Endpoint Protection

Hi all,

By default my servers run a daily scan every night.  I've found a server that is taking over 24 hours to run it's daily scan so it's pretty much constantly scanning.  Is there a way in SEPM to pull a report of how long scans are running?  I'd like to break it down to servers that take more than 12 hours to scan if this is possible.

I've tried a scan statistics histogram grouped by scan time (in seconds) which gives me a nice bell curve but no actual computer names.  Is there a way to find the names?

Hello Daniel_allen
you can see which computer never scan or uncomplate but i don't know any way to know  how long scans are running.
Thanks
Fatih

Hey Daniel,

The best way to do this would be to login to your SEPM and go to:

Monitors->Logs->Log Type: Scan

Select an appropriate time range to view then hit the Advanced Settings hyperlink at the bottom.

Within the Advanced Settings you can filter the logs you would like to view by Duration or even focus it down to to a specific computer or group if you like.

Hope that helps!

As you mentioned that on one of the machines the scan goes on for more than 24 hours which is highly irregular and requires attention. Here are a few suggested options:-

In the SEPM cancel the scheduled scan for the group to which this machine belongs, apply the policy to that group and then create a new scheduled scan and apply the policy to the group again crosscheck with the clients that they are receiving the correct policy number every time you do this. In case the other machines in this group complete the scan in a an accepted time frame and this particular machine does not then keep this machine in a separate group and try applying the scheduled scan policy again if it still fails we would request you to call support.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009031109342948

Thanks David, this seems to work.  Oddly enough if I take the defaults and show everything all is well.  If I try to change any of the settings I get no results.  I can work with this though.

Sandip, this isn't irregular, at least in my environment.  I've had to adjust the daily scan on several servers so far because they were still scanning well into the production time-frame and causing slowness issues.  I'm trying to get an idea of all the servers that need to be adjusted so I can hit them all at once.  The more files that need to be scanned, the longer the scan takes.