vsa 100 setup guide en-us

5/22/2018 Vsa 100 Setup Guide en-us

1/58

McAfee VirusScan Enterprise for usewith the SAP NetWeaver Platform 1.0Setup Guide


2/58

COPYRIGHT

Copyright 2008 McAfee, Inc. All Rights Reserved.

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any formor by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FLASHBOX, FOUNDSTONE, GROUPSHIELD, HERCULES, INTRUSHIELD, INTRUSION INTELLIGENCE,

LINUXSHIELD, MANAGED MAIL PROTECTION, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, MCAFEE.COM, NETSHIELD,PORTALSHIELD, PREVENTSYS, PROTECTION-IN-DEPTH STRATEGY, PROTECTIONPILOT, SECURE MESSAGING SERVICE, SECURITYALLIANCE,SITEADVISOR, THREATSCAN, TOTAL PROTECTION, VIREX, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc.and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All otherregistered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICHTYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTSTHAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,

A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOUDO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURNTHE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

License AttributionsRefer to the product Release Notes.

McAfee VirusScan Enterprise for use with the SAP NetWeaver Platform 1.0 Setup Guide2


3/58

ContentsIntroducing McAfee VirusScan Enterprise for use with the SAP

NetWeaver platform. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Using VirusScan Enterprise with SAP NetWeaver. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Where to find product information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Installing the SAP Virus Scan Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Pre-installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

How SAP and VirusScan work together. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Installing the RFC libraries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Installing the SAP Management Console. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Installing the SAP Gateway. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Installing the SAP Virus Scan Server instance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Configuring the ABAP System with Virus Scan Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Defining scanner groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Defining SAP Virus Scan Servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Application-Server-Starter or Self-Starter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Installing the SAP Virus Scan Server as a self-starter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Defining Virus Scan profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

SAP Virus Scan Server as an Application-Server-Starter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Supported parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Delivered SAP Virus Scan profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Delivered Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Implementing a BAdI for Virus Scanners. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Analyzing SAP Virus Scan Server problems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Testing the Virus Scan Server installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Configuring Java EE with SAP the Virus Scan Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Java EE virus scan provider to SAP NetWeaver. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Installing the product for a purely-Java configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Installing the SAP Virus Scan Server for a purely-Java configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Defining scanner groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Defining SAP virus scan providers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Defining SAP Virus Scan profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

3McAfee VirusScan Enterprise for use with the SAP NetWeaver Platform 1.0 Setup Guide


4/58

Delivered SAP Virus Scan profiles. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Delivered parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Analyzing SAP Virus Scan provider problems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Testing the installation of the SAP Virus Scan provider. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56


Contents


5/58

Introducing McAfee VirusScan Enterprise foruse with the SAP NetWeaver platform

VirusScan

Enterprise protects your SAP NetWeaver

platform from viruses, worms, Trojan

horses, and potentially unwanted code and programs.

This guide provides system requirements for the software, and information about installing

VirusScan

Enterprise as a virus scanning engine linked to your SAP NetWeaver

platform,

as well as modifying, repairing, removing, and reinstalling the software.

To install and manage the product with ePolicy Orchestrator, refer to the ePolicy Orchestrator

software version 4.0 documentation.

Contents

Using VirusScan Enterprise with SAP NetWeaver

Where to find product information

Using VirusScan Enterprise with SAP NetWeaverThis document describes the installation and configuration of the McAfee VirusScan Enterprise

for use with the SAP NetWeaver platform. This document is separated into chapters listed in

the following sections.

Installing the SAP Virus Scan Server

Tasks used to set up the SAP Virus Scan Server.

Configuring ABAP Systems with Virus Scan Interface

The configuration of the McAfee VirusScan Enterprise for use with the SAP NetWeaver platform.

Configuring Java EE with Virus Scan Interface

The configuration description for the Virus Scan Interface for Java used with the SAP NetWeaver.

Where to find product informationThe product documentation is designed to provide you with the information you need during

each phase of product implementation, from evaluating a new product to maintaining existing

ones. Depending on the product, additional documents might be available. After a product is

released additional information regarding the product is entered into the online Knowledgeable

available on VirusScan

Enterprise ServicePortal.



6/58

Maintenance PhaseSetup PhaseInstallation Phase

Maintaining the software.Getting up-and-running with theproduct.

Before, during, and after installation.

Release Notes Online Help Product Guideand Online Help

Known issues in the current

release.

Maintaining the software. Setting up and customizing the

software for your environment.

Reference information.

Issues resolved since the lastrelease.

All information found in the

product guide.Online Help

Managing and deploying products

through ePolicy Orchestrator. Knowledgebase

(https://knowledge.mcafee.com)

Last-minute changes to the

product or its documentation.

Setup Guide Detailed information about options

in the product. Release notes and documentation.

Preparing for, installing and

deploying software in a production

environment.

Supplemental product information.

Workarounds to known issues.

Finding release notes and documentation for McAfee

enterprise products

1 Go toknowledge.mcafee.comand selectProduct Documentation underUseful links.

2 Select| and select the required document fromthe list of documents.

Introducing McAfee VirusScan Enterprise for use with the SAP NetWeaver platformWhere to find product information

https://knowledge.mcafee.com/https://knowledge.mcafee.com/https://knowledge.mcafee.com/https://knowledge.mcafee.com/


7/58

Installing the SAP Virus Scan Server

This chapter describes the steps needed to install McAfee VirusScan Enterprise for use with the

SAP NetWeaver platform.

Contents

Pre-installation

How SAP and VirusScan work together

Installing the RFC libraries

Installing the SAP Management ConsoleInstalling the SAP Gateway

Installing the SAP Virus Scan Server instance

Pre-installationThis section provides an installation overview, steps to perform before you start the installation,

and lists of files needed for the installation.

Installation overview

Before installing the SAP Virus Scan Server, described in this document, confirm you havecompleted the following steps:

1 Installed the McAfee

VirusScan Enterprise 8.7i software see theMcAfee

VirusScan

Enterprise 8.7i, Installation Guide.

2 Installed the McAfee

VirusScan

Enterprise for use with the SAP NetWeaver

platform

software see the McAfee

VirusScan


platform 1.0, Product Guide.

After completing the previous steps, continue with the following installation steps described in

this document:

1 Check for existing SAP components on the target system. If any SAP components are

installed, note all installation directories, instance names (SID), and instance numbers to

avoid conflicts during installation.

2 Installing the SAP Gateway

3 Installing the SAP Virus Scan Server instance

4 Configure one of the following Virus Scan interfaces:

Configuring the ABAP System with Virus Scan Interface

Configuring Java EE with SAP the Virus Scan Interface



8/58

Locating required files

The files required for the installation are listed in the following tables.

If SAP NetWeaver is installed on the target system, you must be able to locate these files in

the file system before you begin the installation.

If NetWeaver is not installed on the target system, download the appropriate Advanced Business

Application Programming (ABAP) or Java 2 Platform Enterprise Edition (J2EE) kernel for yourtarget platform from SAP Service Marketplace, unpack the kernel package to an empty folder,

and locate the required files.

