Endpoint Protection

So vshield is interted into the hypervisor, the VSA is running on the host, there is a Win 8.1 guest on the host with the endpoint driver installed, so surely it should be handing off the scanning of files to the appliance?

but how do i know its working. I thought I'd see some sort of logfile on the vshield web interface telling me it was scanning files as it did it. but i can't find anything and im struggling to see anything on the documentation on how to make sure its working. other than the eicar test file.

if it helps, the client machine isn't showing in SEPM console yet. should it?

thanks.

found the first part of the answer and that is

check that the SVA is checking in with

SEPM Console >> Monitors >> Security Virtual Appliance.

now to work out why mine isnt.

Have you checked the SVA_Install.log?

http://www.symantec.com/docs/HOWTO81083

i have, it shows the install fine, but it doesn't show the appliance trying to get back to the SEPM server. im guessing thats in the next few steps?

Have you tried exporting and replacing the sylink file manually?

not sure how to do that on an appliance, is there a guide somewhere?

Matt

Should be in the Installation settings section

http://www.symantec.com/docs/HOWTO81082

it is in there and i've configured the settings as part of the install. is there a guide to using the command line to verify settings anywhere?

Matt

I don't think that you understand what the Security Virtual Appliance does:

https://support.symantec.com/en_US/article.HOWTO81080.html

The Symantec Endpoint Protection Security Virtual Appliance is a Linux-based virtual appliance that you install on a VMware ESX/ESXi server. The Security Virtual Appliance integrates with VMware's vShield Endpoint. The Shared Insight Cache runs in the appliance and lets Windows-based Guest Virtual Machines (GVMs) with the Symantec Endpoint Protection client installed share scan results. Identical files are trusted and therefore skipped across all of the GVMs on the ESX/ESXi host. Shared Insight Cache improves full scan performance by reducing disk I/O and CPU usage.

The guest OS does NOT offload file scanning to the SVA.

thanks for the heads up. I'd been led to believe that in its most basic guise, it offloaded AV scans to an appliance, to stop it from slowing down the gvm, but i can see thats not the case now. 

It does work best when you also use it with the Virtual Image Exception tool when you create your VM images.  That way the overall scan time is extremely low AND the guests share known-good-file information with each other.  Check out VIE and see if that would work for you.