Lots of 'Scan reports general system error' events on servers with ENSLTP 10.5.5

[kylekat]

I'm starting to experiment with Endpoint Security for Linux Threat Prevention 10.5 in red hat and Oracle linux servers.I noticed that in some of my lab and test environments that i deployed to, I'm getting tons of Event ID (1048) "Scan reports general system error".

From what I'm reading in ancients posts, this is McAfee speech for "we couldn't scan this file". I notice a pattern that the files triggering these events tend to be related to mysql services, Oracle application services.

Wanted to know what people out there were doing with these.... Are you disabling this event altogether, or adding exclusions for specific filet ypes that are normally not able to be scanned?

[User91972758 · Accepted solution]

Hi Kyle,

A lot of what I've done in particular is exclude that specific process / directory from OAS / ODS scans. For the meantime it's a bunch of clutter that gets reported since the scans aren't able to read those files.

For example I believe SMB shares are unable to be scanned and so I've excluded those from scanning when accessed because all I see are event failures which doesn't really help when trying to diagnose any seen issues.

Hope this helps.

Zach