Linux Security 64 Real-time scanning action “Do Nothing” is still preventing access to detected file

Issue:

We have for Linux Security 64 set the Real-time scanning Action for Malware, Action for Potentially Unwanted Applications and Action for suspicious files as  "Do nothing" when there is a detection.

We expected that in that case Linux Security 64 would only report the finding to Policy Manager Console. But in fact, Linux Security 64 will not only report the finding, but it will also prevent access to the detected file. 

Resolution:

When Linux Security 64 real-time scanning detects a file, even if the action is set as "Do nothing", it will indeed block access to the file. This is the intended behavior or logic of the function. 

The workaround is to create either a file or folder exclusion if you need to be able to access the detected file. 

You can create a file or folder exclusion for Linux Security 64 using the Policy Manager Console:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Linux > Real-time scanning
5. In the Files to scan section, add the file or folder path to the Files and folders excluded from scanning list
6. Distribute the policy (Ctrl + D)