Vscan disconnect due to Vscan table update
Applies to
- ONTAP 9
- Vscan
Issue
- In the
EMSlog, Vscan table update events (OffboxVScanTableUpd)are reported as shown in below snippet:
Mon Jan 15 00:04:51 +0000 [Node-01: nblade2: Nblade.vscanNoScannerConn:EMERGENCY]: Vserver "svm" has no virus scanner connection.
Mon Jan 15 00:04:52 +0000 [Node-01: OffboxVScanTableUpd: ems.engine.suppressed:debug]: Event 'Nblade.scannerDisconnected' suppressed 1 times in last 1222378 seconds.
Mon Jan 15 00:04:52 +0000 [Node-01: OffboxVScanTableUpd: Nblade.scannerDisconnected:notice]: Vserver "svm" disconnected from Vscan server (IP: 10.48.xx.xx).
Mon Jan 15 00:05:42 +0000 [Node-01: mgwd: vscan.newVersion.allocated:info]: Vscan version mechanism added new version-ID for Vserver 'svm' corresponding to vendor 'symantec protection engine', version '20240114.7'.
Mon Jan 15 00:05:42 +0000 [Node-01: OffboxVScanTableUpd: ems.engine.suppressed:debug]: Event 'Nblade.scannerConnected' suppressed 1 times in last 1222428 seconds.
Mon Jan 15 00:05:42 +0000 [Node-01: OffboxVScanTableUpd: Nblade.scannerConnected:notice]: Vserver "svm_gbclh1valecifs1" connected to Vscan server (IP: 10.48.xx.xx).
Audit logreports vscan events for the same timestamp and we can see vscan disconnected and came back with new version, this indicates vscan software update resulted in this event
Node-01 svm 10.48.32.75 1/15/2024 00:04:52 scanner-disconnected remote-closed 10.48.xx.xx 1
Node-01 svm 10.48.32.75 1/15/2024 00:05:42 scanner-connected symantec protection engine 20240114.7 10.48.xx.xx 1
