Method and apparatus for snapshot management

1 . A method, comprising:

executing an embedded malware detector, the embedded malware detector being executed inside a first guest operating system, the first guest operating system being executed on a storage processor that is part of a storage system, the storage processor being configured to execute one or more second guest operating systems in addition to the first guest operating system, each of the second guest operating systems being arranged to execute software for reading and/or writing data to one or more storage devices that are provided in the storage system;

identifying, by the embedded malware detector, a given one of the storage devices;

obtaining, by the embedded malware detector, a snapshot of the given one of the storage devices, wherein the snapshot is created independently of one or more policies for point-in-time snapshot creation;

mounting, by the embedded malware detector, the snapshot in the first guest operating system;

scanning the mounted snapshot for malware, the snapshot being scanned by using the embedded malware detector; and

preserving the mounted snapshot for further inspection and outputting an alert in response to the mounted snapshot being found to be infected with malware, and

deleting the snapshot in response to the snapshot being not found to be infected with malware.

2 . The method of claim 1 , wherein identifying the given storage device includes receiving, from a management system, a list of storage devices in the storage system that are designated for monitoring by the embedded malware detector, and selecting the given storage device from the list.

3 . The method of claim 1 , wherein obtaining the snapshot includes requesting the snapshot from a management system.

4 . The method of claim 1 , wherein the software for reading and/or writing data includes a network accessible storage (NAS) server.

5 . The method of claim 1 , wherein the embedded malware detector includes a manager and an antivirus software, the manager being configured to: obtain the snapshot, mount the snapshot, and issue a command to the antivirus software, which, when executed by the antivirus software, causes the antivirus software to scan the mounted snapshot.

6 . The method of claim 1 , wherein the first guest operating system and each of the second operating systems are executed inside a host operating system.

7 . The method of claim 1 , wherein outputting the alert includes one or more of transmitting the alert over a communications network and displaying the alert on a display device.

8 . A storage processor that is part of a storage system, the storage system being configured to provide one or more storage devices, comprising:

a memory; and

at least one processor that is operatively coupled to the memory, the at least one processor being configured to perform the operations of:

executing an embedded malware detector inside a first guest operating system, the first guest operating system being executed on the storage processor together with one or more second guest operating systems, each of the second guest operating systems being arranged to execute software for reading and/or writing data to one or more storage devices that are provided in the storage system;

identifying, by the embedded malware detector, a given one of the storage devices;

obtaining, by the embedded malware detector, a snapshot of the given one of the storage devices, wherein the snapshot is created independently of any policies for point-in-time snapshot creation that are associated with the given storage device;

mounting, by the embedded malware detector, the snapshot in the first guest operating system;

scanning the mounted snapshot for malware, the snapshot being scanned by using the embedded malware detector;

preserving the mounted snapshot for further inspection and outputting an alert in response to the mounted snapshot being found to be infected with malware, and

deleting the snapshot in response to the snapshot being not found to be infected with malware.

9 . The system of claim 8 , wherein identifying the given storage device includes receiving, from a management system, a list of storage devices in the storage system that are designated for monitoring by the embedded malware detector, and selecting the given storage device from the list.

10 . The system of claim 8 , wherein obtaining the snapshot includes requesting the snapshot from a management system.

11 . The system of claim 8 , wherein the software for reading and/or writing data includes a network accessible storage (NAS) server.

12 . The system of claim 8 , wherein the embedded malware detector includes a manager and an antivirus software, the manager being configured to: obtain the snapshot, mount the snapshot, and issue a command to the antivirus software, which, when executed by the antivirus software, causes the antivirus software to scan the mounted snapshot.

13 . The system of claim 8 , wherein the first guest operating system and each of the second operating systems are executed inside a host operating system.

14 . The system of claim 8 , wherein outputting the alert includes one or more of transmitting the alert over a communications network and displaying the alert on a display device.

15 . A non-transitory computer-readable medium storing one or more processor executable instructions, which, when executed by at least one processor of a storage processor, cause the at least one processor to perform the operations of:

executing an embedded malware detector inside a first guest operating system, the first guest operating system being executed on the storage processor together with one or more second guest operating systems, each of the second guest operating systems being arranged to execute software for reading and/or writing data to one or more storage devices that are provided in a storage system;

identifying, by the embedded malware detector, a given one of the storage devices;

obtaining, by the embedded malware detector, a snapshot of the given one of the storage devices wherein the snapshot is created independently of one or more policies for point-in-time snapshot creation;

mounting, by the embedded malware detector, the snapshot in the first guest operating system;

scanning the mounted snapshot for malware, the snapshot being scanned by using the embedded malware detector;

preserving the mounted snapshot for further inspection and outputting an alert in response to the mounted snapshot is found to be infected with malware, and

deleting the snapshot in response to the snapshot being not found to be infected with malware.

16 . The non-transitory computer-readable medium of claim 15 , wherein the software for reading and/or writing data includes a network accessible storage (NAS) server.