You can control when your scanning engines update, how often, and the update source.
.gif) Note: |
|---|
|
If you are using the optional Microsoft Forefront Server Security Management Console to update the scan engines, you should use the Scanner Updates work pane to disable scheduled updates.
|
To schedule updates for scanning engines
-
In the SETTINGS section of the Shuttle Navigator, select Scanner Update. The Scanner Updates work pane appears. The top pane shows a list of all supported file scanners and the worm list.
-
Select a scan engine to be scheduled. The bottom pane contains the Primary and Secondary update paths and the update schedule for the selected engine. Additionally, there is information about that engine. (For more information, see Scanner Information.)
-
Set the primary update path by clicking Primary in the bottom pane and entering a value in the Network Update Path field. By default, FSE uses the primary update path to download updates. If the primary path fails for any reason, FSE uses the secondary update path, if any.
The default primary update path is http://forefrontdl.microsoft.com/server/scanengineupdate. You may change it to point to another HTTP update site, or if you would prefer to use UNC updating as the primary update path, enter the UNC path to another Exchange server. For more information about UNC updating, see Distributing updates.
To restore the default server path, right-click the Network Update Path field and select Default HTTP Path.
-
Set the secondary update path, if desired, by clicking Secondary in the bottom pane and entering a value in the Network Update Path field. If the primary path fails for any reason, FSE will use the secondary update path. It is left blank by default.
The secondary path may be set to use HTTP or UNC updating. Enter either a URL or a UNC path to another Exchange server. For more information about UNC updating, see Distributing updates.
-
Specify the Date to check for updates. If you choose a Frequency of Once, this date is the only time update checking will take place; otherwise, this date represents the first time update checking will take place. Click the left and right arrows on the calendar to change the month. Click a particular day to select it. (The current date is circled in red; a selected date turns blue.)
-
Set a time for the update to take place. Each of the subfields (hour, minute, seconds, and AM/PM) can be selected and set separately. You can enter a time or use the up and down buttons to change the current value of each subfield. FSE defaults to staggering the update time, leaving an interval of five minutes between engines. It is recommended that you stagger updates a minimum of 15 minutes apart.
| Note: |
|---|
|
Do not use the Windows scheduler to set or change scan engine updating times. Changes you make in the operating system are not reflected in FSE update scheduling. Use the Scanner Update Settings work pane only.
|
-
Specify how often the update will occur (the frequency). You can choose Once (update only once, on the specified date and time), Daily (update every day, at the same time), Weekly (update each week, on the same day and time), or Monthly (update each month, on the same date and time). It is recommended that you select Daily (the default), and then set a Repeat interval to update the engine at multiple times during the day.
-
Optionally indicate a repeat interval. Select Repeat, and then choose a time interval. (The minimum time is 15 minutes.) It is recommended that you check for updates at least every two hours. If a new update is not available at the scheduled time, the engine is not taken offline and no updating is done. The default is to repeat updating for each engine every hour.
-
Use the Enable and Disable buttons to control whether the update check will be performed for a selected engine. All engine updates are enabled by default. Even if you are not using a particular engine, you should schedule updates for it. That way, if you find you need to use that engine in the future, it will already be at the current update level.
Scheduling updates on multiple servers
When scheduling engine updates on multiple servers in your organization, it is recommended that you stagger the updates by at least five minutes, to prevent servers from timing out during the update process. When scheduling updates for multiple engines, it is also helpful to stagger the updates in five-minute intervals.
Update Now
To perform an immediate update of a selected scanner, click the Update Now button on the Scanner Updates work pane. If an update exists, Forefront Security for Exchange Server will download the scanner and will start using it after the download is complete. While the engine download is in progress, the Update Now button remains inoperable. This button is useful for quick checks for a new scanner between regularly scheduled updates.
Update on load
Forefront Security for Exchange Server can be configured to update its file scanners when FSCController starts up. To configure Forefront Security for Exchange Server to update at startup, select the Perform Updates at Startup option in the Scanner Updates section of the General Options work pane.
Schedule engine updating using the scheduler on the Scanner Updates work pane. The engines that are to be updated are scheduled in five-minute intervals to avoid possible conflicts. This can be observed by typing at a command prompt after the FSCController has been started. This feature was mainly added for clustered Exchange servers where the inactive node will not receive updates while it is offline.
Scanner information
This is the information that appears on the Scanner Updates work pane for a selected scanner:
-
Engine Version. The version, as reported by the third-party scan DLL.
-
Signature Version. The version of the scanner's virus definition files currently in use, as reported by the third-party scan DLL (not available with every scanner).
-
Update Version. The value located in the Manifest.cab file.
-
Last Checked. The date and time of the last check made for a new scan engine or definition files.
-
Last Updated. The date and time of the last update made to the scan engine or definition files.
Manifest.cab
The Manifest.cab files, maintained by Microsoft, store information for determining if a newer version of a scan engine is available for download. (Each engine has an associated Manifest.cab file in its Package folder.) During a scheduled update or when Update Now has been invoked, Forefront Security for Exchange Server searches the network update path for a new update. To minimize overhead, the Manifest.cab file is first downloaded and used to determine if an update is required. If an update is not required, no further processing takes place. If an update is required, the update is then downloaded and applied. When the update is finished, the new Manifest.cab file overlays the old one.
This is the directory structure of the scan engines on a server running Forefront Security for Exchange Server:
Forefront Directory\
Engines\
x86\
Engine Name\
Package\
manifest.cab
Version Directory\
manifest.cab
enginename_fullpkg.cab
other enginename files
-
Forefront Directory is the top-level directory where all of the FSE files are kept. This was created during the product's installation.
-
Engine Name is a directory with the name of an engine's vendor. There is an Engine Name directory for each engine.
-
The Package directory contains the most-recent Manifest.cab file.
-
The Version Directory name has the format yymmddvvvv (year, month, day, version, for example: 0602020001). On any particular day, there may be multiple version directories. Each contains the current Manifest.cab, the enginename_fullpkg.cab, and all other required files for the engine.