Need few Clarification on On Demand Scan

[Shamini]

1.Which part of scanning(files or memory or registry) takes more time generally ?

2.whats the average CPU usage that can be set to avoid AV scans affecting users ? (Limit maximum CPU usage field in custom on demand scan)

3.if we choose on demand scan to run (say registry ,drives ,folders). How do they run ?

parallelly or one by one ? or please explain how it works. how to know end time for each process?

4. what are the ways available to know if a scan is running for more hours than the usual time ?(mail alerts)

[Pravas]

Hi @Shamini ,

Please find my response below.

1.Which part of scanning(files or memory or registry) takes more time generally ?

Scanning Files would take longer when compared to either Memory or Registry.

2.whats the average CPU usage that can be set to avoid AV scans affecting users ? (Limit maximum CPU usage field in custom on demand scan)

This depends on the overall system configuration. McAfee doesn't have any recommendation for CPU percentage. An administrator needs to tune the performance based on the requirement.

3.if we choose on demand scan to run (say registry ,drives ,folders). How do they run ?

parallelly or one by one ? or please explain how it works. how to know end time for each process?

Scan usually runs in the same sequence (One after another) as configured in Task/Policy. Please refer OnDemandScan_Activity.log which is available on the system.

Location - C:\ProgramData\McAfee\Endpoint Security\Logs

4. what are the ways available to know if a scan is running for more hours than the usual time ?(mail alerts)

Scan time may vary from system to system. For example, some of the factors affecting the scan time are

1. Amount of data on disk

2. Types of files on disk

3. Whether its a 1GB (1 file) or 1GB (multiple files)

4. Type of Disk

5. System Specification

6. If ODS has been configured to balance performance between user & scanner. Some of which are mentioned in the Document below.

https://docs.mcafee.com/bundle/endpoint-security-10.7.x-common-product-guide-windows/page/GUID-BC451...

You could opt to terminate the scan if it goes beyond a certain hour as well.

Thanks