city

City

country

Country

department

Department name

floor

Floor

latitude

Latitude

longitude

Longitude

organization

Organization name

province

Province name

room

Room number

street

Street name

approve-to-group

-

The group which is set as a primary by default for new stations for the Allow access automatically mode (mode='open').

Empty value, which means assign the Everyone group as a primary.

mode

•open—allow access automatically,

•closed—always deny access,

•approval—approve access manually.

New stations approval policy.

-

enabled

•yes—automatically create missing station accounts,

•no—installation is possible only according to already created accounts in the group, installation package for stations of which is launched.

yes

enabled

•yes—replace,

•no—do not replace. The <agent-host-names /> parameter will be used instead.

NetBIOS name replacement mode.

host

•yes—display partially qualified DNS names (before the dot in FQDN),

•no—display fully qualified DNS names (FQDN).

Displayed name format after replacement.

enabled

•yes—store responses in the cache,

•no—do not store responses in the cache.

Mode of storing responses in the cache.

negative-ttl

-

Storage time in the cache (TTL) of negative responses from the DNS server in minutes.

positive-ttl

-

Storage time in the cache (TTL) of positive responses from the DNS server in minutes.

level

Integer from 1 to 9.

Compression level.

mode

•yes—use compression,

•no—do not use compression,

•possible—compression is allowed.

Compression mode.

queue-size

•positive integer,

•unlimited.

Maximum allowable number of updates distribution sessions running at the same time from Dr.Web Server. When the limit is reached, the Agent requests are placed into the waiting queue. The waiting queue size is unlimited.

unlimited

value

•maximal speed in KB/sec,

•unlimited.

Maximal summary speed for updates transmission.

unlimited

queue-size

•positive integer,

•unlimited.

Maximum allowable number of the Agent installation sessions running at the same time from Dr.Web Server. When the limit is reached, the Agent requests are placed into the waiting queue. The waiting queue size is unlimited.

unlimited

value

•maximal speed in KB/sec,

•unlimited.

Maximal summary speed for transmitting data during Agent installations.

unlimited

enabled

•yes—allow synchronization,

•no—disable synchronization.

Synchronization mode.

startup-sync

Positive integer.

Number of stations without geographical coordinates, information on which is requested when establishing a connection between Dr.Web Servers.

auth-list

•none—do not use authorization,

•any—any supported method,

•safe—any safe supported method,

•the following methods, if several, set all necessary methods separated by a space:

▫basic

▫digest

▫digestie

▫ntlmwb

▫ntlm

▫negotiate

Proxy server authorization type. Default is 'any'.

enabled

•yes—use proxy server,

•no—do not use proxy server.

Mode of connections to Dr.Web Server via HTTP proxy server.

host

-

Proxy server address.

password

-

Password of proxy server user if proxy server requires authorization.

user

-

Name of proxy server user if proxy server requires authorization.

enabled

•yes—send statistics,

•no—do not send statistics.

Mode of statistics sending to the Doctor Web company.

-

id

-

MD5 of the Agent license key.

-

interval

Positive integer.

Interval of statistics sending in minutes.

30

multicast-group

IP address of multicast group through which Dr.Web Servers will be exchanging information.

port

Port number of network interface to which transport protocol is bound to transmit the information into multicast group.

interface

IP address of network interface to which transport protocol is bound to transmit the information into multicast group.

port

<port value="" />

value

The Dr.Web Server's network interface port number that is used by transport multicast protocol to transmit the updates. This port is used by all multicast groups.

For multicast updates, you must specify any unused port that will be different from the one specified in the Dr.Web Server's transport protocol settings.

2197

ttl

<ttl value="" />

value

Time-to-live of transferred UDP-datagram. This value will be used by all multicast groups.

8

group

<group address="" />

address

IP address of a multicast group the stations will receive multicast updates from.

233.192.86.0 for IPv4

FF0E::176 for IPv6

on

<on interface="" ttl="" />

interface

IP address of Dr.Web Server network interface that transport multicast protocol is bound to for updates transmission.

–

ttl

Time-to-live of a UDP-datagram transferred through specified network interface. Has a higher priority than the general <ttl value="" /> child element.

8

transfer

<transfer datagram-size="" assembly-timeout="" updates-interval="" chunks-interval="" resend-interval="" silence-interval="" accumulate-interval="" announce-send-times="" />

datagram-size

UDP datagram size (bytes)—size of UDP datagrams in bytes.

Allowed range is 512–8192. To avoid fragmentation, it is recommended that you set a value less than MTU (Maximum Transmission Unit) of the network.

