AVIRA ANTIVIR VIRUS SCAN ADAPTER FOR SAP... Quick guide

HowTo
Configuration of the VSA
with
SAP NetWeaver 2004(s) ABAP
Avira Support
August 2009

2
Content
SAP System Requirements ........................................................................................ 3
SAP Platforms......................................................................................................... 3
OS System Requirements....................................................................................... 3
Important Transactions............................................................................................... 3
What should be considered? ...................................................................................... 4
How is the VSA connected to the SAP system (ABAP)?............................................ 5
How to define a new RFC destination with TCP/IP ................................................. 5
Definition of an RFC Destination............................................................................. 6
This transaction ‘spro’ is the way to the system administration of the Netweaver... 7
Definition of a virus scanner group.......................................................................... 8
Definition of a Virus Scan Adapter or Server........................................................... 9
Definition for profiles which control the activation of the VSA ............................... 12
Definition of the Steps in the Virus Scan Profile.................................................... 14
Testing the installation of the Virus Scan Server (Profile Z_AVIRA)......................... 16
Trace possibilities in the SAP system....................................................................... 18
Activation of the Active Content Scanning................................................................ 21
Testing the Installation of the Virus Scan Server (profile ZACTIVECONTENT)...... 25
Integration of the VSA without RFC destination........................................................ 26
Environment variables VSA_LIB and VSA_DEBUG................................................. 27
Application server or self-starter ............................................................................... 27
External activation of the AntiVir VSA via VSCAN_RFC (self-starter) ...................... 28
Scan of SAR and CAR archives ............................................................................... 29

3
SAP System Requirements
SAP Platforms
SAP NetWeaver 6.40 with support package 7 or more; for the ABAP engine with
SAP-BASIS 640 support package 11 or more;
for the J2EE engine with support package 13 or more SAP NetWeaver 2004s (7.0)
OS System Requirements
Operating systems Linux/Unix (32-bit/64-bit):
Red Hat Enterprise Linux 5 Server; Red Hat Enterprise Linux 4 Server; Novell SUSE
Linux Enterprise Server 10 - 10.2; Novell SUSE Linux Enterprise Server 9; Debian
GNU/Linux 4 (stable); Ubuntu Server Edition 8; Sun Solaris SPARC 9; Sun Solaris
SPARC 10
Operating systems Windows (for 32-bit only):
Windows 2000 Server, SP4 recommended
Windows 2000 Advanced Server, SP4 recommended
Windows 2003 Server
Windows Server 2008 (not for Core-Setup)
Important Transactions
Transactions:
sm59 ÆConfiguration of the RFC connection
spro ÆSystem administration of the SAP Netweaver
vscan ÆVirus Scan Provider Definition
vscantrace Ædirected Trace in case of virus attack
vscanprofile Ædirect access to the definition of the
virus scan profiles in the SAP system
vscangroup Ædirect access to the definition of the
virus scan groups in the SAP system
vscantest ÆTest for the virus scan interface

4
What should be considered?
Important information about the specific configuration of ABAP:
For the installation of the RFC connection it is important that the name of the RFC
destination begins with “VSCAN_”. The virus scanner can only work with this
beginning of the name.
In the menu “Technical settings -> program ID” the RFC destination has to be
entered again.
The option “Registered server program” has to be chosen as kind of activation for the
RFC destination.
The procedure is valid for the virus scan server via RFC destination.

5
How is the VSA connected to the SAP system (ABAP)?
How to define a new RFC destination with TCP/IP
Transaction SM59

6
Definition of an RFC Destination
Transaction SM59
►Create an RFC connection of the type T in transaction SM59
You have to use the following name convention for the configuration of the scan
server:
• VSCAN_<Hostname>, in case you want to start only one virus scan server on the
host
• VSCAN_<Hostname>-<Number>, in case you want to start several virus scan
servers on the host.
The figure is serially numbered and separated by a hyphen from the host name.
Possible names are: VSCAN_HOST123, VSCAN_HOST345-1,
VSCAN_HOST345-2 etc.

7
►Choose the kind of activation “Registered server program”.
►Use the name of the RFC destination as program ID.
►Enter the address of the system gateway as gateway host and gateway service.
In case you start the virus scan server via the computing center management system
on an application server, choose the gateway of this application server.
This transaction ‘spro’ is the way to the system administration of
the Netweaver
•Virus scanner group
•Virus scan server
•Virus scan profile

8
Definition of a virus scanner group
►Transaction ‘vscangroup’
Choose new entries.
You get to the menu new entries: Overview of added entries.
Enter the data for the definition of the scanner group.
Scanner group: Freely definable name of the scanner group.
Business add-in: If this indicator is set, the program transfers the request for a virus
scan instance for this scanner group to the Business Add-In VSCAN_INSTANCE,
with which customers can include their own virus scanners. If this option is not set,
the program searches for a suitable virus scan server among the set of virus scan
servers maintained in Customizing that have this scanner group.
Group text: Explanations about the scanner group.