Table 1: Non-Unicode kernel

DescriptionFile name

Remote Function Call librarylibrfc32.dll

SAP Gateway executablegwrd.exe

R/3 Syslog / NT Eventlog Resource librarysapevents.dll

R/3 Service Starter executablesapstartsrv.exe

SAP Virus Scan Server executablevscan_rfc.exe

SAP iostream librarysapcpp46.dllSAP XML libraryxml63d.dll

Table 2: Unicode kernel

DescriptionFile name

Remote Function Call library (Unicode)librfc32u.dll

Helper DLL for librfc32u librarylibsapu16vc71.dll

IBM ICU Data libraryicudt30.dll

IBM ICU I18N libraryicuin30.dll

IBM ICU Common libraryicuuc30.dll

SAP Gateway executablegwrd.exe

R/3 Syslog / NT Eventlog Resource librarysapevents.dllR/3 Service Starter executablesapstartsrv.exe

SAP Virus Scan Server executablevscan_rfc.exe

SAP iostream librarysapcpp46.dll

SAP XML libraryxml63d.dll

Installing the SAP Virus Scan ServerPre-installation



9/58

How SAP and VirusScan work togetherThe following diagram provides an overview of how the SAP Virus Scan Server and McAfee

VirusScan Enterprise work together.

Figure 1: SAP Virus Scan and SAP server architecture

The following list describes the components shown in the previous figure:

McAfeeInternet connection for McAfee updates McAfee ePolicy Orchestrator and VirusScan databaseManages and store the McAfee DAT

files

Windows ServerRuns the applications

McAfee VirusScan Enterprise Scan EnginePerforms the actual file scanning for viruses.

McAfee

VirusScan


platformProvides

the interface between the McAfee VirusScan Engine and the SAP Virus Scan Server

instance

SAP Virus Scan Server InstanceProvides the interface between the McAfee

VirusScan


platform and the SAP Gateway instance

SAP Gateway InstanceProvides the RFC connection between the Windows server andthe SAP E-Recruiting server

SAP Front End ServerServer where input data and attachments are stored

ApplicationAccesses the data

Central InstanceProvides SAP services for the SAP Web application server (AS) Advanced

Business Application Programming (ABAP) or the SAP Web AS JAVA Add-in variant

DatabaseStores data

User web browserSends input files

Installing the SAP Virus Scan ServerHow SAP and VirusScan work together



10/58

Installing the RFC librariesUse this task to install the SAP RFC (Remote Function Call) libraries. These libraries must be

installed in %SystemRoot%\system32 (for example, C:\Windows\system32), and are required

for RFC communication.

Before you begin

Check whether the libraries are already installed on the target system. If so, you can skip this

task.

Task

1 Determine which Unicode kernel you are using and perform one of the following:

For Non-Unicode kernel, copy the librfc32.dll to %SystemRoot%\system32.

For Unicode kernel, copy the librfc32u.dll, libsapu16vc71.dll and the icu*.dll's to

%SystemRoot%\system32.

Installing the SAP Management ConsoleUse this task to install the SAP Management Console SAPMMC).

The SAP Management Console is required for managing the SAP services running on a system.

If the SAPMMC is already installed (for example, if SAP NetWeaver is installed on the target

system) you can skip this task.

Task

1 Download the appropriate package for your target platform. The SAPMMC installer package

is available for download on SAP Service Marketplace from:https://websmp110.sap-ag.de/.

Microsoft Installer package for 32-bit

Windows platforms

sapmmcX86u.msi

Microsoft Installer package for 64-bit

Windows (x64) platforms

sapmmcX64u.msi

2 Run the installer on the target system and follow the instructions.

Installing the SAP GatewayUse this task to install the SAP Gateway to provide CPI-C services. If an SAP Gateway is already

installed on the target system, you can skip this task.The SAP Gateway carries out Common Programming Interface - Communications (CPI-C) services

within the SAP world, which are based on TCP/IP. These services enable communication between

SAP Systems and external programs. CPI-C services can be used either in the ABAP program

or for the external programs via the interfaces. Because RFC (Remote Function Call) is based

on CPI-C, all RFC connections also pass through the SAP Gateway.

Before you begin

To set up an SAP Gateway, the following SAP components are required:

Installing the SAP Virus Scan ServerInstalling the RFC libraries

https://websmp110.sap-ag.de/https://websmp110.sap-ag.de/


11/58

SAP Gateway (gwrd.exe)

R/3 Syslog / NT Eventlog Resource DLL (sapevents.dll)

R/3 Service Starter (sapstartsrv.exe)

Task

1 Create a directory structure at the root of your system drive, as shown in the followingfigure, where SID(SAP ID) is the name of the instance, and xxis the number of the SAP

Gateway instance.

NOTE: If you use an existing instance name (SID), you must use a new instance number.

Figure 2: Directory structure for SAP gateway

2 Copy the required components, listed inBefore You Begin, to theexe subfolder of thedirectory structure.

3 Create a new text file in theprofilesubfolder and name it START_Gxx_HOSTNAME,

wherexxis the number of the SAP Gateway instance and HOSTNAMEis the NetBIOS name

of the target system in capital letters. For example, START_G20_VSCANSRV01

4 Open the profile with a text editor and enter the following, whereSIDis the name of the

instance,xxis the number of the SAP Gateway instance, and HOSTNAMEis the NetBIOS

name of the target system.

Installing the SAP Virus Scan ServerInstalling the SAP Gateway



12/58

Example:

5 Save the file.

6 Runregedit.exe, and navigate to HKEY_LOCAL_MACHINE | SYSTEM |

CurrentControlSet | Services | Eventlog | Application.

7 Add a new key with the nameSAPSID_xx, whereSIDis the instance name and xxis thenumber of the SAP Gateway instance.

Example:HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SAPVSI_20

8 Add the following values to the key, whereSIDis the name of the instance and xxis the

number of the SAP Gateway instance system.

EventMessageFile REG_SZ C:\usr\sap\SID\Gxx\exe\sapevents.dll

TypesSupported REG_DWORD 7

Example:




13/58

EventMessageFile REG_SZ C:\usr\sap\VSI\G20\exe\sapevents.dll


9 Open a command shell and type the following at the prompt, whereSIDis the name of

the instance andxxis the number of the SAP Gateway instance, and HOSTNAMEis the

NetBIOS name of the target system.

C:\usr\sap\SID\Gxx\exe\sapstartsrv.exe r q p

C:\usr\sap\SID\Gxx\profile\START_Gxx_HOSTNAME s SID n xx

Example:

C:\usr\sap\VSI\G20\exe\sapstartsrv.exe r q p

C:\usr\sap\VSI\G20\profile\START_G20_VSCANSRV01 s VSI n 20

10 To start the SAP Service Install and Uninstall interface, open a command shell and type

the following at the prompt:

C:\usr\sap\SID\Gxx\exe\sapstartsrv.exe

Figure 3: SAP service install interface

11 InSID, type the name of the instance, the number of the SAP Gateway. For example, VSI.

12 InNR, type the number of the SAP Gateway. For example, 20.

13 Browse to the profile in the following directory:C:\usr\sap\SID\Gxx\profile

14 After registering the gateway service, open the windows services control and start the

service.

NOTE:The service is typically named, for example, SAPSID_xx




14/58

15 Open the SAP Management Console.

Figure 4: SAPMMC files

16 Find your Instance (SID) listed under the SAP Systems containing your GatewayHostname

xx.

NOTE:The service is typically named for example,SAPSID_xx.

17 Highlight and start the instance.

18 Confirm the instance and gateway icons are green.

Installing the SAP Virus Scan Server instanceUse this task to set up the SAP Virus Scan Server to work with McAfee

VirusScan

Enterprise

for use with the SAP NetWeaver

platform.

Before you begin

The following SAP components are required:

SAP Virus Scan Server (vscan_rfc.exe)

AP iostream library (sapcpp46.dll)

SAP XML library (xml63d.dll)

R/3 Service Starter (sapstartsrv.exe)

Task

1 Create the directory structure, shown in the following figure, in the root of your system

drive, where SIDis the name of the instance and yyis the number of the SAP Virus Scan

Server instance.