1400

assembly-timeout

File transmission time (ms.)—during the specified time, single update file is transmitted, after that Dr.Web Server starts sending the next file.

All files, which failed to transmit as a part of multicast protocol update, will be transmitted as a part of standard update process over the TCP protocol.

180000

updates-interval

Duration of multicast updates (ms.)—duration of update process via multicast protocol.

All files that failed to transmit at the stage of updating via multicast protocol will be transmitted as a part of the standard update via TCP protocol.

600000

chunks-interval

Package transmission interval (ms.)—interval of package transmission to a multicast group.

The low interval value may cause significant losses during package transfer and overload the network. It is not recommended to change this parameter.

14

resend-interval

Interval between requests for retransmission (ms.)—at this interval Agents send out requests for retransmission of lost packages.

Dr.Web Server accumulates these requests and sends out any lost blocks afterwards.

1000

silence-interval

“Silence” interval on the line (ms.)—whenever a file transmission is over before the allowed time has expired and if during a specified “silence” interval no requests for retransmission of lost packages are received from Agents, Dr.Web Server assumes that all Agents successfully received update files and initiates transmission of the next file.

10000

accumulate-interval

Retransmission request accumulation interval (ms.)—during the specified interval, Dr.Web Server accumulates requests from Agents for retransmission of lost packages.

Agents request for lost packages. Dr.Web Server accumulates these requests throughout the specified time and sends out any lost blocks afterwards.

2000

announce-send-times

Number of file transmission announcements—A number of times Dr.Web Server announces a file transmission to a multicast group before the update transmission starts.

The announcement means a UDP-datagram with file metadata, which is sent to a multicast group. Increasing the number of announcements can potentially improve transmission reliability, but at the same time can lead to decreased amount of data that can be transmitted over the multicast protocol for the time allowed.

3

connections

Positive integer.

Maximal number of connections of Dr.Web Server with database. It is recommended to change default value only after consultation with the technical support.

2

speedup

yes | no

Automatically perform the delayed purging of the database after its initialization, upgrade and import (see Administrator Manual, p. Database).

yes

dbfile

Database name.

database.sqlite

cache

SHARED | PRIVATE

Caching mode.

SHARED

cachesize

Positive integer.

Database cache size (in 1.5Kb pages).

2048

precompiledcache

Positive integer.

Cache size of precompiled sql operators (in bytes).

1048576

synchronous

•TRUE or FULL—synchronous

•FALSE or NORMAL—regular

•OFF—asynchronous

Data write mode.

FULL

checkintegrity

quick | full | no

Verify integrity of database image at Dr.Web Server startup.

quick

autorepair

yes | no

Automatically restore corrupted database image at Dr.Web Server startup.

no

mmapsize

Positive integer.

Maximum number of bytes of the database file that is allowed to be mapped into the process address space at one time.

•for UNIX—10485760

•for Windows—0

wal

yes | no

Use Write-Ahead Logging.

yes

wal-max-pages

Maximal number of “dirty” pages on reaching of which pages will been written on the disk.

1000

wal-max-seconds

Maximal time to delay writing the pages on the disk (in seconds).

30

dbname

Database file name.

host

PostgreSQL server host or path to UNIX domain socket.

port

PostgreSQL server port or extension of UNIX domain socket file.

options

Command line parameters to send to a database server.

For more details, see chapter 18 at https://www.postgresql.org/docs/9.1/libpq-connect.html

requiressl

•1 | 0 (via Control Center)

•y | n

•yes | no

•on | off

Allow SSL connections only.

•0

•y

•yes

•on

user

Database user name.

password

Database user password.

temp_tablespaces

Namespace for temporary tables.

default_transaction_isolation

•read uncommitted

•read committed

•repeatable read

•serializable

Transaction isolation level.

read committed

connectionstring

String with Oracle SQL Connect URL or Oracle Net keyword-value pairs.

user

Registration name of database user.

password

Database user password.

client

Path to the Oracle Instant Client for the access to the Oracle DB. Dr.Web Server is supplied with the Oracle Instant Client of 11 version. But, for later Oracle Servers or if the Oracle driver contains errors, you can download corresponding driver from the Oracle site and set the path to the driver in this field.

prefetch-rows

0-65535

Number of rows to be prefetched when executing a query to the database.

0—use the value = 1 (database default)

prefetch-mem

0-65535

Memory allocated for rows to be prefetched when executing a query to the database.

