cancel
Showing results for 
Search instead for 
Did you mean: 
Reliable Contributor kylekat
Reliable Contributor
Report Inappropriate Content
Message 1 of 2

Lots of 'Scan reports general system error' events on servers with ENSLTP 10.5.5

Jump to solution

I'm starting to experiment with Endpoint Security for Linux Threat Prevention 10.5 in red hat and Oracle linux servers.I noticed that in some of my lab and test environments that i deployed to, I'm getting tons of Event ID (1048) "Scan reports general system error".

From what I'm reading in ancients posts, this is McAfee speech for "we couldn't scan this file". I notice a pattern that the files triggering these events tend to be related to mysql services, Oracle application services.

Wanted to know what people out there were doing with these.... Are you disabling this event altogether, or adding exclusions for specific filet ypes that are normally not able to be scanned?

1 Solution

Accepted Solutions
Highlighted
Reliable Contributor User91972758
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: Lots of 'Scan reports general system error' events on servers with ENSLTP 10.5.5

Jump to solution
Hi Kyle,

A lot of what I've done in particular is exclude that specific process / directory from OAS / ODS scans. For the meantime it's a bunch of clutter that gets reported since the scans aren't able to read those files.

For example I believe SMB shares are unable to be scanned and so I've excluded those from scanning when accessed because all I see are event failures which doesn't really help when trying to diagnose any seen issues.

Hope this helps.

Zach
1 Reply
Highlighted
Reliable Contributor User91972758
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: Lots of 'Scan reports general system error' events on servers with ENSLTP 10.5.5

Jump to solution
Hi Kyle,

A lot of what I've done in particular is exclude that specific process / directory from OAS / ODS scans. For the meantime it's a bunch of clutter that gets reported since the scans aren't able to read those files.

For example I believe SMB shares are unable to be scanned and so I've excluded those from scanning when accessed because all I see are event failures which doesn't really help when trying to diagnose any seen issues.

Hope this helps.

Zach
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community