NOTE: If you use an existing instance name (SID), you use a new instance number. If

you installed the SAP Gateway for this instance name, the instance number of the SAP

Virus Scan Server is the instance number of the SAP Gateway + 1.

Installing the SAP Virus Scan ServerInstalling the SAP Virus Scan Server instance



15/58

2 Copy the required components, listed in the Pre-installation section, to theexe subfolder

of the directory structure listed in the following figure.

Figure 5: Directory structure for SAP gateway

3 Create a new text file in theprofilesubfolder and name it START_Vyy_HOSTNAME,

whereyyis the number of the SAP Virus Scan Server instance and HOSTNAMEis the

NetBIOS name of the target machine in capital letters. For example:

START_V21_VSCANSRV01

4 Open the profile with a text editor and type the following content, whereSIDis the name

of the instance, yyis the number of the SAP Virus Scan Server instance, and HOSTNAME

is the NetBIOS name of the target system.

If you installed the SAP Gateway following the steps inInstalling the SAP Gateway

section, the GATEWAY_HOSTNAMEis HOSTNAMEand GATEWAY_SERVICEis sapgw

xx, wherexxis the number of the SAP Gateway instance.

To use an existing SAP Gateway, you must type the corresponding values for

GATEWAY_HOSTNAMEand GATEWAY_SERVICE.

ReplaceADAPTER_DLLwith the full path, shown in the following table, to the

corresponding adapter DLL. Look for the value of the VSA_LIB environment variable,

this will point to the correct DLL.

%ProgramFiles%\McAfee\VirusScan

Enterprise for use with SAP\McVsa32.dll

On 32-bit Windows platforms

%ProgramFiles%\McAfee\VirusScan

Enterprise for use with SAP\x64\McVsa64.dll

On 64-bit Windows platforms

Example:




16/58

5 Save the file.

6 Create a new text file namedvscan_rfc.xmlin the profilesubfolder.

7 Open the profile with a Unicode-capable text editor, select UTF-8 encoding and type the

following content:




17/58

8 Save the file.

9 Runregedit.exe, and navigate to HKEY_LOCAL_MACHINE | SYSTEM |

CurrentControlSet | Services | Eventlog | Application.

10 Add a new key with the name SAPSID_yy, whereSIDis the instance name and yyis the

number of the SAP Virus Scan server instance.Example:HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SAPVSI_21

11 Add the following values to the key, whereSIDis the name of the instance and yyis the

number of the SAP Virus Scan server instance.

EventMessageFile REG_SZ

C:\usr\sap\SID\Vyy\exe\vscan_rfc.exe


Example:




18/58

EventMessageFile REG_SZ

C:\usr\sap\VSI\V21\exe\vscan_rfc.exe


12 Add the following additional value, whereSIDis the name of the instance and xxis the

number of the SAP Gateway instance if you have installed the SAP Gateway and the SAP

Virus Scan Server under the same instance name (SID), a dependency between both

services is recommended.

DependOnService REG_MULTI_SZ SAPSID_xx

Example:

DependOnService REG_MULTI_SZ SAPVSI_20


the instance, yyis the number of the SAP Virus Scan Server instance and HOSTNAMEis

the NetBIOS name of the target system.

C:\usr\sap\SID\Vyy\exe\sapstartsrv.exe -r -q -p

C:\usr\sap\SID\Vyy\profile \START_Vyy_HOSTNAME-s SID-n yy

Example:

C:\usr\sap\VSI\V21\exe\sapstartsrv.exe -r -q

-p C:\usr\sap\VSI\V21\profile \START_V21_VSCANSRV01 -s VSI -n 21


the instance andxxis the number of the SAP Gateway instance, and HOSTNAMEis the

NetBIOS name of the target system.

C:\usr\sap\SID\Gyy\exe\sapstartsrv.exe r q

p C:\usr\sap\SID\Gyy\profile\START_Gyy_HOSTNAME s SID n yy

Example:

C:\usr\sap\VSI\G20\exe\sapstartsrv.exe r q

p C:\usr\sap\VSI\G20\profile\START_G20_VSCANSRV01 s VSI n 21

15 To start the SAP SerService Install and Unistall interface, open a command shell and type

the following at the prompt:




19/58

C:\usr\sap\SID\Gxx\exe\sapstartsrv.exe

Figure 6: SAP Service Install interface

16 InSID, type in the name of the instance. For example, VSI.

17 InNR, type the number of the SAP Gateway. For example, 21.

18 Browse to the profile in the following directory:

C:\usr\sap\SID\Gxx\profile

19 After registering the gateway service, open the windows services control and start the

service.

NOTE:The service is typically named the following:SAPSID_xx

20 Start the SAP Management Console.

Figure 7: SAPMMC files

21 Find your instance (SID) containing your GatewayHostname xx, listed under the SAP

Systems.

22 Highlight and start the instance.




20/58

23 Confirm the icon for the instance and the gateway are green.




21/58

Configuring the ABAP System with Virus ScanInterface

This chapter describes configuring the Advanced Business Application Programming (ABAP)

System with McAfee VirusScan Enterprise for use with the SAP NetWeaver platform.

Overview

Use the SAP Virus Scan Interface (SAP VSI API) to include the McAfee VirusScan Enterprise for

use with the SAP NetWeaver platform virus scanning in the SAP system to increase the system

security. This allows you to integration the McAfee VirusScan Enterprise for use with the SAPNetWeaver platform solution to scan files or documents that are processed by applications for

viruses. This applies both for applications delivered by SAP and for customer developments, for

example, during data transfers across networks or when documents are exchanged using the

SAP VSI API.

Contents

Defining scanner groups

Defining SAP Virus Scan Servers

Application-Server-Starter or Self-Starter

Installing the SAP Virus Scan Server as a self-starter

Defining Virus Scan profiles

SAP Virus Scan Server as an Application-Server-Starter

Supported parameters

Delivered SAP Virus Scan profiles

Delivered Parameters

Implementing a BAdI for Virus Scanners

Analyzing SAP Virus Scan Server problems

Testing the Virus Scan Server installation

Defining scanner groupsA scanner group combines multiple virus scanners of the same type to allow load balancing.

Since you select the Virus Scan Server using the scanner group when maintaining the virus

scan profile, you must assign each Virus Scan Server to a scanner group.

Maintain a scanner group for each product class of virus scanners that are connected to the

system using the Virus Scan Server. If you include your own virus scanners with the Business

Add-In (BAdI) VSCAN_INSTANCE, create a scanner group for each implementation of your own

scanner and identify these as BAdI implementations.



22/58

Initialization parameters are transferred to the Virus Scan Server when it is started, and are

required to be able to start the Virus Scan Server. If you use the Business Add-In, these

parameters for the method of creating the scan instance are transferred. The parameters

contain, for example, the path to the virus signatures.

Scan parameters are transferred for each scan process and control the behavior of the individual

request, such as yes/no for activating the scanning of macros.

For information about which configuration parameters are required or supported by the product

that you use, see the documentation for the product.

Use this task to set up the SAP virus scan interface to use the SAP Virus Scan Server, and

maintain data in the Implementation Guide (IMG) interface.

NOTE:You must configure scanner groups. SAP does not deliver any scanner groups.

Task

1 In the Start SAP NetWeaver transaction box type theSPRO transaction code.

2 ClickSAP Reference IMG.

3 Navigate to SAP NetWeaver | Application Server | System Administration | Virus

Scan Interface.

