Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 9618 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Console initiated Full System Scan issues

VladGuan

Hi All,

We have serveral Windows, Linux and Mac OS X servers/workstations protected by our Sophos server. Full system scans initiated via the SEC gets registered for Windows (7 and 2008 R2) and Linux (Centos) machines but either is not started or not registered on the SEC for Macs and Fedora machines. They are all up to date and have all policies applied.

Anyone know why the Macs and Fedora machines are either not responding the the scan or not reporting back?

Thanks,
Vlad

:53953


This thread was automatically locked due to age.
  • 0

    Hello Vlad,

    a scheduled scan should appear in the scans list of the endpoint's GUI. The Mac GUI at least in addition shows the last time such a scan has been run. Regardless of the platform the scan's start should be recorded in the AV log apart from the scan-specific log. Unless the scan perishes in some obscure way completion, abort, or cancel should also result in a message written to the log (which is normally also sent to SEC together with alerts and errors - although these are not explicitly associated with the scan, only the "final" message is). BTW - I've tested with an outdated OSX10.4/SAV8.0 installation where the Mac hadn't been rebooted for ages and albeit compliant it didn't start the scheduled scan. After reboot the scans were started according to schedule and correctly reported to SEC.

    Christian

    :53977
  • 0

    Cheers Christian,

    One of the Macs has reported back after doing a console initiated scan last night. I will try the other two Macs again to see what happens, like wise the Fedora PC.

    :53983
  • 0

    It seems at least for one of the Macs (have not checked the other that is not working), that the SophosManagementAgent log states it got EM-DoAction message from Router$SOPHOS.EM followed by it has received action for SAV. However, there is nothing in the Sophos Anti-Virus log to state it has started a scan.

    :54045
  • 0

    Hello Vlad,

    on my legacy Mac the Do-Action (and the resulting scan) doesn't sen a message to the AV log. But the scan (if started) writes its log to /Library/Logs/Sophos Anti-Virus/Scans/SEC Full System Scan/ (a named scheduled scan would write to a folder with its name). Dunno though where you would see why a scan isn't started.

    Christian

    :54073