Operating Principles

The component allows sending the data not represented by files of a local file system for scanning to Dr.Web Scanning Engine located on a local or remote host. This data is processed by the components which send data for scanning over a network connection (Dr.Web MailD, Dr.Web ClamD). Note that these components always use Dr.Web Network Checker for sending files for scanning to Dr.Web Scanning Engine, even if the latter is located on a local host. Thus, if Dr.Web Network Checker is unavailable, these components cannot work correctly.

In addition, Dr.Web Network Checker allows to connect Dr.Web for UNIX Mail Servers to a given set of hosts on the network that run Dr.Web for UNIX Mail Servers (or any other Dr.Web for UNIX solution 10.1 or later) in order to manage a distributed search for data not represented by files of the local file system. Thereby, this component allows to create and configure a scanning cluster, which is a set of network hosts that exchange data for scanning (each host must run its own instance of the Dr.Web Network Checker distributed scanning agent). On each network host comprised by the scanning cluster, Dr.Web Network Checker performs automatic distribution of tasks for scanning data, sending them over the network to all available hosts for which the connection is configured. At the same time, the host load balancing caused by data scanning is performed depending on the amount of resources available on remote hosts. The number of child scanning processes generated by Dr.Web Scanning Engine on a host comprised by the cluster indicates the amount of resources available for load. The lengths of the queues of the files for scanning on each host in use are also considered.

In this case, any network host comprised by the scanning cluster can act both as a scanning client that sends data for remote scanning and as a scanning server that receives data from the specified network hosts for scanning. If necessary, the distributed scanning agent can be configured so that the host acts only as a scanning server or only as a scanning client.

The data received over the network for scanning is stored on the local file system as temporary files and sent to Dr.Web Scanning Engine or, in case it is unavailable or heavily loaded, to another host of the scanning cluster.

The InternalOnly parameter, which you can find in the component settings, allows to manage the Dr.Web Network Checker operation mode. The parameter defines if the component is used for including Dr.Web for UNIX Mail Servers in the scanning cluster or only for internal purposes of the Dr.Web for UNIX Mail Servers components operating locally.

You can create your own component (external application) which will use Dr.Web Network Checker to scan files (including distributing scanning tasks among the hosts of the scanning cluster). For this, the Dr.Web Network Checker component provides a custom API based on the Google Protobuf technology. The description of the Dr.Web Network Checker API , as well as client application sample code that uses Dr.Web Network Checker, are supplied as part of the drweb-netcheck package.

An example of creating a scanning cluster can be found in the Creating the Scanning Cluster section.