Figure 8: SAP Virus Scan Interface

4 Next toDefine Scanner Groups, click the Executeoption icon.

Figure 9: SAP NetWeaver Scanner Groups

Configuring the ABAP System with Virus Scan InterfaceDefining scanner groups



23/58

5 ClickNew Entries.

Figure 10: SAP NetWeaver Scanner Groups Detail

6 Specify the data for the scanner group from the following table.

NotesField

Freely definable name of the scanner group.Scanner Group

If this indicator is set, the program transfers the request for a virus scan

instance for this scanner group to the Business Add-In VSCAN_INSTANCE,

with which customers can include their own virus scanners.

If this option is not set, the program searches for a suitable Virus Scan Server

among the set of Virus Scan Servers maintained in Customizing that have

this scanner group.

Business Add-In

Type a description for the scanner group.Group Text

7 Save your entries.

Defining SAP Virus Scan ServersUse this task to define the SAP Virus Scan Server. The SAP Virus Scan Server is used as an

executable program that includes virus scanners from certified vendors, such as the McAfee

VirusScan Enterprise for use with the SAP NetWeaver platform, using an interface and providesscan services to the application servers of the system as a registered RFC server.

The application server controls tasks such as starting, stopping, and monitoring the Virus Scan

Server. You configure the required data to perform these processes in this task.

NOTE:Use this procedure to create an entry for each Virus Scan Server that you want to set

up. For performance reasons, we recommend that you set up at least one Virus Scan Server

on each application server.

Before you begin

Confirm you have completed the following:

Created at least one scanner group.

Decided whether you are creating the Virus Scan Server as an application-server-starter or

as a self-starter (see Application-Server-Starter or Self-Starter).

Task

1 In the Start SAP NetWeaver transaction box, type theSPROtransaction code.

2 ClickSAP Reference IMG and navigate to SAP NetWeaver | Application Server |

System Administration | Virus Scan Interface.

3 Click theExecuteicon next to Define Virus Scan Servers.

The screen View: Change "Virus Scan Servers": Overview appears.

Configuring the ABAP System with Virus Scan InterfaceDefining SAP Virus Scan Servers



24/58

4 ClickNew Entries.

Figure 11: SAP NetWeaver Virus Scan Server

5 In the Scan Server field, enter the name of the Virus Scan Server. The name must be the

same as the name of the RFC destination that contains the technical connection to the

Virus Scan Server.

6 Under Virus Scan Server Definition, enter the data for the Virus Scan Server using the

following table.

Table 3: Data for the Virus Scan Server Definition

CommentDefinitionOption

Lists the scanner group,

combines multiple Virus Scan

All previously created scanner groups, which

you can display using the input help.

Scanner Group

Servers, or allows the use of a

BAdI implementation.

Provides the monitoring

status of the Virus Scan

Server in the CCMS.

ACTS (Active as a self-starter): Although the

CCMS monitors the Virus Scan Server (if it is

not available, an error status is triggered), it

does not start or stop the Virus Scan Server.

Status

For statuses of NONE and

INAC, the systems automaticThis status is suitable for Virus Scan Servers

that are, for example, started as a service at

operating system level. server selection can no

longer find this Virus Scan

Server.ACTV: Active (Application Server) The CCMS

monitors the Virus Scan Server and, if

necessary, starts it on the specified

application server.




25/58


INAC (Inactive on an Application Server) The

CCMS monitors the Virus Scan Server and, if

necessary, stops it on the specified application

server.

NONE: No monitoring: The CCMS does not

monitor the Virus Scan Server.

Specifies the application server

on which the Virus Scan Server

is to start and/or monitor.

The input help provides a list of the existing

servers. Do not specify a different server name.

Server

Specifies the trace level for

the Virus Scan Server, which

Errors only

Errors and warnings

Trace Level

is to be transferred to theErrors, warnings, and information CCMS at operating system

level when the Virus Scan

Server is started.Maximum output

We recommend that you only

use one of the first two levels

Errors Only or Errors and

Warnings in productionsystems. The two other trace

levels are available for finding

errors during test operation

in the test system.

Codepage that the CCMS sets

when the Virus Scan Server

is started.

Type the codepage valid for the Virus Scan

Server. It must correspond to the codepage of

the application server that is communicating

with the Virus Scan Server:

If you are only using one codepage in your

application servers, type this codepage.

Codepage

If you have application servers in different

codepages, set up a Virus Scan Server on

each application server and specify the valid

codepage in each case.

If your system uses UNICODE, do not type

anything.

Specifies the number of hours

after which the Virus Scan

Server is regularly reinitialized.

0 or : no automatic re-initialization

If the vendor of your virus scanner uses the

interface provided by SAP, you can leave the

Init.Interv.

field empty. This interface is available to

certified vendors of virus scanners.

: Interval in hours

Specifies the maximum

number of scan instances

Max. Instances

provided by the Virus ScanServer.

A Virus Scan Server might

provide multiple scan

instances.

You can use the maximum

number specified here to

determine how many of these

instances are provided. If this

number is exceeded, the

virus scanner is no longer

available for scan requests.




26/58


The number of instances

should correspond to the

number of work processes.

Specifies the full path of the

McAfee VirusScan Enterprise

Full path of the library that contains the McAfee

VirusScan Enterprise for use with the SAP

NetWeaver platform.

Adapter Path

for use with the SAP

NetWeaver platform.

If you do not fill the field, the

Virus Scan Server uses the

content of the environment

variable VSA_LIB.

Specifies the full path to the

configuration file of the Virus

Scan Server.

The configuration file can

contain optional parameters

of the Virus Scan Server.

Full path to the configuration file of the Virus

Scan Server.

Configuration

For externally started Virus

Scan Servers, the

configuration file has already

been defined at the Virus

Scan Server command line,

so you cannot change it here.




27/58

7 Save your entries. A resulting configuration should look like the following figure:

Figure 12: SAP NetWeaver Virus Scan Server details

Application-Server-Starter or Self-StarterWhen configuring a Virus Scan Server for Advanced Business Application Programming (ABAP)

systems, instead of an application-server-starter (started by the application server) you can

install a self-starter (for example, started externally as a service under Microsoft Windows NT

Configuring the ABAP System with Virus Scan InterfaceApplication-Server-Starter or Self-Starter



28/58

or a daemon under UNIX). In the case of application-server-starters, all components are on the

same host. On the other hand, in the case of self-starters, the Virus Scan Server and the SAP

Web Application Sever (AS) can be on different hosts. This means that you can use an SAP

Virus Scan Server that is only available for a particular platform, even if the SAP Web AS is

installed on a different platform.

NOTE:Much of the information in this section was taken from the SAP Libraryfound at the

following URL:

http://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htm

Figure 13: Application-Server-Starter and Self-Starter

During operation, this division into application-server-starters and self-starters primarily affects

the Computing Center Management System (CCMS). You can monitor the virus scanners in the

CCMS (transaction RZ20), in the monitor Virus Scan Servers in the monitor set the SAP CCMS

Monitors for Optional Components using the SAP web-site information found at

http://help.sap.com/saphelp_nw04/helpdata/en/3a/2b813b310c4a0ee10000000a114084/frameset.htm .

The following differences exist in this case

Application-Server-Starters

The CCMS data collector automatically checks whether a configured SAP Virus Scan Server is

available. If not, the CCMS triggers an alert and starts the SAP Virus Scan Server again as an

auto-reaction.

Self-Starters

Although the processes are monitored by CCMS, they are not automatically stopped or started.

