Query on on-access scan logs

[fattonymaximus]

Hi All,

I currently have a number of devices on my EPO server running McAfee Agent 5.5.1.342 and VSE 8.8.0.1804 with on acccess scanning turned on. This is on Win 32 Win 10 machines. Is there a problem running these combinations of sotware together?

When I open up VirusScan Console and right click on the option on access scanner and choose "Statistics" i can see the files that the VSE is currently scanning and can see the last scanned file.

I have checked in the logging file in C:\programdata\mcafee\desktopprotection and the 4 logs files that reside there are Accessprotectionlog.txt (blank file due to it being disabled),  onaccessscanlog.txt, ondemandscanlog.txt, updatelog.txt.

Is there a McAfee log file that will tell me what files onacess scanning has actually scanned?

I checked through the onaccessscanlog.txt (extrracts below) and it looks like it updates what the version is and the number of files scanned.Interpreting the below log files. Does it mean below that at 03:34:53 that a scan ran fully and scanned 16181 files and that the scan is finished?

23/01/2019 03:34:53 Statistics:
23/01/2019 03:34:53 Files scanned: 16181
23/01/2019 03:34:53 Files detected: 0
23/01/2019 03:34:53 Files cleaned: 0
23/01/2019 03:34:53 Files deleted: 0

23/01/2019 03:34:54 Statistics:
23/01/2019 03:34:54 Files scanned: 16181
23/01/2019 03:34:54 Files detected: 0
23/01/2019 03:34:54 Files cleaned: 0
23/01/2019 03:34:54 Files deleted: 0

23/01/2019 03:35:25 Engine version = 6000.8403
23/01/2019 03:35:25 AntiVirus DAT version = 9144.0
23/01/2019 03:35:25 Number of detection signatures in EXTRA.DAT = None
23/01/2019 03:35:25 Names of detection signatures in EXTRA.DAT = None

Errors being reported are that there are dll files such a MSCORLIB is being used by another process for example. However when checking through the above 4 log files and event viewer and cant find any process relating to mcafee in and around the times reported

Is there any log that I am missing out on?

Regards

[vnaidu]

Dear @fattonymaximus 

According the scan logs the OAS scanned the files and nothing is detected. However, if possible you may help us with the logs located from %Programdata%\Mcafee\.

Regards,

[Former Member]

There is no log file which will show you what OAS is scanning - this would have a far too large performance impact on the client if we were to log this. If you were wanting to see what is being scanned, you could do so with procmon but obviously this is only intended really for troubleshooting purposes: https://kc.mcafee.com/corporate/index?page=content&id=KB50981

The stats you see in the OAS log are reported everytime the mcshield processes are restarted. Which would be frequently in your case and something  you should investigate. Based on the extract, looks like maybe a file is timing out causing mcshield to crash. Just a theory though 🙂 - check the Windows Event Logs.

[vnaidu]

@Former Member Excellent

[fattonymaximus · Accepted solution]

Thanks all, 

Was thinking I was missing something but doesnt look like I was.

Regards