Getting accumulated statistics in ICAP mode

In ICAP mode, Kaspersky Scan Engine collects information about its usage and creates statistics from this data.These statistics are stored on your hard disk. You can view the statistics to monitor trends in the data requested from your network. For example, you can see if users in you network are trying to download a lot of malicious files.

To view accumulated statistics:

1. Open the directory specified in the TempPath element of the configuration file.
2. Find the report.json file and open it.

Following is an example of the report.json file.

{ "statistics": { "total_requests": 3, "infected_requests": 3, "not_scanned_requests": 0, "error_requests": 0, "engine_errors": 1, "processed_data": 204, "infected_data": 0, "processed_urls": 1, "infected_urls": 1 } }

where statistics is an object containing the following accumulated statistics:

• total_requests—The total number of received requests in response modification (RESPMOD) mode and request modification (REQMOD) mode.
• infected_requests—The number of requests for which Kaspersky Scan Engine returned a DETECTED, PHISHING, or MACRO scan result.
• not_scanned_requests—The number of valid scan requests that were not processed.

  Possible reasons:

  • The object is too big or too small.
  • The object is an encrypted archive.
  • Kaspersky Scan Engine is configured to skip objects of the format that the object belongs to.
• error_requests—The number of incorrect ICAP requests that were received by Kaspersky Scan Engine.
• engine_errors—The number of requests for which Kaspersky Scan Engine returned a FAILED scan result.
• processed_data—The total amount of scanned data in bytes.

  This includes objects scanned in RESPMOD mode and objects in POST requests that were scanned in REQMOD mode.

• infected_data—The amount of scanned data, in bytes, for which Kaspersky Scan Engine returned a DETECTED, PHISHING, or MACRO scan result.

  This includes objects scanned in RESPMOD mode and objects in POST requests that were scanned in REQMOD mode.

• processed_urls—The total number of checked URLs.
• infected_urls—The number of URLs for which Kaspersky Scan Engine returned a DETECTED or PHISHING scan result.

Resetting statistics

You can reset accumulated statistics at any time.

To reset accumulated statistics:

1. Open the directory specified in the TempPath element of the configuration file.
2. Find the report.json file and delete it.

The kavicapd service will create a new report.json file with all statistics set to 0.

Page top