Operation principle

The On-access scanner esets_dac (ESETS Dazuko-powered file Access Controller) is a resident program which provides continuous monitoring and control over the file system. Every file system object is scanned based on customizable file access event types. The following event types are supported by the current version:

Open events

To activate this file access type, set the value of the ‘event_mask’ parameter to open in the [dac] section of the esets.cfg file. This will enable the ON_OPEN bit of the Dazuko access mask.

Create (close) events

To activate this file access type, set the value of the ‘event_mask’ parameter to close in the [dac] section of the esets.cfg file. This will enable the ON_OPEN bit of the Dazuko access mask. This will enable the ON_CLOSE and ON_CLOSE_MODIFIED bits of the Dazuko access mask.

Note: Some OS kernel versions do not support the interception of ON_CLOSE events. In these cases, close events will not be monitored by esets_dac.

Exec events

To activate this file access type, set the value of the ‘event_mask’ parameter to exec in the [dac] section of the esets.cfg file. This will enable the ON_EXEC bit of the Dazuko access mask.

 

The On-access scanner ensures that all opened, closed and executed files are first scanned by the esets_daemon for viruses. Depending on the scan results, access to specific files is denied or allowed.