report on failed managed scan?

[Former Member]

Hello,

I was wondering if there is a way I can run a query on failed managed scans. I am able to run a query where epo 4.5 shows me a list of computers that were infected and/or show me a list of viruses etc but I do not see a way to see which computers failed completing managed scans.

Is there a way to run that kind of query? Is there a way I have to setup clients logs to be sent to the epo? I'm not sure...please help. Thank you in advance!

-Jae

[Hem · Accepted solution]

Event ID 1203 is for ODS completed.

You can query with Event ID not equal to 1203.

Thanks

Hem

[Sk1dMARK]

Event ID 1202 is OD scan started.  Look for machines with a 1202 event without a corresponding 1203 event.  My theory is that if something happened to the machine or McAfee subsystem to cause the scan to fail part of the way through, that you may not see a specific error event like Event ID 1086 or something to that effect.

Hope this helps.

Regards,

Mark

[Former Member]

Awesome, thanks for the help.

[Former Member]

Hmm..I ran a new query(client events) for any event ID equaling 1203 to just see if the client computers are returning with a completed demand scan and I get back 0 compliant.

I know my computer in specific has completed because I can see the OnDemandScanLog.txt from my computer. All I see are event IDs 2401-2413.

Am I doing something wrong?

[Former Member]

1202 and 1203 events are not enabled by default. You have to turn them on in the event filter, wait for all of your machines to get the new policy, then start your scan.

When you run the report, you'll also need to filter it by 'Analyzer Detection Method' in order to limit to just the managed scan you're looking for. Otherwise you'll receive data with on-demand scans other than the managed one you're trying to verify.

edit: Also, the 1203 event is sent even if the scan is canceled. All it means is that the scan completed; it doesn't care why the scan stopped. I think event 1035 indicates that it was canceled, but I found that event to be a little hit and miss on accuracy.I basically just started doing SQL queries directly in the DB that did a diff between the full list of machines that should have done a scan, and the list of machines that had a 1202 event for that scan name during the designated scan period. It's fairly painful and not 100% reliable, but it's the best I've been able to do.

Message was edited by: Slingo on 10/8/10 9:33:22 AM GMT-05:00