logger at 2026-08-03 23:16:03...
Debug logs grow rapidly and take up disk space! Remember to disable once debugging is done.
EOF
Here is a sample debug output with breakdown:
Receiving/detecting a file for a session:
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4659 sess_hdl = 139893764224514
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4687 scnr_st = (nil) index = 30
2026-08-03 23:21:47.178 DEBUG [0x102] av_get_scnr_state_ext:2331 Receiving a file on this session for the first time
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_get_tuple_info:2260 V4: SRC_IP_INT = ac14020a src port = 41318
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_get_tuple_info:2262 V4: DST_IP_INT = 59ee4961 dst port = 443
Allocating memory in buffer for the file, identifying the protocol, file type and length, direction and corresponding AV profile:
2026-08-03 23:21:47.178 DEBUG [0x102] av_get_scnr_state_ext:2400 allocated memory for scnr_st = 0x7f3bad24f000 trans id: 1 inst id: 0 dir: 2
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4736 received metadata.stream
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_file_type:2888 file_type_max = 100 bitmap_mem_cnt = 2
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_file_type:2890 Allocating memory for file type bitmap
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_file_type:2908 File type found returning. ext = zip max_bits = 100 cr_flags: 0
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_file_type:2916 scnr_st->file_type.bitmap[0] = 10ft_res->file_type_bitmap[0] = 10
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_file_type:2916 scnr_st->file_type.bitmap[1] = 0ft_res->file_type_bitmap[1] = 0
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4659 sess_hdl = 139893764224514
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4687 scnr_st = 0x7f3bad24f000 index = 30
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_get_protocol:2206 The current session's protocol - "http".
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4816 id = 1, name = Scan_HTTP_pdf_exe, protocol = 1
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4946 cr->is_range_enabled = 0 cr->end_flag = 1 cr->ftp_rest = 0tcp_flag = 0
2026-08-03 23:21:47.178 DEBUG [0x102] av_util_get_buffer:39 cr->cr_flags = 0 scnr_st->is_pseudo_file_name = 0
2026-08-03 23:21:47.178 DEBUG [0x102] av_util_get_buffer:44 Returning file buffer "0x7f3bad3c8b00" of length "184".
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4972 buf_len = 184 cr->upfront_file_size = 184 cr->end_flag = 1
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4976 before storage memory for scnr_st = 0x7f3bad24f000 sess_hdl = 139893764224514
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4983 filename = eicar_com.zip
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_get_session_hash:3521 buf= :proto:0:dir2
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_get_session_hash:3555 host_info = ac14020a:59ee4961:443
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2791 Init
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2798 Update
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2798 Update
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2798 Update
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2809 Final, md_len = 32
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2815 digest = c99c924d20275f68e699e8cf5e5a34b509f443a4c919f36e99507b7f135afdbb
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_get_session_hash:3581 scnr_st->range_digest = c99c924d20275f68e699e8cf5e5a34b509f443a4c919f36e99507b7f135afdbb
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2791 Init
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2798 Update
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2809 Final, md_len = 32
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_sha256sum:2815 digest = 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_calculate_file_hash:2848 scnr_st->sha1_digest = 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_init_scan_data:2757 av_file->thread_id = 1
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_init_scan_data:2760 av_scanner_process_result av_file->sess_hdl = 139893764224514
Cache lookup using file hash:
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_search_file_cache:3736 Cache READ Latency in usec = 2
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_search_file_cache:3763 scnr_st->cache_module = 0
2026-08-03 23:21:47.178 DEBUG [0x102] av_file_cache_search_cb:3689 cache_hit = 1 verdict_type = 1 file name = (null) ext = zip detection_name = EICAR_Test_Filedetection_type = MaliciousFile detection_accuracy = 1
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:5154 scnr_st->range_cache_hit = 0
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:5177 Number of bytes scanned av_file->num_byte_scanned = 0
2026-08-03 23:21:47.178 DEBUG [0x102] av_stat_inc_file_type_block_count:561 increment bit no. 59
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_save_file_hash_data:1130 Entry exists verdict = 1
Take action based on cache entry:
2026-08-03 23:21:47.178 DEBUG [0x102] av_lef_export_log:211 verdict_type_str = av-cache
2026-08-03 23:21:47.178 DEBUG [0x102] av_lef_export_log:371 Exporting LEF AV log successful.
