Junos :Verifying Antivirus Configurations

General Scan Engine Status

Using the CLI, you can view the following scan engine status items:

Antivirus license key status

• View license expiration dates.

Scan engine status and settings

• View last action result.
• View default file extension list.

Antivirus pattern update server settings

• View update URL (HTTP or HTTPS-based).
• View update interval.

Antivirus pattern database status

• View auto update status.
• View last result of database loading.
• If the download completes, view database version timestamp virus record number.
• If the download fails, view failure reason.

Example status result:

CLI: show security utm anti-virus status

AV Key Expire Date: 03/01/2010 00:00:00

Update Server: http://update.juniper-updates.net/AV/SRX210

interval: 60 minutes

auto update status: next update in 12 minutes

last result: new database loaded

AV signature version: 12/21/2008 00:35 GMT, virus records: 154018

Scan Engine Info: last action result: No error(0x00000000)

Session Status

Using the CLI, you can view the following session status items:

Antivirus session status displays a snapshot of current antivirus sessions. It includes

• Maximum supported antivirus session numbers.
• Total allocated antivirus session numbers.
• Total freed antivirus session numbers.
• Current active antivirus session numbers.

CLI: show security utm session

Verifying Antivirus Scan Results Using J-Web

View antivirus scan results using J-Web as follows:

1. Select Monitor>UTM>Anti-Virus.
   The following information becomes viewable in the right pane.
   Antivirus license key status
   • View license expiration dates.
   Antivirus pattern update server settings
   • View update URL (HTTP or HTTPS-based).
   • View update interval.
   Antivirus pattern database status
   • View auto update status.
   • View last result of database loading.
   • If the download completes, view database version timestamp virus record number.
   • If the download fails, view failure reason.
   Antivirus statistics provide
   • The number of scan request being pre-windowed.
   • The total number of scan request forwarded to the engine.
   • The number of scan requests using scan-all mode.
   • The number of scan requests using scan-by-extension mode.
   Scan code counters provide
   • Number of clean files.
   • Number of infected files.
   • Number of password protected files.
   • Number of decompress layers.
   • Number of corrupt files.
   • When the engine is out of resources.
   • When there is an internal error.
   Fallback applied status provides either a log-and-permit or block result when the following has occurred
   • Scan engine not ready.
   • Password protected file found.
   • Decompress layer too large.
   • Corrupt file found.
   • Out of resources.
   • Timeout occurred.
   • Maximum content size reached.
   • Too many requests.
   • Other.
2. You can click the Clear Anti-Virus Statistics button to clear all current viewable statistics and begin collecting new statistics.

Verifying Antivirus Scan Results Using the CLI

Using the CLI, you can view statistics for antivirus requests, scan results, and fallback counters.

Scan requests provide

• The total number of scan request forwarded to the engine.
• The number of scan request being pre-windowed.
• The number of scan requests using scan-all mode.
• The number of scan requests using scan-by-extension mode.

Scan code counters provide

• Number of clean files.
• Number of infected files.
• Number of password protected files.
• Number of decompress layers.
• Number of corrupt files.
• When the engine is out of resources.
• When there is an internal error.

Fallback applied status provides either a log-and-permit or block result when the following has occurred

• Scan engine not ready.
• Maximum content size reached.
• Too many requests.
• Password protected file found.
• Decompress layer too large.
• Corrupt file found.
• Timeout occurred.
• Out of resources.
• Other.

CLI: show security utm anti-virus statistics