0—unlimited

dsn

ODBC data source name.

drwcs

user

Registration name of database user.

drwcs

pass

Database user password.

drwcs

limit

Positive integer.

Reconnect to the DBMS after specified number of transaction.

0—do not reconnect

transaction

•SERIALIZABLE—serializable

•READ_UNCOMMITTED—read uncommitted data

•READ_COMMITTED—read committed data

•REPEATABLE_READ—repeatable read

•DEFAULT—equal ""—depends on DBMS.

Transaction isolation level.

Some DBMS support READ_COMMITTED only.

DEFAULT

dbname

Database name.

drwcs

host

Either of the two.

Database server address for TCP/IP connections.

localhost

Path to UNIX socket file when using UDS. If not set, Dr.Web Server tries to locate the file in one of standard mysqld directories.

/var/run/mysqld/

port

Either of the two.

Port number to connect to the database via TCP/IP.

3306

UNIX socket file name when using UDS.

mysqld.sock

user

Registration name of database user.

""

password

Database user password.

""

ssl

yes | any other string

Allow SSL connections only.

no

precompiledcache

Positive integer.

Cache size of precompiled sql operators (in bytes).

1048576

profile

•yes,

•no.

Log information on the Dr.Web Server scripts execution profiling. This parameter is used by technical support and developers. It is not recommended to change this parameter without need.

no

stack

Log information on Dr.Web Server scripts execution from a call stack. This parameter is used by technical support and developers. It is not recommended to change this parameter without need.

trace

Log information on Dr.Web Server scripts execution tracing. This parameter is used by technical support and developers. It is not recommended to change this parameter without need.

discovery

Defines whether the Dr.Web Server detection service is used or not.

no, specified with the ip attribute only.

yes, no

no

•ip

•unix

Defines the family of used protocols and specifies the interface address.

yes

-

•0.0.0.0

•-

name

Specifies the Dr.Web Server name for the Dr.Web Server detection service.

no

-

drwcs

multicast

Defines whether Dr.Web Server included into a multicast group or not.

no, specified with the ip attribute only.

yes, no

no

multicast-group

Specifies the address of the multicast group into which Dr.Web Server is included.

no, specified with the ip attribute only.

-

•231.0.0.1

•[ff18::231.0.0.1]

port

Port to listen.

no, specified with the ip attribute only.

-

2193

enabled

•yes—protocol is enabled,

•no—protocol is disabled.

Protocol usage mode.

no

name

•AGENT—protocol that allows interaction of Dr.Web Server with Dr.Web Agents.

•MSNAPSHV—protocol that allows interaction of Dr.Web Server with the Microsoft NAP Validator component of system health validating.

•INSTALL—protocol that allows interaction of Dr.Web Server with Dr.Web Agent installers.

•CLUSTER—protocol for interaction between Dr.Web Servers in the cluster system.

•SERVER—protocol that allows interaction of Dr.Web Server with other Dr.Web Servers.

Protocol name.

-

enabled

•yes—extension is enabled,

•no—extension is disabled.

Extension usage mode.

no

name

•WEBMIN—Dr.Web Security Control Center extension for managing Dr.Web Server and anti-virus network via the Control Center.

•FrontDoor—Dr.Web Server FrontDoor extension that allows connections of Dr.Web Server remote diagnostics utility.

Extension name.

-

min-count

Maximal number of remaining licenses for which the Limitation on a number of licenses in the license key notification will be sent.

3

min-percent

Maximal percentage of remaining licenses for which the Limitation on a number of licenses in the license key notification will be sent.

5

report-period

Period of reports creation by Dr.Web Server on license keys it uses.

If a report on license usage is created by a child Dr.Web Server, then after it is created, this report is sent to the main Dr.Web Server.

Created reports are additionally sent at each connection (including restart) of Dr.Web Server, and also at changing the number of donated licenses at the main Dr.Web Server.

1440

active-stations-period

Period for counting the number of active stations for creating the report on licenses usage. The 0 value prescribes to count all stations in the report not depending on their activity status.

0

expiration-interval

Validity period of donated licenses—time period on which licenses are donated from the key on this Dr.Web Server. The setting is used if the Server donates licenses to neighbor Dr.Web Servers.

1440

prolong-preact

Period for accepted licenses renewal—period till the license expiration, starting from which this Dr.Web Server initiates renewal of the license which is accepted from the neighbor Dr.Web Server. The setting is used if Dr.Web Server accepts licenses from neighbor Dr.Web Servers.

60

check-interval

License synchronization period—interval for synchronising information about donating licenses between Dr.Web Servers.

