APIs in Category: antivirus
 Cluster-Mode API version 1.15

 
av-get-engine-info
av-get-engine-options
av-get-log
av-get-remedy-info
av-get-version-info
av-log-iter
av-set-engine-info
av-set-engine-options
av-set-log
av-set-remedy-info
av-set-version-info
av-start-update
These APIs collectively enable the getting/setting of values associated with the following antivirus entities:

1. Engine: This is the vendor-specific scan engine library that is used to scan and repair files.

2. Version: This is the version information for the different components of the antivirus solution. viz. the platform-specific scan engine library, the virus pattern files, the spyware pattern files and the Data ONTAP cluster version associated with a specific version of the antivirus components.

3. Agent: This is an embedded 3rd party program that communicates with a vendor-specific Server on the customer network and provides a consistent interface to the vendor solution.

4. Engine Options: These are tunable options of the engine that have reasonable defaults; but can be overriden in some cases.

5. Event Log: This is a log of important events that the vendor cares about. These are not intended to be verbose. These entries are typically logged only when there are policy changes in the antivirus configuration.

6. Update: This is a way to start an asynchronous update job via the job manager to get engine and pattern-file updates from an external (or customer) website.

7. Remedy: These are options that determine the remedy action when a virus is detected. Eg. quarantine of files, renaming of files, etc.

NetApp Manage ONTAP
 
av-get-engine-info [top]

This gets the attributes of the Anti-Virus engine installed.
Output Name Range Type Description
is-enabled boolean
If 'true', the AV feature has been enabled on the cluster.
license-expiry-time integer
Expiry date of license in seconds from midnight Jan 1, 1970. Range : [0..2^32-1]
license-key string
Vendor-specific license key for license management, that is currently in effect.
license-type string
Vendor-specific license type. Possible values:
  • "full" - full license
  • "eval" - evaluation license
  • "none" - no license
prod-info string
Detailed information of the AV product
seats integer
Number of nodes that can run an instance of the AV software Range : [0..2^32-1]
update-url string
HTTP/HTTPS url for downloading updates.
vendor string
Descriptive name of AV vendor
 Errno  Description
 EINTERNALERROR
 ELOWMEMORY

 
av-get-engine-options [top]
Get the attributes of the antivirus.
Input Name Range Type Description
desired-attributes av-engine-option
optional
Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
 
Output Name Range Type Description
attributes av-engine-option
The attributes of the antivirus.
 Errno  Description
 EOBJECTNOTFOUND
 EINTERNALERROR

 
av-get-log [top]
Get the attributes of the antivirus.
Input Name Range Type Description
datetime [0..2^31-1] integer
When the event is logged. The time value is in seconds since January 1, 1970.
desired-attributes av-event-info
optional
Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
 
Output Name Range Type Description
attributes av-event-info
The attributes of the antivirus.
 Errno  Description
 EOBJECTNOTFOUND
 EINTERNALERROR

 
av-get-remedy-info [top]
This gets the remedy information of the Anti-Virus engine installed. i.e. what to do when a virus is found.
Output Name Range Type Description
action string
The remedy action desired. Possible values:
  • "none" - no action will be taken
  • "repair" - file will be reparied
  • "delete" - file will be deleted
  • "quarantine" - file will be quarantined
directory string
The pathname of the directory to use for quarantine.
extension string
The file extension to use for the remedy action.
option string
The option of the remedy action desired. Possible values:
  • "move" - file will be moved
  • "add_extension" - an extencion will be added to the file
repair string
The failed repair option to try. Possible values:
  • "none" - no action will be taken
  • "delete" - file will be deleted
  • "quarantine" - file will be quarantined
 Errno  Description
 EINTERNALERROR
 ELOWMEMORY

