Endpoint Protection

 View Only
  • 1.  Endpoint scan: storage migration options

    Posted Feb 22, 2012 08:38 AM

    when configuring a new scan, in the Advanced Scan options, under Storage Migration Options is a dropdown list.  What do all these options mean?

     

    (nothing was mentioned in the help file, the documentation, or by searching the Symantec site & Google)



  • 2.  RE: Endpoint scan: storage migration options

    Posted Feb 22, 2012 09:27 AM

    Storage Migration :

    Specifies the options for the files that Hierarchical Management (HSM) and offline backup systems maintain.Skip offline and sparse files

     

    Note:

    For all of these options, consult your HSM or backup vendor to select the appropriate settings.

     

     



  • 3.  RE: Endpoint scan: storage migration options
    Best Answer

    Broadcom Employee
    Posted Feb 22, 2012 09:45 AM

    Table: Storage migration options

    Option

    Description

    Skip offline files

    Specifies that if the offline bit is set, the Symantec Endpoint Protection client skips the file

    A small clock over a file's icon in Windows Explorer indicates that the offline bit is set. Any application can set the offline bit even if the file is not offline.

    Skip offline and sparse files

    Specifies that offline and sparse files are skipped

    Some applications set the file sparse bit to indicate that part of the file is not present on the disk. Some HSM products set this bit and others don't. With a sparse file, a stub of the file remains on the disk, and the majority of the file is moved to offline storage. This setting is the default.

    Skip offline and sparse files with a reparse point

    Specifies that offline and sparse files with a reparse point are skipped

    Some vendors use reparse points. Applications that use reparse points also use an appropriate device driver to manage reparse points in the files. With a reparse point, a portion of the file remains on disk, and the remainder is transparently accessed through the device driver.

    Scan resident portions of offline and sparse files

    Specifies that if the file is sparse, the Symantec Endpoint Protection client scans only the resident portion

    The Symantec Endpoint Protection client identifies resident portions of a file. The nonresident portion remains in secondary storage. Some vendors support this capability.

    Scan all files, forcing demigration (fills drive)

    The Symantec Endpoint Protection client scans the entire file, which forces demigration from secondary storage if necessary. Because the size of the secondary storage is usually greater than the size of the local volume, this setting might fill the local volume. When the local volume is full, further files that are opened for scanning might fail.

    Scan all files without forcing demigration (slow)

    Specifies that all files are scanned, without forcing demigration

    The Symantec Endpoint Protection client copies a file from secondary storage to the local hard drive as a temp file for scanning. The HSM application leaves the original file on the secondary storage.

    This method is slow and not all HSM vendors support it. Because a file is copied from secondary storage to a disk for scanning, resource demand is high. Processor and network performance might further degrade as the Symantec Endpoint Protection client detects infected content when a repair or deletion is returned to secondary storage.

    Scan all files recently touched without forcing demigration

    Specifies that all files that have been touched recently are scanned, without forcing demigration

    This option lets you specify that only the files that have been migrated recently and might still reside on faster secondary storage are scanned. This method can reduce some of the resource demand issues with the Scan all files without forcing demigration option.

    You can the scan the files that reside on faster disks, and skip demigration and scans if the files reside on slow disks. For example, files might be migrated to a remote disk after 30 days of no access. After 60 days of no access, the file is migrated to DVD-ROM or remote SAN storage. This method might still be slow because file access without forced demigration can be a slow operation.

    If you select this option, you must select the type of access and the number of days to define "recently touched."

    Open files using backup semantics

    Specifies that files be opened using backup semantics

    In some cases, using this option may allow the Symantec Endpoint Protection client to scan files without demigration. It may also allow the client to scan the stub, but not the rest of the demigrated file.

    Type of access within the number of days selected

    If you select Scan all files recently touched without forcing demigration, you must set this option. This option specifies the type of access (Accessed, Modified, or Created) and the number of days to define as "recent."



  • 4.  RE: Endpoint scan: storage migration options

    Posted Feb 27, 2012 01:03 PM

    Thanks Pete.  This was exactly the information for which I was looking. 

    In my haste I neglected to mention that I was specifically trying to determine which option yielded the most thorough scan (particularly when using, or not using, forced demigration).  However, from what you posted above, my question was still answered in it's entirely anyway. 

    It appears the most thorough option is scanning them all without forced demigration (since the demigration might possibly cause some files to be skipped).

     

    Thanks again for replying.