Endpoint Protection

  Hi folks,

  Determining the time duration of a file scan on a Windows client is pretty straight forward from the SEP console.

 Goto Monitors>Logs>Select "Scan" from the pull down menu.

  When you bring up the logs, one of the columns will be "Duration" and therein lies your answer....for Windows clients only. A MacOS X client displays no information in this column. The only information a Mac client displays with respect to scan information is the the start time.

  Is there another way to acquire such information from the console? If not, is there some log file on the client that can be examined?

 I know NavX is the actual process that runs on the Mac that performs the scan, but I would like to avoid litrerally timing it's presence to determine a scan duration; especially since they can take hours  ;)

check this discussion

http://aka-community.symantec.com/connect/pt-br/forums/how-view-scan-details-sep-11-ru6-mac

this is not available an idea is posted please vote

Unfortunately, it doesn't show it.

Unfortunately, the information available via SEPM reporting is mostly blank for Mac clients.  Please see and vote up this Idea:

Scan results displayed for SEP for Mac clients in SEPM's Reporting needs expansion

You may be able to find information in the OS's Console logs, but otherwise there is no log for the client (which is probably why no additional information is sent to the SEPM).  You could use command line navx with output to a file to determine length of scan.

Command line switches and use of NAVX command line utility for SAV/SEP for Macintosh
http://www.symantec.com/docs/TECH92772

The first scan always takes the longest.  Subsequent scans typically take less time thanks to the QuickScan file.

The QuickScan File
http://www.symantec.com/docs/TECH104802

sandra

  Hi all,

  Thanks for the links and feedback. Sandra, I voted on your idea too.

  I'll use the navx command-line idea to gather information when practical, but it sure would be nice if this data was available via the console.

  With respect the navx, I'm assuming running it from the terminal performance-wish, would be equivalent to running a scheduled scan with priority slider set to "High" when managed via the AV policy?

I'm not sure what you mean by 'terminal performance-wish'--maybe you meant '-wise'?  I'm not sure what the 'niceness' value is (as it's called in the command line Symantec Scheduler) of a navx scan.  I'll see if I can find out.

sandra

  Hi Sandra,

 Sorry for the fat fingers...

 I was trying to state that from a perfromance perspective, I wonder what priority ( niceness in your words.) navx would run when launched from the terminal. When compared to an AV policy with the scheduled scan set to "High" proririty, would navx when manually launched from the terminal, consume the same system resources?

 Hopfully, I'm being a little clearer and less clumsy this time around.

No worries I knew what you meant, it just took me a couple of tries.

I'll see what I can find and let you know.

sandra