There is, however, a separate monitoring tree element (MTE) class in CCMS for these

self-starters. You can assign an auto-reaction method to this MTE class yourself to react to

alerts. You can, for example, use the MTE class CCMS_OnAlert_Email to send an email or anSMS (seeDefining Automatic Alert Notification and Forwarding Alerts to Alert Management

[ALM]).

NOTE:Ensure that you secure your RFC connections with Secure Network Communications

(SNC) as described in the SNC manual. You can find the SNC manual on the SAP Service

Marketplace under service.sap.com/security | Security in Detail | Secure System

Management.

Configuring the ABAP System with Virus Scan InterfaceApplication-Server-Starter or Self-Starter

http://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/3a/2b813b310c4a0ee10000000a114084/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/3a/2b813b310c4a0ee10000000a114084/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htm


29/58

Installing the SAP Virus Scan Server as a self-starterUse this task to configure the SAP Virus Scan as a self-starter as an alternative, if you cannot

use the application-server-starter, for example in the following cases:

The SAP Web AS kernel uses 64 bits and the external anti-virus product or the external

McAfee VirusScan Enterprise for use with the SAP NetWeaver platform, (sometimes calledthe Virus Scan Adapter [VSA]) use 32 bits.

The SAP Web AS and the external anti-virus product support different architectures. For

example, the SAP Web AS is installed on an AIX platform, but the anti-virus product is only

available for Microsoft Windows.


following URL:


Before you begin

The self-starter starts the virus scan engine using a local XML configuration file. This is usually

the file vscan_rfc.xml, which contains the parameters required by the McAfee VirusScan Enterprisefor use with the SAP NetWeaver platform. The server must be started, or, if necessary, restarted

using operating system resources.

NOTE:The detailed information in this section is not required for all installations. The section

Installing the SAP Virus Scan Server instanceprovides adequate installation information for

most applications.

Task

1 Copy the relevant variant of the virus scan server from the CD or the SAP Service

Marketplace to a start directory. The section Pre-installationdescribes initially copying these

files to your target system.

2 Create the configuration file using the commands listed in the following tables.

NOTE:The Installing the SAP Gatewaysection describes the directory structure used to

save the files created in this section.

Table 4: Configuration Commands for the Self-Starter

NotesPlatformCommand

Calls the online help for the commands and options.Allhelp

Shows the internal version information of the virus scan server.

You must use at least internal version 1.5 (see SAP Note 782963).

Allversion

Receives the CSA and separate server configuration and stores

them in a local XML configuration. (Option cfg is mandatory

Allget_config

for this). The options received using the command line are stored

as the server configuration. If you do not specify any command-line

options, the predefined values are set.

Use this command to start the setup of a self-starter. If the file

specified using the option -cfg does not exist, a new file is

created.

Installs a new VSCAN_xx service in the Microsoft Windows NT

Service Control Manager (SCM).

The cfg option with a specification of a local configuration is

mandatory for this command. The service is installed if the McAfee

Windows NTinstall

VirusScan Enterprise for use with the SAP NetWeaver platform

Configuring the ABAP System with Virus Scan InterfaceInstalling the SAP Virus Scan Server as a self-starter

http://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htm


30/58

NotesPlatformCommand

is successfully initialized. If you specify additional options, these

are only stored in the XML file used. The srvc option specifies

the number of the service; that is, you can install up to 100

services on a host. The default value for srvc is 00.

Deletes an existing VSCAN_xx service in the Microsoft Windows

NT Service Control Manager (SCM).

You can specify the service more exactly using the srvc option.

Example: vscan_rfc remove srvc 1 deletes the existing service

VSCAN_01.

Windows NTremove

Starts an installed VSCAN_xx service. This command starts the

service with the specified options.

The Microsoft Windows NT command net start VSCAN_xx startsthe previously installed service only if the local configuration is

used.

Windows NTstart

Stops a running VSCAN_xx service. This command corresponds to

the Microsoft Windows NT command net stop Windows NTstop

In addition to the commands, you can specify the following options.

Table 5: Options for Self-Starters

NotesPlatformOption

Program ID of the RFC destination, such as VSCAN_LOCAL.All-a

Host name of the SAP gateway.All-g

Service name of the SAP gateway, such as sapgw00.All-x

Complete path specification of the XML configuration fileAll-cfg

Path specification of the trace file to be used.All-f

Trace level of the trace file:All-I

0 := ErrorsAll-c

1 := Errors and warnings (such as virus infections)

2 := Errors, warnings, and virus scan engine calls

3 := Additional information, all RFC calls, and memory operations

Path specification of the McAfee VirusScan Enterprise for use with

the SAP NetWeaver platform to be used. If you do not set this

option, the environment variable VSA_LIB is used.

All-V

Profile name (Default: VSA_CONFIG) for the current McAfee

VirusScan Enterprise for use with the SAP NetWeaver platform

All-p

configuration. This option allows differentiation if you are using

multiple (different) VSA configurations in one XML file.

Configures the maximum number of threads that the server can

use. Possible values: 1 to 999.

All-T

Configures the minimum number of threads that the server shoulduse.

All-m

Configures the minimum number of threads that the server should

use.

NOTE:The mean value of m and T is always used for the number

of threads that are held open.

All-L

The SNC name of this instance.

NOTE:Setting L, S, or Q activates SNC for the server.

All-S




31/58

NotesPlatformOption

SNC security level Possible values:

1:=Authentication

All-Q

2:=Integrity protection

3:=Encryption

7:=Minimum level8:=DEFAULT

9:=Maximum level

The SNC name of the SAP instance.

NOTE:If you set this name, only requests from SAP instances

with this SNC identity are accepted.

All-P

Timeout in seconds for the internal instances operations RELOAD

and SHUTDOWN.

All-I

Maximum number of trace lines for the memory trace. Default

value: 10000

All-n

Retention period in seconds for the memory trace: Default value:

86400 seconds.

All-h

Service number of the Microsoft Windows NT commands install

| remove | start | stop.

NT-srvc

Starts the virus scan server as a daemon process with fork().UNIX-daemon

Examples:

In the following example, the call generates both the server and the McAfee VirusScan

Enterprise for use with the SAP NetWeaver platform configuration for

McVsa32.dll:vscan_rfc get_config V %ProgramFiles%\McAfee\VirusScan Enterprise for use

with SAP\McVsa32.dll cfg \vsa\vscan_rfc.xml

To set new parameters to overwrite existing parameters, execute additional commands

and options in a new call. These are then set in the XML configuration. In this example,

you can change the call as follows:vscan_rfc get_config V %ProgramFiles%\McAfee\VirusScanEnterprise for use with SAP\McVsa32.dll cfg \vsa\vscan_rfc.xml

vscan_rfc get_config V %ProgramFiles%\McAfee\VirusScan Enterprise for use with

SAP\McVsa32.dll cfg \vsa\vscan_rfc.xml

a VSCAN_LOCAL g

x c

Operating the self-starter

You can operate the self-starter as a service under Microsoft Windows NT or as a daemon

under UNIX.

Operation as a serviceYou can use the Microsoft Windows Service Control Manager (SCM) to install the virus scan

server as a service. You can install up to 100 services of this type (numbered from 00 to

99).

Operating the virus scan server as a service means that operating system resources such

as the Event Log are available to your for monitoring. You can also use the SCM to restart

the virus scan server service after a termination. You can also use the Microsoft Management

Console (MMC) to remotely monitor and control the installed service.