 
av-get-version-info [top]
This gets the version information of the Anti-Virus engine installed.
Output Name Range Type Description
last-update-time integer
Update time of the current AV version in seconds from midnight January 1, 1970.
spyware-pattern-version string
The version of the spyware pattern files
virus-pattern-version string
The version of the virus pattern files
vsapi-32-bit-version string
The version of the 32-bit VSAPI engine.
vsapi-64-bit-version string
The version of the 64-bit VSAPI engine.
 Errno  Description
 EINTERNALERROR
 ELOWMEMORY

 
av-log-iter [top]
Iterate over a list of antivirus objects.
Input Name Range Type Description
desired-attributes av-event-info
optional
Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
max-records [1..100] integer
optional
The maximum number of records to return in this call. Default: 20
query av-event-info
optional
A query that specifies which objects to return. A query could be specified on any number of attributes in the antivirus object. All antivirus objects matching this query up to 'max-records' will be returned.
tag string
optional
Specify the tag from the last call. It is usually not specified for the first call. For subsequent calls, copy values from the 'next-tag' obtained from the previous call.
 
Output Name Range Type Description
attributes-list av-event-info[]
optional
The list of attributes of antivirus objects.
next-tag string
optional
Tag for the next call. Not present when there are no more antivirus objects to return.
num-records [0..100] integer
The number of records returned in this call.
 Errno  Description
 EINTERNALERROR

 
av-set-engine-info [top]
This sets the attributes of the Anti-Virus engine installed. If an optional attribute is not specified, the current value is left unchanged.
Input Name Range Type Description
is-enabled boolean
optional
If 'true', the AV feature is to be enabled on the cluster.
license-expiry-time integer
optional
Expiry date of license in seconds from midnight Jan 1, 1970. Range : [0..2^32-1]
license-key string
optional
Vendor-specific license key for license management, that is currently in effect.
license-type string
optional
Vendor-specific license type. Possible values:
  • "full" - full license
  • "eval" - evaluation license
  • "none" - no license
prod-info string
optional
Detailed information of the AV product
seats integer
optional
Number of nodes that can run an instance of the AV software Range : [0..2^32-1]
update-url string
optional
HTTP/HTTPS url for downloading updates.
vendor string
optional
Descriptive name of AV vendor
 Errno  Description
 EINTERNALERROR
 EINVALIDINPUTERROR
 ERESOURCEINUSE
 ELOWMEMORY

 
av-set-engine-options [top]
Modify the attributes of antivirus object.
Input Name Range Type Description
cache-size [0..2^32-1] integer
optional
Max Cache Size for Scanning Files (MB)
group-archive-unpack boolean
optional
Scan archive file formats
heuristic-analysis boolean
optional
Heuristic Virus Search Analysis
macro-analysis boolean
optional
Macro Virus Search Analysis
max-recursion-depth [0..2^32-1] integer
optional
Max recursion depth into archives
mime-lines-to-scan [0..2^32-1] integer
optional
Max Lines to Scan to Identify MIME file
proxy-host string
optional
proxy server name e.g. http://proxy_server_name
proxy-login string
optional
proxy server login
proxy-password string
optional
proxy server password
proxy-port [0..2^32-1] integer
optional
proxy server port number
scan-mime boolean
optional
Scan MIME-Encoded Files
 Errno  Description
 EOBJECTNOTFOUND
 EINTERNALERROR

 
av-set-log [top]
Create a new antivirus.
Input Name Range Type Description
datetime [0..2^31-1] integer
When the event is logged. The time value is in seconds since January 1, 1970.
return-record boolean
optional
If set to true, returns the antivirus on successful creation. Default: false
vendor-id [0..2^32-1] integer
Vendor ID
vendor-string string
Vendor String
 
