Vscan disconnect due to Vscan table update
Applies to
- ONTAP 9
- Vscan
Issue
- In the
EMS
log, Vscan table update events (OffboxVScanTableUpd)
are reported as shown in below snippet:
Mon Jan 15 00:04:51 +0000 [Node-01: nblade2: Nblade.vscanNoScannerConn:EMERGENCY]: Vserver "svm" has no virus scanner connection.
Mon Jan 15 00:04:52 +0000 [Node-01: OffboxVScanTableUpd: ems.engine.suppressed:debug]: Event 'Nblade.scannerDisconnected' suppressed 1 times in last 1222378 seconds.
Mon Jan 15 00:04:52 +0000 [Node-01: OffboxVScanTableUpd: Nblade.scannerDisconnected:notice]: Vserver "svm" disconnected from Vscan server (IP: 10.48.xx.xx).
Mon Jan 15 00:05:42 +0000 [Node-01: mgwd: vscan.newVersion.allocated:info]: Vscan version mechanism added new version-ID for Vserver 'svm' corresponding to vendor 'symantec protection engine', version '20240114.7'.
Mon Jan 15 00:05:42 +0000 [Node-01: OffboxVScanTableUpd: ems.engine.suppressed:debug]: Event 'Nblade.scannerConnected' suppressed 1 times in last 1222428 seconds.
Mon Jan 15 00:05:42 +0000 [Node-01: OffboxVScanTableUpd: Nblade.scannerConnected:notice]: Vserver "svm_gbclh1valecifs1" connected to Vscan server (IP: 10.48.xx.xx).
Audit log
reports vscan events for the same timestamp and we can see vscan disconnected and came back with new version, this indicates vscan software update resulted in this event
Node-01 svm 10.48.32.75 1/15/2024 00:04:52 scanner-disconnected remote-closed 10.48.xx.xx 1
Node-01 svm 10.48.32.75 1/15/2024 00:05:42 scanner-connected symantec protection engine 20240114.7 10.48.xx.xx 1