Configuration Parameters

The component uses configuration parameters which can be found in the [LinuxSpider] section of the integrated configuration file of Dr.Web for UNIX File Servers.

Parameter

Description

LogLevel

{logging level}

Logging level of the component.

If the parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method of the component.

Default value: Auto

ExePath

{path to file}

Path to the executable file of the component.

Default value: <opt_dir>/bin/drweb-spider.

•For GNU/Linux: /opt/drweb.com/bin/drweb-spider

Start

{Boolean}

Launch/do not launch the component by the Dr.Web ConfigD configuration daemon.

When you specify the Yes value for this parameter, it the configuration daemon will start the component immediately; and when you specify the No value, the configuration daemon will terminate the component immediately.

Default value: Depends on the product in which Dr.Web component is supplied and operates.

Mode

{LKM | FANOTIFY | AUTO}

Operation mode for SpIDer Guard.

Allowed values:

•LKM—use the Dr.Web LKM module installed in the operating system kernel (LKM—Linux kernel module);

•FANOTIFY—use the fanotify monitoring interface;

•AUTO—select the mode automatically.

Changing of this parameter value should be done with the extreme caution as various GNU/Linux OS kernels support both operating modes in a different way. It is strongly recommended that you set this parameter value to AUTO, as in this case the best mode will be selected for integration with the file system manager on startup. At that, the component will attempt to enable FANOTIFY mode and, on failure—LKM. If none of the modes can be set, the component exits.

If necessary, you can build a Dr.Web LKM module from the source codes and install it, following the instructions in the Building kernel module for SpIDer Guard section.

Default value: AUTO

DebugAccess

{Boolean}

Write information on access attempts to files to the log on debug level. level (iwhen LogLevel = DEBUG)

Default value: No

ExcludedProc

{path to file}

Processes excluding from monitoring. The files created or modified by the processes from the list are not scanned.

Multiple processes can be specified as a comma-separated list. The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list of processes wget and curl.

1.Adding values to the configuration file.

•Two values in a line:

[LinuxSpider]
ExcludedProc = "/usr/bin/wget", "/usr/bin/curl"

•Two lines (a value per line):

[LinuxSpider]
ExcludedProc = /usr/bin/wget
ExcludedProc = /usr/bin/curl

2.Adding values via the command drweb-ctl cfset:

# drweb-ctl cfset LinuxSpider.ExcludedProc -a /usr/bin/wget
# drweb-ctl cfset LinuxSpider.ExcludedProc -a /usr/bin/curl

Default value: (not set)

ExcludedFilesystem

{file system name}

Exclude the specified file system from monitoring.

This option is available only in FANOTIFY mode.

Multiple file systems can be specified as a comma-separated list. The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add the cifs and the nfs file systems to the list.

1.Adding values to the configuration file.

•Two values in a line:

[LinuxSpider]
ExcludedFilesystem = "cifs", "nfs"

•Two lines (a value per line):

[LinuxSpider]
ExcludedFilesystem = cifs
ExcludedFilesystem = nfs

2.Adding values via the command drweb-ctl cfset:

# drweb-ctl cfset LinuxSpider.ExcludedFilesystem -a cifs
# drweb-ctl cfset LinuxSpider.ExcludedFilesystem -a nfs

Default value: cifs

BlockBeforeScan

{Off | Executables | All}

Block files until they are scanned by the monitor (in enhanced or “paranoid” monitoring mode)

Allowed values:

•Off—never block access to files even if they are not scanned;

•Executables—block access to executable files (PE, ELF files and scripts that contain a preamble #!) not scanned by the monitor;

•All—block access to any files not checked by the monitor.

Files are blocked the FANOTIFY mode.

Default value: Off

[*] ExcludedPath

{path to file or directory}

Exclude the object (a file or a directory) on the specified path from monitoring. File masks (which contain the characters '?' and '*' as well as symbol classes '[ ]', '[! ]', '[^ ]') are allowed.

Multiple objects can be specified as a comma-separated list. Each value should be put in quotation marks. The values in the list must be separated with commas (each value in the quotation marks). The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add to the list the files /etc/file1 and directory /usr/bin.

1.Adding of values to the configuration file.

•Two values in a line:

[LinuxSpider]
ExcludedPath = "/etc/file1", "/usr/bin"

•Two lines (a value per line):

[LinuxSpider]
ExcludedPath = /etc/file1
ExcludedPath = /usr/bin

2.Adding values via the command drweb-ctl cfset:

# drweb-ctl cfset LinuxSpider.ExcludedPath -a /etc/file1
# drweb-ctl cfset LinuxSpider.ExcludedPath -a /usr/bin

Note that symbolic links here have no effect as only the direct path to a file is analyzed when scanning.

Default value: /proc, /sys

[*] OnKnownVirus

{action}

Action to be applied by Dr.Web for UNIX File Servers to a known threat (virus, and so on) detected with signature analysis.

Acceptable values: Cure, Quarantine, Delete.

Default value: Cure

[*] OnIncurable

{action}

Action to be applied by Dr.Web for UNIX File Servers to an incurable threat.

Acceptable values: Quarantine, Delete.

Default value: Quarantine

[*] OnSuspicious

{action}

Action to be applied by Dr.Web for UNIX File Servers to an unknown threat (or suspicious objects) detected by using heuristic analysis.