Nutanix Files, part of Nutanix Unified Storage (NUS), is being used for user home directories, and users are experiencing delays or access denied errors when accessing large audio and video files. The issue is related to the integration with an ICAP (Internet Content Adaptation Protocol) server, which Nutanix Files uses to scan files for security (e.g., antivirus, malware detection). The delays and errors suggest that the ICAP server is struggling to scan these large files, causing timeouts or access issues.

Understanding the Issue:

ICAP Integration: Nutanix Files can integrate with an ICAP server to scan files for threats. By default, files are scanned on read and write operations, and if a scan cannot be completed (e.g., due to timeouts), access may be blocked.

Large Audio/Video Files: These files are typically very large (e.g., GBs in size), and scanning them can take significant time, especially if the ICAP server is under-resourced or the network latency is high.

Four-Minute Timeout: The “access denied” error after four minutes suggests a timeout in the ICAP scan process, likely because the ICAP server cannot complete the scan within the default timeout period (often 240 seconds or 4 minutes).

Long Wait Times: The wait times before opening files indicate that the ICAP server is scanning the files on read, causing delays for users.

Analysis of Options:

Option A (Add the extensions of the affected file types to the ICAP's Exclude File Types field in the ICAP settings for the Files cluster): Correct. Nutanix Files allows administrators to exclude certain file types from ICAP scanning by adding their extensions (e.g., .mp4, .wav) to the “Exclude File Types” field in the ICAP settings. Large audio and video files are often safe and do not need to be scanned (e.g., they are less likely to contain malware), and excluding them prevents the ICAP server from attempting to scan them, eliminating delays and timeout errors.

Option B (Uncheck the "Block access to files if scan cannot be completed (recommended)" option in the ICAP settings for the Files cluster): Correct. By default, Nutanix Files blocks access to files if the ICAP scan cannot be completed within the timeout period (e.g., 4 minutes), resulting in the “access denied” error. Unchecking this option allows access to files even if the scan fails or times out, mitigating the access denied issue for large files while still attempting to scan them. This is a recommended mitigation when scans are causing access issues, though it slightly reduces security by allowing access to un-scanned files.

Option C (Enable the "Scan on Write" option and increase resources for the ICAP server): Incorrect. The “Scan on Write” option is already enabled by default in Nutanix Files ICAP settings, as it ensures files are scanned when written to the share. Increasing resources for the ICAP server might help with scanning performance, but it does not directly address the issue of large files causing timeouts on read operations, and it requires additional infrastructure changes that may not be feasible. The issue is primarily with read access delays, not write operations.

Option D (Enable the "Scan on Read" option and decrease resources for the ICAP server): Incorrect. The “Scan on Read” option is also enabled by default in Nutanix Files ICAP settings, and it is the root cause of the delays—scanning large files on read causes long wait times. Decreasing resources for the ICAP server would exacerbate the issue by further slowing down scans, leading to more timeouts and errors.

Selected Actions:

A: Excluding audio and video file extensions from ICAP scanning prevents the server from attempting to scan large files, eliminating delays and timeouts for these file types.

B: Disabling the “Block access” option ensures that users can access files even if the ICAP scan times out, mitigating the “access denied” error after four minutes.

Why These Actions?

Excluding File Types (A): Large audio and video files are often safe and do not need scanning, and excluding them avoids the performance bottleneck caused by the ICAP server, directly addressing the long wait times.

Disabling Block Access (B): The four-minute timeout leading to “access denied” errors is due to the ICAP scan failing to complete. Allowing access despite scan failures ensures users can still open files, though it requires careful consideration of security risks (e.g., ensuring excluded file types are safe).

Combining these actions provides a comprehensive solution: excluding file types prevents unnecessary scans, and disabling the block ensures access during edge cases where scans might still occur.

Exact Extract from Nutanix Documentation:

From the Nutanix Files Administration Guide (available on the Nutanix Portal):

“To mitigate performance issues with ICAP scanning for large files (e.g., audio, video), add the extensions of affected file types to the ‘Exclude File Types’ field in the ICAP settings for the Files cluster. Additionally, to prevent ‘access denied’ errors due to scan timeouts, uncheck the ‘Block access to files if scan cannot be completed (recommended)’ option, allowing access to files even if the scan fails.”