Server selection for optimized malware scan on NAS
Server selection for optimized malware scanning on network-attached storage systems is provided herein. A data storage system as described herein can include a memory that stores computer executable components and a processor that executes computer executable components stored in the memory. The computer executable components can include a load determination component that determines respective available capacities of anti-malware servers based on loading information obtained from the anti-malware servers and a task assignment component that assigns a malware scan task to a selected anti-malware server of the anti-malware servers based on the respective available capacities of the anti-malware servers.
1. A data storage system, comprising:
a memory that stores computer executable instructions; and
a processor that executes the computer executable instructions stored in the memory to facilitate performance of operations, wherein the operations comprise:
determining respective available capacities of anti-malware servers based on loading information obtained from the anti-malware servers;
maintaining a data structure that stores information relating to the respective available capacities of the anti-malware servers;
determining a selected anti-malware server from the anti-malware servers based on the information stored in the data structure; and
assigning a malware scan task to the selected anti-malware server.
2. The data storage system of claim 1 , wherein the operations further comprise determining the respective available capacities based on one or more performance metrics associated with the anti-malware servers.
3. The data storage system of claim 2 , wherein the one or more performance metrics comprise at least one of historical server scan throughput of the anti-malware servers, available server processor capacities of the anti-malware servers, or available server memory capacities of the anti-malware servers.
4. The data storage system of claim 2 , wherein the one or more performance metrics comprise at least one of cache memory availability at the anti-malware servers or anti-malware software versions running on the anti-malware servers.
5. The data storage system of claim 1 , wherein the operations further comprise:
receiving the loading information from the anti-malware servers via respective messages received from the anti-malware servers, the respective messages comprising at least one of a heartbeat message or a scan response message from an anti-malware server of the anti-malware servers.
6. The data storage system of claim 1 , wherein the operations further comprise:
obtaining updated loading information for a first anti-malware server of the anti-malware servers; and
updating the information relating to the available capacity of the first anti-malware server in the data structure in response to the updated loading information indicating a change in the available capacity of at least a threshold.
7. A method, comprising:
obtaining, by a device operatively coupled to a processor, available capacity information for respective ones of anti-malware servers based on loading information obtained from the respective ones of the anti-malware servers;
maintaining, by the device, a data structure that stores information relating to the available capacity information for the respective ones of the anti-malware servers;
determining, by the device, a selected anti-malware server of the anti-malware servers based on the information stored in the data structure; and
assigning, by the device, a malware scan task to the selected anti-malware server of the anti-malware servers.
8. The method of claim 7 , wherein the obtaining comprises:
obtaining the available capacity information for the respective ones of the anti-malware servers based on one or more performance metrics associated with the respective ones of the anti-malware servers.
9. The method of claim 8 , wherein the one or more performance metrics comprise at least one of historical server scan throughput information associated with the respective ones of the anti-malware servers, available server processor capacity information associated with the respective ones of the anti-malware servers, or available server memory capacity information associated with the respective ones of the anti-malware servers.
10. The method of claim 8 , wherein the one or more performance metrics comprise at least one of a count of available connections at the respective ones of the anti-malware servers, cache memory availability at the respective ones of the anti-malware servers, or anti-malware software versions running on the respective ones of the anti-malware servers.
11. The method of claim 7 , further comprising:
receiving, by the device, the loading information from the anti-malware servers via messages received from the anti-malware servers, the messages comprising at least one of a heartbeat message or a scan response message.
12. The method of claim 7 , further comprising:
obtaining, by the device, updated loading information for a first anti-malware server of the anti-malware servers; and
updating, by the device, the information relating to the available capacity of the first anti-malware server in the data structure in response to the updated loading information indicating a change in the available capacity of at least a threshold.
13. A non-transitory machine-readable medium comprising computer executable instructions that, when executed by a processor, facilitate performance of operations, the operations comprising:
obtaining available capacity information for respective ones of anti-malware servers based on loading information obtained from the respective ones of the anti-malware servers;
maintaining a data structure that stores information relating to the available capacity information for the respective ones of the anti-malware servers; and
determining a selected anti-malware server of the anti-malware servers based on the information stored in the data structure; and
assigning a malware scan task to the selected anti-malware server.
14. The non-transitory machine-readable of claim 13 , wherein the operations further comprise:
obtaining the available capacity information for the respective ones of the anti-malware servers based on one or more performance metrics associated with the respective ones of the anti-malware servers.
15. The non-transitory machine-readable medium of claim 14 , wherein the one or more performance metrics comprise at least one of historical server scan throughput information associated with the respective ones of the anti-malware servers, available server processor capacity information associated with the respective ones of the anti-malware servers, available server memory capacity information associated with the respective ones of the anti-malware servers, a count of available connections at the respective ones of the anti-malware servers, cache memory availability at the respective ones of the anti-malware servers, or anti-malware software versions running on the respective ones of the anti-malware servers.
16. The non-transitory machine-readable medium of claim 13 , wherein the operations further comprise:
receiving the loading information from the anti-malware servers via messages received from the anti-malware servers, the messages comprising at least one of a heartbeat message or a scan response message.
17. The non-transitory machine-readable medium of claim 13 , wherein the operations further comprise:
obtaining updated loading information for a first anti-malware server of the anti-malware servers; and
updating the information relating to the available capacity of the first anti-malware server in the data structure in response to the updated loading information indicating a change in the available capacity of at least a threshold.