Possibility to trace back for older avdb signatures

1) No, it isn't possible to configure SPL to control when supplements (AV definition, etc) are updated, nor to point at anything other than latest.

2) SafeStore can't be turned off, but stores obfuscated quarantined files locally, nothing goes remote. Also nothing on a network mount will be quarantined, so files never travel onto a machine.

thanks for the answers.

Regarding safestore, I have not configured anything for safestore in my SPL installation case and noticed that SPL removed the threat file upon a on-demand scan. So where did store/moved locally ? 

SPL stores quarantined files internally in the installation directory, in an obfuscated form. They can be restored upon command from Central if they are false positives. They are rescanned every four hours in case Sophos Labs decides that they are false positives.

thanks!

So the installation directory should satisy below requirements for safestore to work ?

SafeStore has the following default limits:

• The single file limit is 100 GB.
• The overall quarantine size limit is 200 GB.
• The maximum number of files stored is 2000.

thanks!

So the installation directory should satisy below requirements for safestore to work ?

SafeStore has the following default limits:

• The single file limit is 100 GB.
• The overall quarantine size limit is 200 GB.
• The maximum number of files stored is 2000.

Most systems won't end up quarantining that many large files, but if your machine is then that much space will be required.