Skip to main content

MultiAV Sandbox Pool

Problem​

During the investigation and testing of the MultiAV system, we identified the following issues that have a significant impact on system performance.

1. Low System Performance with One Instance per Antivirus​

All antivirus solutions, except Symantec, can scan multiple paths/directories concurrently.

We measured the performance of each antivirus when scanning a single path and multiple paths. The results showed that an antivirus instance performs better when it has fewer paths to scan.

For example, assume there are 5 paths that need to be scanned:

  • Scenario 1: One antivirus instance scans all 5 paths.
  • Scenario 2: Five antivirus instances scan the 5 paths, with each instance scanning one path.

Using the same system resources, Scenario 2 takes less time because the scanning workload is distributed across multiple antivirus instances.

2. Symantec Concurrent Scanning Limitation​

The Linux Symantec Antivirus process can scan only one path/directory at a time.

Therefore, a single Symantec instance cannot handle multiple scan requests concurrently, which can significantly reduce the overall performance of MultiAV.

Solution​

To address these issues, we decided to implement a sandbox pool structure.

A sandbox pool can contain multiple instances of the same antivirus. When a scan request is received, the pool selects an instance using the Round-Robin algorithm.

This allows multiple instances of the same antivirus to process scan requests concurrently.

Note: The previous design can be considered a special case of the new design where all antivirus instances are in a single pool.

Migration Guide​

If you want to migrate to the sandbox pool design, all sandbox types should be migrated to pools, not just one.

However, the system will continue to work correctly if sandbox pools are not used at all.

1. Create New Instances​

Create the required new antivirus instances.

Since the system_name of each instance is used in the MultiAV configuration, you can add a number to the system_name to make instances of each antivirus type easier to identify.

For example:

<av-name>0
<av-name>1
<av-name>2

2. Add Instances to sandbox-pool.conf​

Add the created instances to:

/opt/pvm/multiav/configs/sandbox/sandbox-pool.conf

The configuration has the following structure:

{
  "sandbox_pool_list": [
    {
      "enable": true,
      "name": "drweb",
      "sandbox_list": [
        {
          "name": "drweb-0",
          "system_name": "drweb0",
          "mount_path": "/flash",
          "command": "drweb-ctl",
          "args": [
            "scan",
            "--OnKnownVirus=DELETE",
            "--OnSuspicious=DELETE",
            "--OnAdware=DELETE",
            "--OnDialers=DELETE",
            "--OnJokes=DELETE",
            "--OnRiskware=DELETE",
            "--OnHacktools=DELETE"
          ]
        }
      ]
    }
  ]
}

Add a new object to the sandbox_list array for each instance you have created.

Notice: Make sure that the system_name values are correct.

3. Enable the Pools​

Enable the pools that you have configured.

4. Specify Sandbox Status in manager.conf​

A sandbox should either be disabled ("enable": false) or removed from the sandboxes list after it has been migrated to a pool.

The configuration path is:

/opt/pvm/multiav/configs/sandbox/manager.conf

Option 1: Disable the Sandbox​

{
  "debug": true,
  "path": "/run/pvm/multiav/flash",
  "concurrent_scan": 10,
  "sandboxes": [
    {
      "enable": false,
      "name": "clam",
      "system_name": "clam",
      "mount_path": "/flash",
      "command": "clamscan",
      "args": [
        "-r",
        "--remove"
      ]
    }
  ]
}

Option 2: Remove the Sandbox from the sandboxes List​

{
  "debug": true,
  "path": "/var/run/pvm/multiav/flash",
  "concurrent_scan": 10,
  "sandboxes": []
}

5. Restart the MultiAV Service​

Restart the pvm-multiav service:

systemctl restart pvm-multiav