1440

from

-

Email address which will be set as a sender of emails.

drwcs@localhost

debug

•yes—use debug mode,

•no—do not use debug mode.

Use debug mode to get SMTP session detailed log.

no

server

-

SMTP server address which is used to send emails.

127.0.0.1

user

-

Name of SMTP server user, if the SMTP server requires authorization.

-

pass

-

password of SMTP server user, if the SMTP server requires authorization.

-

port

Positive integer.

SMTP server port which is used to send emails.

25

start_tls

•yes—use this authentication type,

•no—do not use this authentication type.

Encrypt data transfer. At this, switching to secured connection is performed by using the STARTTLS command. The 25 port is used by default for the connection.

yes

auth_plain

Use plain text authentication on a mail server.

no

auth_login

Use LOGIN authentication on a mail server.

no

auth_cram_md5

Use CRAM-MD5 authentication on a mail server.

no

auth_digest_md5

Use DIGEST-MD5 authentication on a mail server.

no

auth_ntlm

Use AUTH-NTLM authentication on a mail server.

no

conn_timeout

Positive integer.

Connection timeout for SMTP server.

180

enabled

•yes—use SSL,

•no—do not use SSL.

SSL encryption usage mode.

no

verify_cert

•yes—check SSL sertificate,

•no—do not check SSL sertificate.

Validate the SSL certificate of a mail server.

no

ca_certs

-

The path to the root SSL certificate of Dr.Web Server.

-

enabled

yes | no

Enables monitoring of multiple events of infecting stations and be able to send summary notifications to the administrator.

yes

aggregation-period

Positive integer.

Time period in seconds after sending the notification about epidemic, during which single notifications about infected stations will not be sent.

300

check-period

Time period in seconds, during which specified number of messages on infected stations must be received, to send the corresponding notification about epidemic.

3600

threshold

The number of messages on infections that must be received in specified time period, so that Dr.Web Server may send to the administrator a single notification on epidemic on all cases of infection (the Epidemic in the network notification).

100

most-active

Number of the most frequently occurring threats which must be included in the epidemic report.

5

enabled

yes | no

Enables monitoring of multiple events of Preventive protection and be able to send summary notifications to the administrator.

yes

aggregation-period

Positive integer.

Time period in seconds after sending a summary report on Preventive protection events, during which notifications about single events will not be sent.

300

check-period

Time period in seconds, during which specified number of Preventive protection events must be occurred to send a summary report.

3600

threshold

The number of the Preventive protection events that must be received in specified time period, so that Dr.Web Server may send to the administrator a single summary report on these events (the Summary report of Preventive protection notification).

100

most-active

Number of the most frequently occurring processes that have performed a suspicious action, which must be included in the Preventive protection report.

5

enabled

yes | no

Enables monitoring of multiple events of Application Control and be able to send summary notifications to the administrator.

yes

aggregation-period

Positive integer.

Time period in seconds after sending a summary report on processes blocked by Application Control, during which notifications about single blockings will not be sent.

300

check-period

Time period in seconds, during which specified number of processes must be blocked to send a summary report.

3600

threshold

The number of events on processes blocked by Application Control that must be received in specified time period, so that Dr.Web Server may send to the administrator a single summary report on these events (the Large number of blocks by the Application Control detected notification).

100

most-active

Number of the most common profiles according to which the block was made, and which must be included in the notification on multiple blockings.

5

enabled

yes | no

Enables monitoring of abnormally terminated connections with clients and be able to send corresponding notifications to the administrator.

yes

aggregation-period

Positive integer.

Time period in seconds after sending the notification on multiple connections termination, during which notifications about single terminated connections will not be sent.

300

check-period

Time period in seconds, during which specified number of connections with clients must be terminated, to send the corresponding notification.

3600

single-alert-threshold

Minimum number of connections with a single address that must be terminated during the counting period, to send the notification about single abnormally terminated connection (the Connection terminated abnormally notification).

10

summary-alert-threshold

Minimum number of connections that must be terminated during the counting period, to send the common notification about multiple abnormally terminated connections (the Large number of abnormally terminated connections detected notification).

1000

min-session-duration

If duration of terminated connection with a client is less than specified value, then specified number of connections is reached, notification about single terminated connections (the Connection terminated abnormally notification) will be sent not depending on the counting period. At this, the connection must not be terminated further by the longer connections, and the notification about multiple abnormally terminated connections must not be sent (the Large number of abnormally terminated connections detected notification).

300