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_apply_action:2601 AV profile based session dropped
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_apply_action:2614 Failed to export vulnerability infomation to Devid
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_apply_action:2618 vulnerability infomation successfully reported to Devid (action: Deny(2)
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_notify_cp:1208 try to send CP notification. action = 5
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_notify_cp:1224 scnr_st->is_pseudo_file_name: 0
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_notify_cp:1244 scnr_st->filename: eicar_com.zip
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_notify_cp:1255 Send user notification
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_apply_action:2679 action = 5
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_free_scnr_st:2031 scnr_st->pkt_hold = 0 scnr_st->app_end = 0
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_free_scnr_st:2078 free scnr_st = 0x7f3bad24f000 sess_hdl = 139893764224514
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_free_scnr_st:2086 free scnr_st = 0x7f3bad24f000 prev = NULL
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_free_scnr_st:2124 free scnr_st = 0x7f3bad24f000 scnr_st->file_io_array = 0x7f3bad400c40
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4659 sess_hdl = 139893764224514
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_result:4687 scnr_st = (nil) index = 30
2026-08-03 23:21:47.178 DEBUG [0x102] av_scanner_process_app_end:4576 application.end type = 23
2026-08-03 23:21:47.259 DEBUG [0x101] av_lef_data_free:66 Free an av lef template instance.
The debug taken after clearing cache shows that the AV module is scanning the file after the cache hit did not yield any match:
2026-08-05 09:28:50.343 DEBUG [0x101] av_get_scnr_state_ext:2331 Receiving a file on this session for the first time
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_get_tuple_info:2260 V4: SRC_IP_INT = ac14020a src port = 49608
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_get_tuple_info:2262 V4: DST_IP_INT = 59ee4961 dst port = 443
2026-08-05 09:28:50.343 DEBUG [0x101] av_get_scnr_state_ext:2400 allocated memory for scnr_st = 0x7f3b58937a00 trans id: 1 inst id: 0 dir: 2
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_result:4736 received metadata.stream
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_file_type:2888 file_type_max = 100 bitmap_mem_cnt = 2
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_file_type:2890 Allocating memory for file type bitmap
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_file_type:2908 File type found returning. ext = zip max_bits = 100 cr_flags: 0
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_file_type:2916 scnr_st->file_type.bitmap[0] = 10ft_res->file_type_bitmap[0] = 10
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_file_type:2916 scnr_st->file_type.bitmap[1] = 0ft_res->file_type_bitmap[1] = 0
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_result:4659 sess_hdl = 139893039334913
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_result:4687 scnr_st = 0x7f3b58937a00 index = 30
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_get_protocol:2206 The current session's protocol - "http".
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_result:4816 id = 257, name = Scan Web Traffic, protocol = 3
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_result:4946 cr->is_range_enabled = 0 cr->end_flag = 1 cr->ftp_rest = 0tcp_flag = 0
2026-08-05 09:28:50.343 DEBUG [0x101] av_util_get_buffer:39 cr->cr_flags = 0 scnr_st->is_pseudo_file_name = 0
2026-08-05 09:28:50.343 DEBUG [0x101] av_util_get_buffer:44 Returning file buffer "0x7f3b589eff40" of length "184".
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_result:4972 buf_len = 184 cr->upfront_file_size = 184 cr->end_flag = 1
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_result:4976 before storage memory for scnr_st = 0x7f3b58937a00 sess_hdl = 139893039334913
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_result:4983 filename = eicar_com.zip
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_get_session_hash:3521 buf= :proto:0:dir2
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_get_session_hash:3555 host_info = ac14020a:59ee4961:443
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2791 Init
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2798 Update
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2798 Update
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2798 Update
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2809 Final, md_len = 32
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2815 digest = c99c924d20275f68e699e8cf5e5a34b509f443a4c919f36e99507b7f135afdbb
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_get_session_hash:3581 scnr_st->range_digest = c99c924d20275f68e699e8cf5e5a34b509f443a4c919f36e99507b7f135afdbb
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2791 Init
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2798 Update
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2809 Final, md_len = 32
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_sha256sum:2815 digest = 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_calculate_file_hash:2848 scnr_st->sha1_digest = 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_init_scan_data:2757 av_file->thread_id = 0
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_init_scan_data:2760 av_scanner_process_result av_file->sess_hdl = 139893039334913
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_search_file_cache:3736 Cache READ Latency in usec = 1
2026-08-05 09:28:50.343 DEBUG [0x101] av_file_cache_search_cb:3689 cache_hit = 0 verdict_type = 0 file name = (null) ext = (null) detection_name = (null)detection_type = (null) detection_accuracy = 0
2026-08-05 09:28:50.343 DEBUG [0x101] av_scanner_process_result:5154 scnr_st->range_cache_hit = 0
2026-08-05 09:28:50.344 DEBUG [0x101] av_scanner_hold_mbuf:3855 action set to VS_HOLD scnr_st->thread_id = 0 mbuf: 0x1474a1f80
2026-08-05 09:28:50.344 DEBUG [0x101] av_scanner_nio_async:4250 Enqueue av_file = 0x7f3bad3c0400 to Normal IO Thread
2026-08-05 09:28:50.344 DEBUG [0x401] av_util_ct_run_scan:273 HT thread_id = 0
2026-08-05 09:28:50.344 DEBUG [0x401] av_util_ct_run_scan:293 Commtouch API running scan on a file "0x7f3bb104c0c0", with filename "eicar_com.zip" and length "184".
