McAfee AVDCDE-AA-AA - Active Virus Defense Suite, User Manual

Page: 282 / 344

Using VirusScan Utilities
282 McAfee VirusScan Anti-Virus Software
VirusScan software as an Alert Manager client
VirusScan software works as a client program with respect to NetShield
software and an Alert Manager server. It can send alert “events” whenever it
detects a virus or malicious software to any Alert Manager server you specify.
The Alert Manager server then relays those events—and any others it receives
from other workstations—as alert messages, via the methods you or your
system administrator defined for alert distribution.
VirusScan software can instead send these same alert messages as text (.ALR)
files to a Centralized Alerting directory visible to the Alert Manager server.
The Alert Manager server checks the Centralized Alerting directory
periodically, looking for any new .ALR files, and distributing the alert
messages from any it finds.
Š
NOTE: McAfee recommends that you send alert events directly to an
Alert Manager server rather than via Centralized Alerting, unless your
network configuration does not permit you to use Alert Manager servers.
The Alert Manager server can work in conjunction with Network
Associates Event Orchestrator software to tie alert messages into the
Network Associates Magic HelpDesk application for trouble-ticket
generation and other features.
Alert Manager messages also contain much richer data than do those sent
via Centralized Alerting. Enabling SNMP traps for Alert Manager will
collect a host of information about the computer that generates the alert
message and its software configuration.
The VirusScan client can supplement either method with Desktop
Management Interface (DMI) alerts for network management software, such
as Hewlett-Packard OpenView, to process.
Configuring the Alert Manager client utility
VirusScan software includes a simple client configuration utility that allows
you to choose the Alert Manager server that you want to receive alert events,
designate a Centralized Alerting directory to receive alert messages, and
specify the numeric value of DMI alert messages you want to send.
Setting up a complete alert system is a two-part process: First, you must enable
the Alert Manager Client Configuration utility and point it to the correct Alert
Manager server or Centralized Alerting location. Next, you must verify that
you have selected the
Notify Alert Manager checkbox in the VirusScan
Advanced Alert property page, in the Alert page for the E-Mail Scan extension
and in the Alert pages for each VShield module you have enabled.