Vscan Server Status Disconnected from long time as Scanner Fails to Register with ONTAP

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 83

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas

Last Updated:

Applies to

ONTAP 9 (Cluster Mode)
Trend Micro Vscan Server

Issue

Vscan server status shows as disconnected from quite long time. No disconnect reason listed.

Node::> vscan connection-status show-not-connected -instance
  (vserver vscan connection-status show-not-connected)
                                   Node: Node-1
                                Vserver: SVM
                                 Server: x.x.x.x
                          Server Status: disconnected
               Server Disconnect Reason: -
Time When Vscan Server Was Disconnected: -
                            Server Type: primary
                                   Node: Node-2
                                Vserver: SVM
                                 Server: x.x.x.x
                          Server Status: disconnected
               Server Disconnect Reason: -
Time When Vscan Server Was Disconnected: -
                            Server Type: primary

Enabled ONTAP Antivirus Connector Logging, and found that
- ONTAP using ZAPI and correctly discovers VSCAN-capable LIFs and mark selected VSCAN LIF in use.
- Ontap is trying to connect with VSCAN server, but scanner never completes registration.
- As scanner does not complete register, the pipe is never validated and is eventually closed.

Issuing zapi network query to 167.x.x.52
[MgmtHost::FetchVlifs] vserver:[SVM], node:[node-2], exists:[1]
[MgmtHost::FetchVlifs] vserver:[SVM], node:[node-2], exists:[1]
[MgmtHost::FetchVlifs] vserver:[SVM], node:[node-1], exists:[1]
[LifParam::ReconcileLifThreads] [plp: 16.x.x.52, node-2] in_use: [1]
[LifParam::ReconcileLifThreads] [plp: 167.x.x,50, node-1] in_use: [1]
[Pipe: -> node-2][r] Waiting for scanner to register before opening the pipe
basicStats: %cpu=1, %net=0
[Pipe: -> node-1][r] Waiting for scanner to register before opening the pipe
[pipe: 167.x.x.50][w][sess: 0] sending extended-stats, valid-pipe?[0]
[Pipe: 167.x.x.50] lastStatsSkipTime timeout. Closing pipe...
[pipe: 167.x.x.52][w][sess: 0] sending extended-stats, valid-pipe?[0]
[Pipe: 167.x.x.52] lastStatsSkipTime timeout. Closing pipe...

Packet trace:
- Similar behaviour is noted in packet trace Vscan server sends TCP RST packets to ONTAP, terminating the session. These resets originate from the AV server and not from ONTAP, indicating that the session is being rejected or terminated externally.