Endpoint Protection

 View Only
Expand all | Collapse all

SEP problem with endless scan

  • 1.  SEP problem with endless scan

    Posted May 13, 2014 12:12 PM
      |   view attached

    Hi guys,

    I'm reviving an old discussion that was closed:
    https://www-secure.symantec.com/connect/forums/sep-problem-endless-scan

    We have SEPM 12

    Some clients running on Windows 2000 are running an endless looping scan, when I open the Auto-Protect Scan Statistics it said Files scanned: ~5 million and some scans have started several months ago non-stop.. One of the machines started the scan 11 months ago :o

    I tried stopping All Scan from the console but it does not take effect on the client.

    I really don't know what approche to take, is there no way to tell the scanning policy not to scan te same file twice?

    Any advice is highly appreacited.



  • 2.  RE: SEP problem with endless scan

    Posted May 13, 2014 12:14 PM

    Seems that the original scan was interrupted somehow and now it's just "stuck" (cosmetic isue) I doubt a scan is actually running.

    Was this an upgrade over a previous 11.x version?

    Have you tried just running a repair of the client?



  • 3.  RE: SEP problem with endless scan

    Posted May 13, 2014 12:28 PM

    It seems the scan is still running.

    Everytime I open the Auto-protect Scan Statistics I see different file name and the Files scanned increments.

    Was this an upgrade over a previous 11.x version?
    Not sure

    Have you tried just running a repair of the client?
    No, can it help?



  • 4.  RE: SEP problem with endless scan

    Posted May 13, 2014 12:30 PM

    That only applies for Auto-Protect, not a scheduled scan.

    This was an issue in a previous version of 11.x

    It might if something is "stuck" A reinstall may just be quick and easy here if you can do it.



  • 5.  RE: SEP problem with endless scan

    Posted May 13, 2014 12:34 PM

    Oh really!? Good point !

    When I go to View Logs I see in the Scan Log tab that the status for all the entries is Scan Complete - Does it mean that a scan is not running at the moment?

    Is that how I confirm if a scan is running at the moment?



  • 6.  RE: SEP problem with endless scan
    Best Answer

    Posted May 13, 2014 12:36 PM

    When you open the SEP GUI it will a scan is in progress at the top right.

    The scan is likely not running.

    This issue generally happens when a scan is interrupted so it has no way to mark as being completed.



  • 7.  RE: SEP problem with endless scan

    Posted May 13, 2014 01:12 PM

    So for this particular problem (where the client is online in the console but the definitions do not install) what's the best solution?

    Repair SEP and reboot? 



  • 8.  RE: SEP problem with endless scan

    Posted May 13, 2014 01:15 PM

    Start with a repair/reboot. Let's see what the result is.



  • 9.  RE: SEP problem with endless scan

    Posted May 13, 2014 01:22 PM

    Thanks for your help Brian, I will start with that.

    Btw, as long as the client show ONLINE in the console it means that client/server communications are established right?

    Is there another way to test client/server communication or to force a sync?



  • 10.  RE: SEP problem with endless scan

    Posted May 13, 2014 01:25 PM

    Correct.

    Right click on the icon in the task tray and select "Update Policy"

    or from a Run prompt type "smc -updateconfig"



  • 11.  RE: SEP problem with endless scan

    Posted May 13, 2014 01:47 PM

    You're the man !



  • 12.  RE: SEP problem with endless scan

    Posted May 13, 2014 01:48 PM

    laugh