3 To install the first service, type the following:vscan_rfc install -cfg \vsa\vscan_rfc.xml




32/58

4 To install additional services (VSCAN_), type the following: vscan_rfc install -cfg

\vsa\vscan_rfc.xml -srvc 1

NOTE:You must specify the local configuration file (option -cfg). The service is only installed

after successful initialization of the McAfee VirusScan Enterprise for use with the SAP

NetWeaver platform and checking of the SAP gateway.

Operation as a Daemon

You can start the virus scan server as a daemon directly at the operation system start.

5 To start the operation from a daemon, type the following:vscan_rfc -cfg /vsa/vscan_rfc.xml

daemon

NOTE:You can monitor the daemon with operating system resources (CRONTAB, INITTAB).

6 Configure the self-starter using the following options:

Call get_config again and use additional Commands and Options.

Edit the XML configuration file directly.

Synchronize the settings using the IMG activity Define Virus Scan Servers (transaction

VSCAN).With this configuration option, the parameters for trace level (option -I), codepage (option

-c), max. threads or max. instances (option -T), and VSA_LIB (option -V) are saved to the

specified configuration using the Local button. If you leave the Configuration field empty

for a self-starter, the values are saved to the XML configuration in use.

NOTE:The values are only saved if an XML file already exists.

Defining Virus Scan profilesUse this task to configure virus scan profiles to check data for viruses. A virus scan profile

contains a list of scanner groups that check a document. You can also use a virus scan profile

to assign configuration parameters for the virus scanner. If you scan for viruses with this virus

scan profile, the virus scanner receives the parameters.


following URL:


A virus scan profile specifies steps that are to be run during a virus scan. A step is either a virus

scanner, which is found using the scanner group, or a step specifies, a virus scan profile, which

is then performed as part of the enclosing virus scan profile.

A virus scan is performed under the name of a virus scan profile. The system administrator can

use the profile to activate or deactivate the virus scan for each component.By default, each SAP application that integrates a virus scan provides a virus scan profile. The

names of these virus scan profiles are constructed as follows //. Check the virus scan profiles delivered by SAP (for

example, using Delivered Virus Scan Profiles), and determine which components you want to

use to activate or deactivate the virus scan.

NOTE:To create your own virus scan profiles, you can use the namespaces Y* and Z*.

Configuring the ABAP System with Virus Scan InterfaceDefining Virus Scan profiles



33/58

Before you begin

You must have created scanner groups.

Task


2 ClickSAP Reference IMG and navigate to SAP NetWeaver | Application Server |System Administration | Virus Scan Interface.

3 Click theExecuteicon next to Define Virus Scan Profiles.

The screen View: Change "Virus Scan Servers": Overview appears.

4 ClickExecuteoption next to Define Virus Scan Profiles.

5 ClickNew Entriesand the following window appears.

Figure 14: SAP NetWeaver Virus Scan Profiles New Entries

6 Type the data for the scanner profile using the information in the following table.Table 6: Data for the Virus Scan Profile Definition

NotesPossible valuesScreen Field

Specifies the name of a virus scan profile.Scan Profile

Explanatory text for a virus scan profile.Profile Text

Specifies that this virus scan profile is active.

The virus scan profile can only be used if

this indicator is set.

Active

SAP applications can used fixed profile

names that are delivered. By default, these

profiles are not active, meaning that the

application program works without a virus

scan.

You can activate the virus scan for each

application by setting this indicator.




34/58


Indicates this virus scan profile is the default profile.

You can set this indicator for a maximum of

one virus scan profile. This virus scan profile

is used in the following cases:

Default Profile

If an application requests a virus scanner without

specifying a virus scan profile.

If a virus scan profile is requested for which the

Use Reference Profile indicator is set, and the

Reference Profile is empty.

Used to operate multiple applications using the same

virus scan profile, set the Use Reference indicator and

specify the reference profile.

Use Reference

Specifies the name of the reference profile.

Since a virus scan profile can use another

virus scan profile as a reference profile, you

The input help

provides a list of all

profiles already

defined.

Use Reference Profile

can operate multiple applications using thesame virus scan profile.If you leave the field

empty, the system If the Use Reference Profile indicator is set

in the virus scan profile, this field specifiesuses the default

profile. the name of the reference profile to be used.

Instead of the settings of the current virus

scan profile, the settings of the reference

profile are then used. This means that

several virus scan profiles can use the

settings of a shared reference profile, such

as the scanner groups to be used.

Specifies the type of logical linkage for the steps in the

virus scan profile.

If multiple steps that are to be performed

during the virus scan with a virus scan profile

All steps successful:

The virus scan must

have performed all

steps without errors.

Relationship

are defined for a profile, you can use thisAt least one step

successful:field to control how the overall result of the

virus scan is to be evaluated.

It is sufficient if one

step of the virus scanUsing multiple steps allows you to scan

documents with scan engines from different

vendors at the same time.was successfully

performed.The program interprets a virus scan as

error-free only if the scan engine returns the

return value Check performed successfully

or (in the case of cleanups) Cleanup

performed successfully.

All other return values are regarded as

unsuccessful virus scans. This also includes

situations such as:

The program did not check the document because

the file name extension is categorized as

non-critical.




35/58


The program could not check the document,

because the document is a password-protected

archive.

The scan engine is obsolete.

7 Click theSaveicon to save your entries.

8 From the display of Virus Scan Profiles, select the McAfee profile you created.

Figure 15: Virus Scan Profiles

9 Double-click theStepsnode in the Dialog Structure to define steps for the profile.

Figure 16: SAP NetWeaver Virus Scan Profiles Steps

10 Using the following table, type the data for the definition of the step:

Table 7: Data for the Definition of a Step of the Virus Scan Profile

NotesPossible ValuesScreen Field

Specifies the position of the scanner group

in the virus scan profile.

integer valuePosition

Specifies whether a step in the virus scan

profile refers to a scanner group or another

virus scan profile.

If you choose Group, the system

uses a Virus Scan Server from this

Group or ProfileType

group (or a BAdI implementation)

for the virus scan. If you choose

Profile, the program processes the




36/58


specified virus scan profile instead

of this step.

You can define any conditions by

combining the steps of the virus

scan profile with the linkage typeof the steps (AND/OR).

Combines multiple Virus Scan Servers or

allows the use of a BAdI implementation.

All of the Virus Scan Servers of a

scanner group have the same set

The input help provides a list of

all existing scanner groups.

Scanner Group

of configuration parameters and

will therefore use the same scan

engine.

Specifies the name of a virus scan profile

that you can include as a step in the profile

that you are currently processing.

The input help provides a list of

all existing profiles.

Virus Scan Profile

11 Click the Saveicon to save your entries.

12 Double-click theConfiguration Parameters node to create configuration parameters for

a step.

Figure 17: SAP NetWeaver Virus Scan Profiles Configuration Parameters

13 Type the following data for the definition of the configuration parameters:

Table 8: Data for the Definition of Configuration Parameters


Specifies the key of a configuration

parameter.

The input help provides a list of all

existing constants.

Parameters

A virus scanner requires configurationdata. The set of possible configuration

parameters is defined by SAP as a

predetermined set of symbolic

constants.

Specifies the value specified by the vendor for a

configuration parameter.

ValueValue





37/58

You have defined a virus scan profile and therefore performed the last configuration step for

the Virus Scan Server. You can, finally, check the configuration.

SAP Virus Scan Server as anApplication-Server-Starter

With this use of the Virus Scan Server, all required components are in the working directory of

the SAP Web application server (AS) kernel on one host. The Virus Scan Server is included in

the standard system. This means that you only have to ensure that the prerequisites for the

operation of the application-server-starter are fulfilled.

