Optimizing network directory scanning

To optimize the File Threat Protection task, you can exclude from scans any files being copied from network directories to the local directory. To do so, configure exclusion based on processes for the utility used for copying from network directories (for example, for the cp utility).

To configure exclusion of network directories from scans:

  1. Output the File Threat Protection task settings (File_Threat_Protection, ID:1) to a configuration file using the command:

    kesl-control --get-settings 1 --file <full path to configuration file> [--json]

  2. Open the configuration file and add the [ExcludedForProgram.item_ #] section with the following settings:
    • ProgramPath – path to the process to be excluded or to the directory with the processes to be excluded.
    • ApplyToDescendants is a parameter that indicates whether the scan should exclude child processes of the excluded process (possible values: Yes or No).
    • AreaDesc – a description of the process exclusion scope, which contains additional information about the exclusion scope.
    • UseExcludedForProgram enables exclusion of the specified scope during task operation (possible values: Yes or No).
    • Path – path to the files or directory with files modified by the process.
    • AreaMask.item_# – file name mask for files to be excluded from the scan scope. You can also specify the full path to the file.

      Example:

      [ExcludedForProgram.item_0000]

      ProgramPath=/usr/bin/cp

      ApplyToDescendants=No

      AreaDesc=

      UseExcludedForProgram=Yes

      Path=AllRemoteMounted

      AreaMask.item_0000=*
  3. Execute the command:

    kesl-control --set-settings 1 --file <full path to configuration file> [--json]

    Specify the --json key if you are importing settings from a configuration file in JSON format. If the key is not specified, the application will attempt to import settings from an INI file. If the import fails, an error is displayed.

The application does not scan the files in network directories, but the cp command itself (for the example given above) and local files are scanned.

Page top