Dwight,

I wanted to let you know that zero byte "files" on the TSM
Server are OK for some things. For example, DP for Domino and
DP for Exchange use zero byte files that contain meta data
necessary for their restores.

So, once you find a way to query for this, you should be aware
that you might find some legitimate zero byte files.

Then again... you probably already knew this!  :-)
But.. just in case people started querying their TSM Servers,
and seeing some of these zero byte files, I didn't want them
assuming they had a virus.

Thanks,

Del

----------------------------------------------------

Del Hoobler
IBM Corporation
hoobler AT us.ibm DOT com

- Never cut what can be untied.
- Commit yourself to constant improvement.
===============================================================
> OK, I've had a question put to me and so far I just don't know...
> With such viruses, as the ones that zero out files under windows, is
there
> an easy way to see if TSM is holding any zero-byte files ? ? ?  (ie.
check
> from the TSM server for potentially infected client nodes...)
>
> I tried testing under Unix (AIX) with a zero byte file and...
> I thought that I might be able to look in the adsm.contents table for
> file_size=0
>         but what I found is (two things)...
>         1) due to aggregates, the file size listed for most files is the
> size of the aggregate
>         2) if you have a zero byte file, you won't even have an entry for
it
> in the adsm.contents table
> The output of a "show version" doesn't list anything about filesize...
>
> Anyone have any tricks to do such a discovery ? (of zero byte backed up
> files)