Our IT services has deployed anti-ransomeware software (ARS). ARS is an important tool to help protect our data from ransomware attacks. The government of PEI was recently hit with a ransomware attack in February 2020.
On April 7th ARS was deployed on our network storage. Our data store, config store, file geodatabases and raster tile caches are stored on our network storage. Coincidentally, we have noticed stability issues with the our ArcGIS servers through most of April. On April 30th the network storage team helped us identify a pattern that showed stability issues with the our ArcGIS Servers that coincided with the dates and times of events logged by the ARS software.
Before I continue let me strongly state “There has NOT been a ransomware attack on our ArcGIS servers.”
We believe that normal ArcGIS Server operations might mimic ransomware activity. This triggers the ARS software to log an event and then begin to take snapshots of our files on the network storage servers. We suspect the snapshotting may be interfering with the normal operation of ArcGIS Server. Some of our users have reported failed map service requests and we have witnessed missing raster map tiles in our tile cached basemaps.
Since April 30th the Isilon server team has disabled the ARS snapshotting activity for our storage space on the network servers. This appears to have improved the stability of our ArcGIS servers but we are continuing to closely monitor for problems.
If ARS has been deployed on your storage servers and you are having stability issues with ArcGIS Server you should dig a little deeper. Have the ARS logs reviewed to see if they mention the ArcGIS Server admin account and see if the dates and times in the logs coincide with dates and time of ArcGIS Server problems. Good luck!
