How to run a program after scan is finished?

HI,

Is this primarily a problem for older machines, such as XP, 2003?  The option "run scan at lower priority " should allow you to run the scans during the day.

Otherwise there is no way to have the machine shutdown once complete without getting creative.  One option might be to create another scheduled task on the machine at the same time that runs shutdown.exe.  You would configure this with the option of "Only start the task if the computer has been idle for at least: " set to maybe 1 minute.   This should in theory cause shutdown.exe to be called once the task has completed.  You could test this to see if it works.

Otherwise, you would need maybe another tasks set to kick off the Sophos task and then the original task would call shutdown.exe once the first returns.

There is no way to do it natively within the product but maybe the above gives you something to work with.

Regards,

Jak
 

Hi Jak,

ok, no way in the product, would be a good idea to include something like that in a later version?

We mostly have XP machines (1 - 5 years old), and the newer machines do slow down as well. "run scan at lower priority " is checked.

I will try the idea with the computer idle time and report the result here.

Hi,

Unfortunately "the run scan at lower priority " only works for Vista+ machines but it'll be interesting to hear how you get on with the other idea.

Regards,

Jak

It did not work because the computer thinks it would idle when the scan runs. So shutdown is done before the scan is finished.

Unfortunately there seems to be no way to recognise that the scan is finished - no event can be logged, no process does finish.

So the only way to run nightly scans is to guess how long it will take, which is bad.

Hello strubbel,

while I don't need this functionality it poses an interesting challenge. What would Gyro Gearloose (or Daniel Düsentrieb) do? Well, here's some pieces of VBS code cobbled together.I've done only rudimentary testing so use at your own risk. The shutdown is not implemented - I leave this to you (you should perhaps put in some safeguards). The script should be started before the scan. The are two places marked  ===== configure ===== (you can guess why).

' --------- 
' the name of the log is usually the name of the scan
' (unless the file is locked, then a number is appended
'  the script does not check for this)
' ===== configure ===== 
strScanname = "Scan all" 
strScanlog = SAVLogDir() & strScanname & ".txt" 
strScanended = "whoops"
blnScanrunning = FALSE 
strComputer = "." 
 
Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 
strQuery = "SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE " _
           & "TargetInstance ISA 'CIM_DataFile' AND " _
           & "TargetInstance.Name='" & strScanlog & "'"

' check every 10 seconds for an event 
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
  ("SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE " _
  & "TargetInstance ISA 'CIM_DataFile' AND " _
  & "TargetInstance.Name='" & strScanlog & "'")

Do
  Set objLatestEvent = colMonitoredEvents.NextEvent
  intNSize = objLatestEvent.TargetInstance.FileSize
  intOSize = objLatestEvent.PreviousInstance.FileSize
  If blnScanrunning Then
     strScanended = ScanStatus(strScanname, strScanlog)
     If strScanended <> "not run" Then
        Exit Do
     End If 
  Else
     blnScanrunning = blnScanrunning OR (IntNSize <> intOSize)
  End If
  
Loop

' If we get here, the scan has finished
' and we can shut down 
Wscript.Echo strScanended & ", proceed to shutdown"
'---------------------
'---------------------
' Function ScanStatus aborted completed
Function ScanStatus (strName, strLog)

Const ForReading = 1
ScanStatus = "not run"

Set objFSO = CreateObject("Scripting.FileSystemObject")
' localize the below two lines as needed
' ===== configure ===== 
strAborted   = "Scan '" & strName & "' aborted"       
strCompleted = "Scan '" & strName & "' completed"

Set objFile = objFSO.OpenTextFile(strLog, ForReading, FALSE, vbUseDefault)
strContents = objFile.ReadAll
objFile.Close

If InStr(1, strContents, strCompleted, vbTextCompare) Then
    ScanStatus = strCompleted
End If

If InStr(1, strContents, strAborted, vbTextCompare) Then
    ScanStatus = strAborted
End If

Set objFSO = nothing

End Function

'---------------------
' Read the SAV Log directory location from the registry
Function SAVLogDir

Const HKEY_LOCAL_MACHINE = &H80000002
strRootKeyPath = "SOFTWARE"
strSubKeyPath = "SOFTWARE\Sophos\SAVService\Application"

Set objRegistry = GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv")

objRegistry.EnumKey HKEY_LOCAL_MACHINE, strRootKeyPath, arrRootSubKeys
For each objRootSubKey in arrRootSubKeys
  If (objRootSubKey="Wow6432Node") Then
    blnIs64 = TRUE
  End If
Next
If blnIs64 Then
     strSubKeyPath = "SOFTWARE\Wow6432Node\Sophos\SAVService\Application"
End If

objRegistry.GetStringValue HKEY_LOCAL_MACHINE, strSubKeyPath, "LogDir", strLogDir
SAVLogDir = replace(strLogDir,"\","\\") & "\\"

Set objRegistry = nothing

End Function

 
Christian

Hello Christian,

great, thank you. In the mean time I was on this way, too, with something like running

   type nachts.txt | find "Ergebniszusammenfassung für Scan"

in a loop and looking for the %errorlevel%

But I missed your nice function SAVLogDir (), for instance.

So I think now I will get the problem solved. After I know it works, I will post the final solution here.

Hello strubbel,

yeah, forgot about the localization (I'll edit my post accordingly). Didn't want to come up with a crude (no insult intended) solution in this forum :smileywink: (although I still use simple cmd language hacks when no one else can see them).

You've probably thought of it already - if some machines take a really long time to finish and there's a chance that someone will log on before the scan has completed should make sure that this isn't the case (you probably don't want to shut down then).

Christian

The other "marker" for a scan finishing could be:

HKEY_LOCAL_MACHINE\SOFTWARE\[Wow6432Node]\Sophos\SAVService\Status\LastScan \EnterpriseScan

This appears to be the time, http://www.epochconverter.com/ the scheduled scan created in SEC finished.  My machine has the value:

1326924146 = Wed, 18 Jan 2012 22:02:26 GMT = The time in SEC for the scheduled scan.

May prove a useful interface.  Interms of logic, I'll let you have a think... :)

Jak