Scan Timeout Events Fail to Show "Threat Target File Path"

[Former Member]

I often run a report on event 1059 (scan timeout) entries to observe what files are timing out VirusScan.  Lately, I've noticed a lot of events logged in which the "Threat Target File Path" is empty.  If I view the logs on the system in question, the file paths are listed.  Does anyone have any ideas why this information isn't showing up in EPO?

[jstanley]

I'd suggest starting by checking in the latest reporting extension for VSE. Currently this extension is available in the install package for VSE 8.7 patch 3.

[Former Member]

Our reports extension should be current; it shows version 1.1.0.149.  Now that you mention it, I just checked it in a couple weeks ago.  Could that be causing a problem, especially if most of our clients are still running 8.5?

[jstanley]

Actually this may be an issue (even with the latest reporting extension) related to the way VSE 8.5i is generating these events. The events failing to process should leave a .XML or a .TXML file in the ePO's DB\Events folder. Take a look at one of those files using notepad and see if they contain any unusual characters (boxes, strange symbols you don't recognize, etc). If so then you will need to call into support and open a ticket as this is an issue we are currently investigating. I investigated this issue myself and only found it to occur on VSE 8.5i so if upgrading to VSE 8.7i is an option that may resolve the issue.

The folder I'm referening in EPO resides here:

<ePO install directory>\DB\Events\

[Former Member]

The Events folder is empty right now, but I'll keep checking.  This condition did start around the time that I checked in the new extension, and we are in the process of moving to 8.7, so I'll probably wait until we complete the upgrades and see if the condition still exists then.  Thanks.