Prerequisites

You have installed the external anti-virus product and the associated McAfee VirusScan

Enterprise for use with the SAP NetWeaver platform using the instructions provided by the

vendor.

The kernel directory contains the following components:

vscan_rfc.exe (Microsoft Windows NT) or vscan_rfc (UNIX)

The current RFC library or LIBRFC (see SAP Note 413708)

sapcpp45.dll (Microsoft Windows NT) or sapcpp45. (UNIX)

xml63d.dll (Microsoft Windows NT) or xml63d (UNIX)

Supported parametersUse this page to find the parameters supported by McAfee

VirusScan

Enterprise for use with

the SAP NetWeaver platform:

Option definitions

NotesPossible ValuesParameter

The scan will be performed on the best effort basis. All of

the following parameters are activated

0 or 1SCANBESTEFFORT

Scans for all files regardless of their file extension.0 or 1SCANALLFILES

Scans for all macros regardless of the file type of the object.0 or 1SCANALLMACROS

Scans for all embedded objects, for example in UUENCODE

and MIME encoded objects.

0 or 1SCANALLEMBEDDED

List of the file extensions for which the adapter should scanadditionally. The wildcard ? can also be used here in order

to search for patterns.

SCANEXTENSIONS

Syntax:

exe;com;do?;ht?;?at;e??;

Activates heuristic search, 0 means deactivated.SCANHEURISTICLEVEL

1. Program heuristics

2. Macro heuristics

3. Program and macro heuristics

4. Potentially unwanted programs

Configuring the ABAP System with Virus Scan InterfaceSAP Virus Scan Server as an Application-Server-Starter



38/58

NotesPossible ValuesParameter

5. Program and Potentially unwanted programs

6. Macro and potentially Unwanted programs

Restricts scan/repair of an object to single detection. The

scan/repair will be stopped if a virus has been detected.

0 or 1SCANLIMIT

Archives or compressed objects are to be unpacked.0 or 1SCANEXTRACTAn infected object will be renamed. (See VirusScan Enterprise

Product Guide for further details).

0 or 1CLEANRENAME

An infected object will be deleted.0 or 1CLEANDELETE

Delivered SAP Virus Scan profilesAs of SAP NetWeaver 04, SAP delivers the following SAP Virus Scan profiles for ABAP with

Support Package 11 (see SAP Note 797108):

/SCET/GUI_UPLOAD

The following profile is used by the front end upload module GUI_UPLOAD, which is also used

by the class method:

CL_GUI_FRONTEND_SERVICES => GUI_UPLOAD

For example: upload of a local file using SAP GUI in the SAP application

/SIHTTP/HTTP_UPLOAD

This profile is used by the Business Server Page (BSP) framework, that is, by all SAP applications

that are based on the BSP framework.

For example: Upload of a local file using BSP class CL_HTMLB_MANAGER.

The profiles are deactivated when delivered. To activate them, first create at least one basisprofile that you save as the default profile. You can then activate one of the delivered profiles.

By default, it links to a reference profile, which is the default profile.

Delivered ParametersThere are INIT, SCAN, CLEAN, and CUST parameters, of which INIT, SCAN, and CLEAN

parameters are passed to the external product. For more information about which parameters

exist and their effect, see the documentation for the external product. The default values of

the parameter configuration show all parameters. An external product usually supports only a

subset of the parameters.It is mandatory that the parameter SCANBESTEFFORT exists for every certified virus scan

product. If you set this parameter to 1, the most stringent security settings of the external

product are selected. For more information about which settings these are and how they affect

the performance of the product, see the documentation of the external product.

CUST parameters are used by the virus scan profiles delivered by SAP and are not forwarded

as an external product. The following parameters exist:

Configuring the ABAP System with Virus Scan InterfaceDelivered SAP Virus Scan profiles



39/58

CUST_NOT_SCANNED_AS_WARNING

Parameter that defines whether processing of the file to be checked is terminated if the return

code

CON_SCANRC_NOT_SCANNED

This value is returned (default value). If the value of the parameter is 1, processing is continued.This return code is output, for example, if the file type is unknown, or the file to be checked is

an encrypted archive file.

Parameters relate to each profile that contains a definition.

Implementing a BAdI for Virus ScannersUse this task to configure and use the Business Add-In VSCAN_INSTANCE to include your own

virus scanners in the Virus Scan interface.


following URL:


To integrate the BAdI implementation, use the BAdI Implementation indicator when creating

the scanner group. If you then perform a virus scan with this scanner group, the program calls

your implementation of the BAdI as a filter value for the group name and you can transfer an

instance of your scanner implementation.

Create an implementation for each scanner group that is to use the BAdI implementation. You

can use an implementation for multiple filter values (group names).

SAP does not deliver a default implementation. Instead, with the Virus Scan Server, there is a

separate component available that integrates the scan engines of certified vendors into the

virus scan interface.

Before you begin

You must have created a scanner group to address your implementation.

Task


2 ClickSAP Reference IMG and navigate to SAP NetWeaver | Application Server |

System Administration | Virus Scan Interface.

Configuring the ABAP System with Virus Scan InterfaceImplementing a BAdI for Virus Scanners



40/58

3 Click theExecuteicon next to Implement BAdl for Virus Scanners.

Figure 18: Business Add-In Builder

4 Type a name in theImplementation Name field or select an entry from the drop-down

list that appears if you click the icon at the right-side of the field.

NOTE:Select the Addin implementation from the drop-down list needed for your business

application.

Figure 19: Restrictions: Addin implementation


You have now created an implementation for the scanner group. For the rest of the procedure,

see the documentation for the interface IF_EX_VSCAN_INSTANCE.

Configuring the ABAP System with Virus Scan InterfaceImplementing a BAdI for Virus Scanners



41/58

Analyzing SAP Virus Scan Server problemsUse this task to configure the Virus Scan Server outputs errors, warnings, or additional

information to a file or have it write them to the servers memory. You can use the VSCANTRACE

analysis tool to query and output this memory content to analyze all registered Virus Scan

Servers for errors during their production operation.

When the server is started, the trace is deactivated for memory output. Activate it only if

problems occur, since it affects the performance of the server. The settings for memory output

are only valid for a particular length of time (the default value is 24 hours). They are then

deactivated.

Before you begin

For you to be able to use the memory trace, at least one Virus Scan Server must be active.

Task

1 Start transaction VSCANTRACE.

2 Choose the server either using the input help that displays all defined Virus Scan Serversfrom table VSCAN_SERVER, or specify the server directly. To do this, the server must have

been started at the SAP gateway using an RFC destination defined in transaction SM59.

3 Confirm your entry with ENTER.

The connection to the Virus Scan Server is created. If the connection to the server is made,

the traffic light is green.

4 ClickMemory.

NOTE:If you do not select Memory the trace is sent to a file, which you can display using

the developer traces (transaction ST11, file name dev_VSCAN_.trc).

The current trace level is displayed.

5 To set a new value for the trace level, select the desired trace components, then click

Activate.

NOTE:ClickDeactivate to completely deactivate the memory trace, but not the error

output to the trace file. You can therefore not suppress the output of errors by setting the

trace level for the file to the value 0.

If you change the selection from Memory to File or vice-versa, you can clickCopydisplay

the trace level already selected for this option for the individual components. The selection

option is activated for each active component when you do this.

6 To display the memory trace, clickExecute.

The overview appears. It shows the availability of the anti-virus engine used, the utilization

of the Virus Scan Server, the current trace level for the memory and an HTML output of

the current trace information.You have the following options in the overview:

Refresh:Refreshes the list.

Delete:Deletes the trace output.