Output Name Range Type Description
result av-event-info
optional
The antivirus created (keys or the entire object if requested)
 Errno  Description
 EINTERNALERROR

 
av-set-remedy-info [top]
This sets the quarantine information of the Anti-Virus engine installed. If an optional attribute is not specified, the current value is left unchanged.
Input Name Range Type Description
action string
optional
The remedy action desired. Possible values:
  • "none" - no action will be taken
  • "repair" - file will be reparied
  • "delete" - file will be deleted
  • "quarantine" - file will be quarantined
directory string
optional
The pathname of the directory to use for quarantine.
extension string
optional
The file extension to use for the remedy action.
option string
optional
The option of the remedy action desired. Possible values:
  • "move" - file will be moved
  • "add_extension" - an extencion will be added to the file
repair string
optional
The failed repair option to try. Possible values:
  • "none" - no action will be taken
  • "delete" - file will be deleted
  • "quarantine" - file will be quarantined
 Errno  Description
 EINTERNALERROR
 EINVALIDINPUTERROR
 ELOWMEMORY

 
av-set-version-info [top]
This sets the version information of the Anti-Virus engine installed. If an optional attribute is not specified, the current value is left unchanged.
Input Name Range Type Description
cluster-version string
The current cluster version of the engine. If this does not correspond to the current cluster version of the engine, then the ZAPI fails.
component-updated string
optional
The component that was updated. Possible values:
  • "engine" - only antivirus engine was updated
  • "vde" - only virus definition files were updated
  • "both" - both antivirus engine and virus definition files were updated
spyware-pattern-version string
optional
The version of the spyware pattern files
virus-pattern-version string
optional
The version of the virus pattern files
vsapi-32-bit-version string
optional
The version of the 32-bit VSAPI engine.
vsapi-64-bit-version string
optional
The version of the 64-bit VSAPI engine.
 Errno  Description
 EINTERNALERROR
 EINVALIDINPUTERROR
 ELOWMEMORY
 EVERSION_INVALIDRANGE
 EVERSION_EXISTS

 
av-start-update [top]
Run an Anti-Virus Update job immediately
Input Name Range Type Description
sync boolean
If 'true', an AV Update job should be started immediately
 Errno  Description
 EINTERNALERROR
 EINVALIDINPUTERROR
 ELOWMEMORY

 
Element definition: av-engine-option [top]
AV engine options When returned as part of the output, all elements of this typedef are reported, unless limited by a set of desired attributes specified by the caller.

When used as input to specify desired attributes to return, omitting a given element indicates that it shall not be returned in the output. In contrast, by providing an element (even with no value) the caller ensures that a value for that element will be returned, given that the value can be retrieved.

When used as input to specify queries, any element can be omitted in which case the resulting set of objects is not constrained by any specific value of that attribute.

Name Range Type Description
decompressed-file-count-limit string
optional
Generic/Dummy Field 1 Attributes: required-for-create, modifiable
decompressed-file-size-limit string
optional
Generic/Dummy Field 2 Attributes: required-for-create, modifiable
decompression-layers-limit string
optional
Generic/Dummy Field 3 Attributes: required-for-create, modifiable
decompression-size-factor string
optional
Generic/Dummy Field 4 Attributes: required-for-create, modifiable
is-spyware-enabled string
optional
Generic/Dummy Field 5 Attributes: required-for-create, modifiable

 
Element definition: av-event-info [top]
Log Entry Written by an Antivirus Agent When returned as part of the output, all elements of this typedef are reported, unless limited by a set of desired attributes specified by the caller.

When used as input to specify desired attributes to return, omitting a given element indicates that it shall not be returned in the output. In contrast, by providing an element (even with no value) the caller ensures that a value for that element will be returned, given that the value can be retrieved.

When used as input to specify queries, any element can be omitted in which case the resulting set of objects is not constrained by any specific value of that attribute.

Name Range Type Description
datetime [0..2^31-1] integer
optional
When the event is logged. The time value is in seconds since January 1, 1970. Attributes: key, required-for-create, non-modifiable
vendor-id [0..2^32-1] integer
optional
Vendor ID Attributes: required-for-create, modifiable
vendor-string string
optional
Vendor String Attributes: required-for-create, modifiable