Hi,
I've successfully deployed EVS for NSX in my lab environment, however I ran into some problems:
1. For some reason, EVS appliance(the one that does the actual scan) would stop working at some point, all protected guest VMs becomes frozen, i.e. mouse cursor can still move but applications cannot run, looks like filesystem activity is entirely blocked. The only way to fix this is to force restart EVS appliance. I checked /var/log/messages and see a huge number of entries like this:
Mar 3 01:09:07 evs-appliance evs_sva[12722]: [WARNING] (EPSEC) [0x3278] Exceeded maximum concurrent events for /vmfs/volumes/57687926-b4eb627e-80fe-1c98ec284388/XXX.vmx
full log is attached. This happened twice already and I've only deployed it for 2 days.
Is there anything I've mis-configured here? please help.
evs_log_messages.zip
2. How to deal with quarantined files in case of false positive? I've tried Upload Quarantine task on protected VM and it fails with message "Ignoring invalid task for VAgentHost".
3. Is Linux guest supported? I tried installing guest introspection driver on a Linux guest and it gets picked up by VAgentHost as protected VM, but it doesn't seem there's any protection, I can download and read Eicar file without getting detected.