Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 1 subscriber
  • Views 3862 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Scheduled scan breaks for unknown reasons, Sophos logging failed

strubbel

Hi,

we are in the process of moving scheduled scans to night hours.

Last night we had quite some machines which did not log the end of the scan as usual in the Scanjob.txt file:

Jobname: Nachts

Content of file Nachts.txt:

20120531 194237    Scan 'Nachts' gestartet.

Content of file SAV_20120531.txt :

20120531 194237    Scan 'Nachts' gestartet.
20120531 194950    Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20120531 195103    Die Erkennungsdatenversion 4.78G (Detection Engine 3.31.20) wird verwendet. Diese Version kann 3664173 Objekte erkennen.
20120531 195103    Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20120531 195116    Die Erkennungsdatenversion 4.78G (Detection Engine 3.31.20) wird verwendet. Diese Version kann 3664173 Objekte erkennen.

and so on

When I go to such a machine I see that the scheduled scan does not run anymore, but why is the end of the scan not in the logs? This log entry does trigger the shutdown process of the machine here, and usually it works as expected.

:25441


This thread was automatically locked due to age.
Parents
  • 0

    Hello strubbel,

    as I said, please contact Support to confirm this - as you rightly said, it's a security problem.

    It might be possible to trigger on the "On-Access started" message and treat it as "job ended". As another update is unlikely in the next few hours you could even repeat the procedure and start the scan anew. 

    Christian

    :25509
Reply
  • 0

    Hello strubbel,

    as I said, please contact Support to confirm this - as you rightly said, it's a security problem.

    It might be possible to trigger on the "On-Access started" message and treat it as "job ended". As another update is unlikely in the next few hours you could even repeat the procedure and start the scan anew. 

    Christian

    :25509
Children
No Data