9
Definition of a Virus Scan Adapter or Server
Transaction ‘vscan’
Provider type choice:
ADAPTER (Virus Scan Adapter):
This option can be chosen in case Avira GmbH supports the SAP operation system
directly. The virus scanner runs directly in the SAP web application server and no
files have to be sent to an outsourced server via the network. With this configuration,
there is no need to set a VCSAN_RFC as the SAP system communicates directly
with the virus scanner.

10
SERVER (Virus Scan Server):
This option has to be activated if Avira does not support the SAP operation system.
The files which have to be scanned are sent to an outsourced server. After the scan
the virus scanner informs the SAP system if a virus has been found or not. The
further handling of the upload is done by the SAP virus scan interface.
The example underneath shows the configuration with the outsourced server.
►Choose in the IMG SAP Web Application Server/
System administration/ virus scan interface
►Choose the Execute option next to Define Virus Scan Servers.
The screen View: Change "Virus Scan Servers": Overview appears.
►Choose New Entries.
The screen New Entries: Details of Added Entries appears.
►Enter the name of the virus scan server into the box Scan server. The name has
to be the same as the name of the RFC destination which contains the technical
connection to the virus scan server.

11
The following parameters are supported by Avira AntiVir for SAP:

12
All parameters are activated by default except for the parameter
SCANHEURISTICLEVEL. You can activate it in the menu ‘vscanprofile’ afterwards.
Definition for profiles which control the activation of the VSA
Transaction vscanprofile

13
Scan Profile: Specifies the name of a virus scan profile.
Profile Text: Explanatory text for a virus scan profile.
Active: Specifies that this virus scan profile is active. The virus scan profile can only
be used if this indicator is set. SAP applications can use fixed profile names that are
delivered. By default, these profiles are not active, meaning that the application
program works without a virus scan. You can activate the virus scan for each
application by setting this indicator.
Default Profile: Indicator that this virus scan profile is the default profile.
You can set this indicator for only one virus scan profile. This virus scan profile is
used in the following cases:
-If an application requests a virus scanner without specifying a virus scan profile.
-If a virus scan profile is requested for which the Use Reference Profile indicator is
set, and the Reference Profile is empty.
Use reference: To operate multiple applications using the same virus scan profile,
set the Use Reference indicator and specify the reference profile.

14
Definition of the Steps in the Virus Scan Profile
Transaction vscanprofile
Position: Specifies the position of the scanner group in the virus scan profile.
You can activate the parameters SCANHEURISTICLEVEL in the menu Configuration
parameters.
Value1 = low
Value 2 = medium
Value 3 = high

15
In case a virus scan profile uses several scanner groups, you can serialize them by a
position number.
Type: Specifies whether a step in the virus scan profile refers to a scanner group or
another virus scan profile. If you choose Group, the system uses a virus scan server
from this group (or a BADI∗implementation) for the virus scan. If you choose Profile,
the program processes the specified virus scan profile instead of this step. You can
define any conditions by combining the steps of the virus scan profile with the linkage
type of the steps (AND/OR).
∗The abbreviation BADI means business add-in. BADIs are the object related successors of user-exits. In
comparison to the common CMOD/SMOD-extension they are more difficult to use. But they offer amplified
development and modification possibilities. A BADI interface (transaction SE18) can contain different BADI
implementations (transaction SE19) but only one can be active at the same time.
You can realize interesting combinations of different BADIs. You can find all BADIs for each transaction by means
of the following steps: 1. Transaction SE24 (Display class cl_exithandler); 2. Double-click on method
GET_INSTANCE; 3. Enter breakpoint in line 25 (CASE sy-subrc); 4. Start transaction, execute the corresponding
actions and wait fort he debugger; 5. Evaluate the content of the box exit_name.

16
Scanner Group: Combines multiple virus scan servers or allows the use of a BAdI
implementation. All of the virus scan servers of a scanner group have the same set of
configuration parameters and will therefore use the same scan engine.
Viren Scan Profile: Specifies the name of a virus scan profile that you can include
as a step in the profile that you are currently processing.
Testing the installation of the Virus Scan Server (Profile
Z_AVIRA)
This procedure gives you the possibility to check your configured virus scan server.
►Start the transaction VSCANTEST.
►Enter the object you want to scan, the given test file or you own local file.
►Choose the virus scan profile, the scanner group ort he virus scan server.
►Choose an action.

17

18
Trace possibilities in the SAP system
fTransaction vscantrace
fDefinition of a trace log for certain events

19
Trace possibilities in the SAP System
fTransaction vscantrace
fTrace runs and recollects data

20
Trace possibilities in the SAP System
fTransaction vscantrace
fTrace runs and collects data
fA file with an eicar (test virus) has been uploaded