Mcafee OAS exclusion recommendations

Products

• Autosys Workload Automation

Issue/Introduction

On several Autosys managers a Mcafee "OAS Manager" process consumes a lot of CPU.

After analysis by the Antivirus teams, it appears that it is the /opt/CA/SharedComponents directory that comes up in the scans.

Would it be possible to have your best practices ?

The goal would be to know the executables that create these logs in order to study their exclusion.

Following files were noticed McAfee logs

Feb 18 02:29:40 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/pgsql/data/pg_stat_tmp/db_0.tmp could not be opened due to - No such file or directory
Feb 18 02:29:40 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/pgsql/data/pg_stat_tmp/global.tmp could not be opened due to - No such file or directory
Feb 18 02:29:41 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory
Feb 18 02:29:43 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory
Feb 18 02:29:45 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory
Feb 18 02:29:45 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory
Feb 18 02:29:51 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory
Feb 18 02:29:55 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory
Feb 18 02:30:01 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/pgsql/data/pg_stat_tmp/db_0.tmp could not be opened due to - No such file or directory
Feb 18 02:30:01 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/pgsql/data/pg_stat_tmp/global.tmp could not be opened due to - No such file or directory
Feb 18 02:30:01 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/pgsql/data/pg_stat_tmp/db_16486.tmp could not be opened due to - No such file or directory
Feb 18 02:30:01 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/pgsql/data/pg_stat_tmp/global.tmp could not be opened due to - No such file or directory
Feb 18 02:30:01 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory
Feb 18 02:30:02 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory
Feb 18 02:30:05 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory
Feb 18 02:30:08 host1234 ERROR OASManager [30408] Skipping since file path /opt/CA/SharedComponents/CADirectory/dxserver/data/itechpoz/itechpoz.dp$ could not be opened due to - No such file or directory

Environment

Release : 11.3.6

Component : CCSECS - EM COMMON SERVICES

Resolution

These files are belonging to

- Postgres  = database used when Event Manager is installed
- itechpoz   = this is CA internal LDAP directory that is being used by EEM

Recommendation is to exclude these files from McAfee scans.