I installed SAV (Sophos anti virus) for linux v9 on a test OES server. Its configured to use fanotify since talpa failed to load.

I created the eicar test virus and found I was able to write the virus file out to the NSS volumes. Copying the files to root / resulted in a virus detection.

I'm newbie to linux and OES, but it sounds to me like fanotify is not called when writing files out to the NSS volumes, which is where all the user homedirectories would be located, and possibly the shared areas too.

I know that virus scanning is best located on the desktop, but we have always thought a belt and braces approach by installing a different vendors product on the server was best - a 'on demand' scanner on the server would catch anything missed by the desktop scanner.

Any comments appreciated.