Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 10147 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

User (NT-Authority/System) has aborted On-Access-Scan on this computer

PeterSchwarz

Sophos Anti-Virus for NetApp running on Windows 2012 R2 logs this message several times a day in the sav.log

Is this normal behaviour or an error?



This thread was automatically locked due to age.
  • 0

    Hello PeterSchwarz,

    does it say aborted or stopped? Dunno whether it's different for NetApp - the stopped message is normal and usually followed by a Using detection data ... and a started message. The Anti-Virus service is restarted when new threat detection data (IDEs) has been downloaded (corresponds to the Installing product entries in the updating log).

    Christian

  • 0
    Thank you for your response!

    It's a german installation and it says "abgebrochen" (=aborted).

    But it is followed by the lines you mentioned, so probably the german translation is wrong and it means "stopped".

    20151117 090237 Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
    20151117 090239 Die Erkennungsdatenversion 5.21 (Detection Engine 3.60.0) wird verwendet. Diese Version kann 10248965 Objekte erkennen.
    20151117 090239 Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
  • 0 in reply to PeterSchwarz

    Hello PeterSchwarz,

    the german translation is wrong
    not outright wrong but ... keine Ahnung warum nicht gestoppt verwendet wird (oder begonnen, eingeleitet oder was auch immer für gestartet) - so isses halt [:)].
    Wie gesagt, das (Service Stopp/Start und damit On-Access Stopp) ist der normale Ablauf wenn neue IDEs geladen werden sollen. 

    Christian

Cookie Information Banner