Video Screencast Help
Scheduled Maintenance: Symantec Connect is scheduled to be down Saturday, April 19 from 10am to 2pm Pacific Standard Time (GMT: 5pm to 9pm) for server migration and upgrade.
Please accept our apologies in advance for any inconvenience this might cause.

SEP for MacOS X; Determining File Scan Duration

Created: 14 Jan 2011 • Updated: 14 Jan 2011 | 7 comments
This issue has been solved. See solution.

  Hi folks,

  Determining the time duration of a file scan on a Windows client is pretty straight forward from the SEP console.

 Goto Monitors>Logs>Select "Scan" from the pull down menu.

  When you bring up the logs, one of the columns will be "Duration" and therein lies your answer....for Windows clients only. A MacOS X client displays no information in this column. The only information a Mac client displays with respect to scan information is the the start time.

  Is there another way to acquire such information from the console? If not, is there some log file on the client that can be examined?

 I know NavX is the actual process that runs on the Mac that performs the scan, but I would like to avoid litrerally timing it's presence to determine a scan duration; especially since they can take hours  ;)

 

 

 

 

 

 

Comments 7 CommentsJump to latest comment

_Brian's picture

Unfortunately, it doesn't show it.

SOLUTION
sandra.g's picture

Unfortunately, the information available via SEPM reporting is mostly blank for Mac clients.  Please see and vote up this Idea:

Scan results displayed for SEP for Mac clients in SEPM's Reporting needs expansion

You may be able to find information in the OS's Console logs, but otherwise there is no log for the client (which is probably why no additional information is sent to the SEPM).  You could use command line navx with output to a file to determine length of scan.

Command line switches and use of NAVX command line utility for SAV/SEP for Macintosh
http://www.symantec.com/docs/TECH92772

The first scan always takes the longest.  Subsequent scans typically take less time thanks to the QuickScan file.

The QuickScan File
http://www.symantec.com/docs/TECH104802

sandra

Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection

Don't forget to mark your thread as 'solved' with the answer that best help

landmissle's picture

  Hi all,

  Thanks for the links and feedback. Sandra, I voted on your idea too.

  I'll use the navx command-line idea to gather information when practical, but it sure would be nice if this data was available via the console.

  With respect the navx, I'm assuming running it from the terminal performance-wish, would be equivalent to running a scheduled scan with priority slider set to "High" when managed via the AV policy?

 

 

sandra.g's picture

I'm not sure what you mean by 'terminal performance-wish'--maybe you meant '-wise'?  I'm not sure what the 'niceness' value is (as it's called in the command line Symantec Scheduler) of a navx scan.  I'll see if I can find out.

sandra

Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection

Don't forget to mark your thread as 'solved' with the answer that best help

landmissle's picture

  Hi Sandra,

 Sorry for the fat fingers...

 I was trying to state that from a perfromance perspective, I wonder what priority ( niceness in your words.) navx would run when launched from the terminal. When compared to an AV policy with the scheduled scan set to "High" proririty, would navx when manually launched from the terminal, consume the same system resources?

 Hopfully, I'm being a little clearer and less clumsy this time around.

 

 

 

 

sandra.g's picture

No worries smiley I knew what you meant, it just took me a couple of tries. wink

I'll see what I can find and let you know.

sandra

Symantec, Information Developer
Installation, Migration, Deployment and Patching
User Protection & Productivity, Endpoint Protection

Don't forget to mark your thread as 'solved' with the answer that best help