cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Reliable Contributor kylekat
Reliable Contributor
Report Inappropriate Content
Message 1 of 2

Lots of 'Scan reports general system error' events on servers with ENSLTP 10.5.5

Jump to solution

I'm starting to experiment with Endpoint Security for Linux Threat Prevention 10.5 in red hat and Oracle linux servers.I noticed that in some of my lab and test environments that i deployed to, I'm getting tons of Event ID (1048) "Scan reports general system error".

From what I'm reading in ancients posts, this is McAfee speech for "we couldn't scan this file". I notice a pattern that the files triggering these events tend to be related to mysql services, Oracle application services.

Wanted to know what people out there were doing with these.... Are you disabling this event altogether, or adding exclusions for specific filet ypes that are normally not able to be scanned?

1 Solution

Accepted Solutions
Reliable Contributor User91972758
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: Lots of 'Scan reports general system error' events on servers with ENSLTP 10.5.5

Jump to solution
Hi Kyle,

A lot of what I've done in particular is exclude that specific process / directory from OAS / ODS scans. For the meantime it's a bunch of clutter that gets reported since the scans aren't able to read those files.

For example I believe SMB shares are unable to be scanned and so I've excluded those from scanning when accessed because all I see are event failures which doesn't really help when trying to diagnose any seen issues.

Hope this helps.

Zach
1 Reply
Reliable Contributor User91972758
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: Lots of 'Scan reports general system error' events on servers with ENSLTP 10.5.5

Jump to solution
Hi Kyle,

A lot of what I've done in particular is exclude that specific process / directory from OAS / ODS scans. For the meantime it's a bunch of clutter that gets reported since the scans aren't able to read those files.

For example I believe SMB shares are unable to be scanned and so I've excluded those from scanning when accessed because all I see are event failures which doesn't really help when trying to diagnose any seen issues.

Hope this helps.

Zach
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator