False ransomware alert for .pay files in VCF Operations for Logs using Dell PowerProtect Data Manager

Products

• VCF Operations

Issue/Introduction

Hundreds of files with the .pay extension are incorrectly identified as ransomware by Dell PowerProtect Data Manager on VCF Operations for Logs appliances. These files, typically following the _###_Lucene41_0.pay naming convention, are located within  /storage/core/loginsight/cidata/store/########-####-####-####-############/index/ directories and are legitimate system files.

Environment

• VCF Operations 9.0.x
• Dell PowerProtect Data Manager

Cause

Dell PowerProtect Data Manager incorrectly flags files with the .pay extension as being related to ransomware.

Resolution

The .pay files identified are legitimate system files related to Apache Lucene, which is used by VCF Operations. These files are expected to be present in the /index/ directories on the appliance and do not indicate a ransomware infection.

For a complete list of files used by Apache Lucene, refer to the Lucene Documentation.