Event ID 1048 on ENSL 10.6.7

[rokasporch]

Hi Community,

we have here some Ubuntu 18.04 Systems with Agent 5.6.3 and ENSL 10.6.7.

In the Threat Events, OAS and ODS reports many "Scan reports general system error"

For example 3000 Events with /home/username/.cache/mozilla/firefox/oewldma2.default/cache2/entries/6782312FB4477D6E1AAADA88C2DB5EBCD247ECF6

I read https://community.mcafee.com/t5/Mac-and-Linux-Products/Lots-of-Scan-reports-general-system-error-eve... but the solutions there, an exclusion of path and process will not the best way for us.

How can we fix this without an exclusion?

Thanks

[vivs]

Hello,

Thanks for your post.

If you don't want to see the events , In that case please go to the ePO>Server Settings>Event Filtering and uncheck the event.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[YashT]

Hello @rokasporch ,

The Event id 1048 is information event that can be checked on KB78291 or KB54677.

Event ID

Name

Severity

1048

Scan reports general system error

Informational

and as @vivs  suggested, you can ignore this events if you dont want it to be reported to epo following KB70252 and unchecking the event which you dont require.

[rokasporch]

Hello,

thank you for your replay.

I was wondering because the Event pops up with access denyed as action taken:

Threat Type: Not specified
Action Taken: Deny access
Event Description: Scan reports general system error
Analyzer Detection Method: OAS

[amit_naidu · Accepted solution]

Hello @rokasporch ,

Thank you for your query,

The event is generated because ENSL goes to scan the file but the file is either no longer in the scan queue or has a lock on it and ENSL can't get to the file.  This is a normal process and if you are getting a lot of these errors then putting in exclusions is the way to reduce the number.

Hope this helps!

[rokasporch]

Thank you for the explanation.