2026-08-05 09:28:50.344 DEBUG [0x401] av_util_ct_init_sdk_thread:563 thread_id = 0 tgrp_id = 1 av_res = 0x7f3b58c14280
2026-08-05 09:28:50.344 DEBUG [0x401] av_util_ct_init_sdk_thread:631 Commtouch thread level sdk initialized.
2026-08-05 09:28:50.344 DEBUG [0x401] av_util_ct_run_scan:334 av_res = 0x7f3b58c14280 av_file = 0x7f3bad3c0400
2026-08-05 09:28:50.344 DEBUG [0x401] av_util_ct_update_detection_results:86 av_file = 0x7f3bad3c0400
2026-08-05 09:28:50.344 DEBUG [0x401] av_results_print_ext:257 AV results:
Detection Type: 1
Detection Name: EICAR_Test_File
Detection Msg: WE_DONT_SUPPORT_THIS_NOW
Detection Accuracy:
Detection Component Type: .
2026-08-05 09:28:50.345 DEBUG [0x401] av_util_ct_handle_end_processing:63 av_file = 0x7f3bad3c0400
2026-08-05 09:28:50.345 DEBUG [0x401] av_util_ct_run_scan:427 Commtouch API successfully completed scan.
2026-08-05 09:28:50.345 DEBUG [0x401] av_scanner_hlpr_nio_cb:5947 NIO file scan Latency in msec = 1
2026-08-05 09:28:50.345 DEBUG [0x401] av_scanner_hlpr_nio_cb:5957 Normal IO processing done, Enqueue for result processing av_file = 0x7f3bad3c0400
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_specialIO_process_result:1587 av_scanner_specialIO_process_resultav_file = 0x7f3bad3c0400av_file->sess_hdl = 139893039334913
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_specialIO_process_result:1591 Number of bytes scanned av_file->num_byte_scanned = 0
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_update_db_entry:1085 Entry Modified
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_save_file_hash_data:1152 Cache write done
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_save_file_hash_data:1156 Cache write Latency in usec = 7
2026-08-05 09:28:50.345 DEBUG [0x101] av_stat_inc_file_type_block_count:561 increment bit no. 59
2026-08-05 09:28:50.345 DEBUG [0x101] av_lef_export_log:211 verdict_type_str = av-scan
2026-08-05 09:28:50.345 DEBUG [0x101] av_lef_export_log:371 Exporting LEF AV log successful.
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_profile_hit_action:1272 AV profile based session dropped
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_notify_cp:1208 try to send CP notification. action = 5
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_notify_cp:1224 scnr_st->is_pseudo_file_name: 0
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_notify_cp:1244 scnr_st->filename: eicar_com.zip
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_notify_cp:1255 Send user notification
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_held_pkt_handle_scan_verdict:1529 action: 5 av_file_mbuf: 0x1474a1f80 scnr_st_mbuf: 0x1474a1f80, pkt_hold: 1
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_held_pkt_handle_scan_verdict:1537 vparse held mbuf called for mbuf: 0x1474a1f80 action: 5
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_process_result:4659 sess_hdl = 139893039334913
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_process_result:4687 scnr_st = 0x7f3b58937a00 index = 30
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_process_app_end:4576 application.end type = 23
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_process_app_end:4583 args->sinfo = 0x7f3b58adc410 tmp_scnr_st->pt_sinfo = (nil)
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_free_scnr_st:2031 scnr_st->pkt_hold = 1 scnr_st->app_end = 1
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_held_pkt_handle_scan_verdict:1555 File HOLD Latency in msec = 1
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_specialIO_process_result:1669 free av_defs = 0x7f3b930f1680
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_specialIO_process_result:1694 free scnr_st = 0x7f3b58937a00 sess_hdl = 139893039334913
2026-08-05 09:28:50.345 DEBUG [0x101] av_scanner_specialIO_process_result:1739 free scnr_st = 0x7f3b58937a00 av_file = 0x7f3bad3c0400 scnr_st->file_io_array = 0x7f3b58aacb40
2026-08-05 09:28:50.348 DEBUG [0x101] av_lef_data_free:66 Free an av lef template instance.