Austin/San Antonio Security User Group

 View Only
  • 1.  Increased files scanned

    Posted Jun 13, 2013 10:49 AM

    Hello, I have a user who requested her scan run at night rather than during the day.

    So I moved her from the day time scan group to a night time scan group, both groups are the same other than the time schedule for the scan to take place and the Advanced Scanning Options for the night time are set at Best Scan Performance while the daytime is set to Best Application Performance.

    However we notice last night that her scan took 10 hours and 5.7 million files were scanned, the last three scans that happened during the day were 3.5 million files and took around 7 hours.

    I am very confused as to why the night scan looked at more files and too longer.

     

    Please help with any ideas

     

    SEP 12.1.2



  • 2.  RE: Increased files scanned

    Posted Jun 13, 2013 10:52 AM

    Was the original policy configured to look at less? Had any exceptions been added previously?



  • 3.  RE: Increased files scanned

    Posted Jun 13, 2013 10:55 AM

    Both groups have the same workstation exceptions policy.



  • 4.  RE: Increased files scanned

    Posted Jun 13, 2013 10:58 AM

    Seems like a large amount of files, usually see this when compressed files come into play.

    You can enable vpdebug logging to see what is being scanned, follow this KBA on how to enable it:

    How to enable Automatic Symantec Endpoint Protection (SEP) 12.1 Client Debugging, including WPP logs

    Article:TECH171176  |  Created: 2011-10-05  |  Updated: 2013-03-25  |  Article URL http://www.symantec.com/docs/TECH171176

     



  • 5.  RE: Increased files scanned

    Posted Jun 13, 2013 11:11 AM

    At night it was Adavanced scan option which was enabled. 

    there will always be a diff in the file count when scanning is done

    https://www-secure.symantec.com/connect/forums/sep-1212-full-scan-results-inconsistent#comment-8573291



  • 6.  RE: Increased files scanned
    Best Answer

    Posted Jun 13, 2013 11:59 AM

    I found my issue, setting was off on the Compressed Files.