Skip to main content

Understanding Lenovo virus scanning

You can use integrated antivirus functionality on Lenovo storage systems to protect data from being compromised by viruses or other malicious code. Lenovo virus scanning, called Vscan, combines best-in-class third-party antivirus software with ONTAP features that give you the flexibility you need to control which files get scanned and when.

How virus scanning works​

Storage systems offload scanning operations to external servers hosting antivirus software from third-party vendors. The ONTAP Antivirus Connector, provided by Lenovo and installed on the external server, handles communication between the storage system and the antivirus software.

  • You can use on-access scanning to check for viruses when clients open, read, rename, or close files over CIFS. File operation is suspended until the external server reports the scan status of the file. If the file has already been scanned, ONTAP allows the file operation. Otherwise, it requests a scan from the server.

  • You can use on-demand scanning to check files for viruses immediately or on a schedule. You might want to run scans only in off-peak hours, for example. The external server updates the scan status of the checked files, so that file-access latency for those files (assuming they have not been modified) is typically reduced when they are next accessed over CIFS. You can use on-demand scanning for any path in the SVM namespace, even for volumes that are exported only through NFS.

You typically enable both scanning modes on an SVM. In either mode, the antivirus software takes remedial action on infected files based on your settings in the software.



  • Virus scanning workflow
    You must create a scanner pool and apply a scanner policy before you can enable scanning. You typically enable both on-access and on-demand scanning on an SVM.
  • Antivirus architecture
    The Lenovo antivirus architecture consists of a Vscan server and a set of ONTAP configurables.