Export:Exports the list to a local file.

Status:Displays the current status of the Virus Scan Server used, even if the memory

trace is deactivated. In addition to technical information about the Virus Scan Server,

this output also contains the configuration of the Virus Scan Server and information

Configuring the ABAP System with Virus Scan InterfaceAnalyzing SAP Virus Scan Server problems



42/58

about the loaded McAfee VirusScan Enterprise for use with the SAP NetWeaver platform

including the anti-virus engine.

Stop:Stops the Virus Scan Server.

Configuration:Branches to the display mode of the IMG activity Define Virus Scan

Servers.

Test:Branches to the transaction VSCANTEST.

Testing the Virus Scan Server installationUse this task to check that your configured Virus Scan Server is functioning correctly.

Task

1 In the SAP NetWeaver transaction box, type theVSCANTESTtransaction code.

2 Specify the object to be checked, using either the test data provided or your own local file.

3 Select theVirus Scan Profile,Scanner Group, or theVirus Scan Serverto be tested.

Figure 20: SAP NetWeaver transaction VSCANTEST

4 From theActiondrop-down list, select one of the following actions:

Check Onlycauses the anti-virus product that you specified scans the data for viruses

and displays a result.

Configuring the ABAP System with Virus Scan InterfaceTesting the Virus Scan Server installation



43/58

Check and Cleancauses the product to also attempts to clean the data if a virus

infection is diagnosed.

Figure 21: SAP NetWeaver VSCANTEST Result

Configuring the ABAP System with Virus Scan InterfaceTesting the Virus Scan Server installation



44/58

Configuring Java EE with SAP the Virus ScanInterface

The chapter contains the configuration description for the SAP Virus Scan Interface for Java

used with SAP NetWeaver.

The virus scan provider is the service of the J2EE Engine that makes the tc/sec/vsi/ interface

available to the SAP applications of the Engine.


following URL:


Contents

Java EE virus scan provider to SAP NetWeaver

Installing the product for a purely-Java configuration

Installing the SAP Virus Scan Server for a purely-Java configuration

Defining scanner groups

Defining SAP virus scan providers

Defining SAP Virus Scan profiles

Delivered SAP Virus Scan profiles

Delivered parameters

Analyzing SAP Virus Scan provider problems

Testing the installation of the SAP Virus Scan provider

Java EE virus scan provider to SAP NetWeaverConfiguring a Java Enterprise Edition (EE) virus scan provider to the SAP Netweaver platform

is done using one of the following sections.

NOTE:The descriptions in this chapter assume you are an administrator of the J2EE Engine.


following URL:


Virus scanadapterfor a purely-Java installation

This procedure describes the normal case in which you are using a local McAfee VirusScan

Enterprise for use with the SAP NetWeaver platform (virus scan adapter). The McAfee VirusScan

Enterprise for use with the SAP NetWeaver platform is a native dynamic library from a third-party

vendor, which can be loaded directly into the process environment of the J2EE Engine. This

http://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htm


45/58

means that you can check memory contents directly for viruses, which achieves a higher

performance.

Virus ScanServerfor a purely-Java installation

This procedure describes the special case, in which the platform or process architecture does

not allow the direct inclusion of a McAfee VirusScan Enterprise for use with the SAP NetWeaverplatform. This is the case, for example, if the required operating system for SAP NetWeaver is

not compatible with the external anti-virus product. In this case, use a virus scan server. The

virus scan server communicates with the J2EE Engine using TCP/IP (SAP RFC protocol) and

accesses the external anti-virus product using a McAfee VirusScan Enterprise for use with the

SAP NetWeaver platform.

McAfee VirusScan Enterprise for use with the SAP NetWeaver platform or virus scan

server for an integrated installation (Java and ABAP)

Both purely-Java installations provide the same interface to instance java from the package

com.sap.security.core.server.vsi.api.

The configuration of the virus scan provider service is stored in the Configuration Manager of

the J2EE Engine. You can use the Visual Administrator for graphical administration.

Installing the product for a purely-Javaconfiguration

Use this task to install the McAfee VirusScan Enterprise for use with the SAP NetWeaver platform

software.


following URL:


After you have installed the McAfee VirusScan Enterprise for use with the SAP NetWeaver

platform software, you only need to type the path to the adapter specified in the product

documentation in the VSA_LIB field.

Configuring Java EE with SAP the Virus Scan InterfaceInstalling the product for a purely-Java configuration



46/58

Task

1 In theVisual Administrator, choose the cluster Destinations.

Figure 22: SAP NetWeaver J2EE RFC Destinations

2 On theRuntimetab page, select RFC and add a new RFC connection by clicking New.

3 Type a name for the new connection using the following naming convention.

NOTE:The name is case-sensitive.

VSCAN_host name, if you only want to start one virus scan server on the host.

VSCAN_host name-number, if you want to start multiple virus scan servers on the host.

The number is a sequence number, which is separated from the host name with a

hyphen.

Examples:VSCAN_HOST123, VSCAN_HOST345-1, VSCAN_HOST345-2.

4 In the right pane, underConnection Settings, set the Load Balancingsetting toNo.

5 Type the Gateway-Hostand the Gateway-Servicenames.

6 ClickSaveto save the new RFC connection.

Configuring Java EE with SAP the Virus Scan InterfaceInstalling the product for a purely-Java configuration



47/58

Installing the SAP Virus Scan Server for apurely-Java configuration

Use this task to install the Java Enterprise Edition SAP Virus Scan Server to use the interface

with SAP NetWeaver.


following URL:


Task

1 Open the SAP Management Console and start the Standalone Gateway.

2 Start the SAP Virus Scan Server with the options -a, -x, and -g, as described inInstalling

a Virus Scan Server as a Self-Starter. For option -a, specify the program ID using the naming

convention (case-sensitive; prefix VSCAN_).

3 In the Visual Administrator, set up the virus scan provider as a Virus Scan Server, as

described in Defining a Virus Scan Provider.4 Specify exactly the program ID that you defined above under option a as the name.

However, you must leave off the name prefix VSCAN_, since this is automatically added.

5 Specify server settings that match those of the provider defined previously. Specify -g and

-x as defined under step 2.

Defining scanner groupsUse this task to define scanner groups as part of a McAfee VirusScan Enterprise for use with

the SAP NetWeaver platform or Virus Scan Server for an Integrated Installation (Java and ABAP)


following URL:


A scanner group combines multiple virus scanners of the same type. You require the groups to

specify virus scan profiles later.

For information about which configuration parameters are required or supported by the product

that you use, see the documentation for the product.

NOTE:SAP does not deliver any scanner groups.

Task

1 In the Visual Administrator, choose the cluster, Virus Scan Provider.

2 On theGroupstab page, create a scanner group by clicking New.

a Specify the name of the new group in the dialog box, and clickOK.

b Select the node for the newly created group.

c On theSettingstab page, type a description of the group in the Descriptionfield.

d To save your entries, clickSet.

Figure 23: SAP NetWeaver J2EE Virus Scan Provider Groups

Configuring Java EE with SAP the Virus Scan InterfaceInstalling the SAP Virus Scan Server for a purely-Java configuration

http://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_nw04/helpdata/en/b8/e6e540c1848131e10000000a1550b0/frameset.htm


48/58

3 On theParameterstab, set the configuration parameters required for the product that

you are using.

a Use the input help to specify the paramet

vsa 100 setup guide en-us

Documents

sap virus scan server

sap virus scan server

virus scan server installation

sap gateway

sap netweaver platform

virus scanners

trademarks of mcafee

java ee virus scan provider