{"id":7941,"date":"2026-10-13T12:42:32","date_gmt":"2026-10-13T09:42:32","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=support_article&p=7941"},"modified":"2026-10-13T12:42:32","modified_gmt":"2026-10-13T09:42:32","slug":"linux-security-64-real-time-scanning-action-do-nothing-is-still-preventing-access-to-detected-file","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/linux-security-64-real-time-scanning-action-do-nothing-is-still-preventing-access-to-detected-file\/","title":{"rendered":"Linux Security 64 Real-time scanning action “Do Nothing” is still preventing access to detected file"},"content":{"rendered":"

Issue:<\/h3>\n

We have for Linux Security 64 set the Real-time scanning Action for<\/strong> Malware<\/strong>, Action for Potentially Unwanted Applications<\/strong> and Action for suspicious files<\/strong> as \u00a0"Do nothing" when there is a detection.<\/p>\n

We expected that in that case Linux Security 64 would only report the finding to Policy Manager Console. But in fact, Linux Security 64 will not only report the finding, but it will also prevent access to the detected file.\u00a0<\/p>\n

Resolution:<\/h3>\n

When Linux Security 64 real-time scanning detects a file, even if the action is set as "Do nothing", it will indeed block access to the file. This is the intended behavior or logic of the function.\u00a0<\/p>\n

The workaround is to create either a file or folder exclusion if you need to be able to access the detected file.\u00a0<\/p>\n

You can create a file or folder exclusion for Linux Security 64 using the Policy Manager Console:<\/p>\n

    \n
  1. Log in to the Policy Manager Console<\/li>\n
  2. Select a host or policy domain from the domain tree<\/li>\n
  3. Go to the Settings <\/strong>tab<\/li>\n
  4. Navigate to Linux > Real-time scanning<\/strong><\/li>\n
  5. In the Files to scan <\/strong>section, add the file or folder path to the Files and folders excluded from scanning <\/strong>list<\/li>\n
  6. Distribute the policy (Ctrl + D)\u00a0<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    We have set Real-Time scanning in Linux Security 64 (LS) to “Do nothing” in case a malware, a potentially unwanted application or a suspicious file is detected. We expected that in that case LS would just report the finding to Policy Manager. But in fact, LS will not only report the finding, but also prevent access to the detected file, which in our opinion is not appropriate behavior considering the setting of the real-time scanner to “Do Nothing”.\u00a0<\/p>\n","protected":false},"template":"","support_article_product":[106],"class_list":["post-7941","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000005274","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-13 09:42:32","import_hash":"6d909ea33ae5ddd8916f064c98a7f2ef2fa54a9a","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/7941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7941"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=7941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}