Full/quick scan fails when initiated from EPO

[cgillett]

Hello,

I am attempting to perform a scan via EPO by selecting the tag from the System Tree, then going to Actions->Agent->Run Client Task Now->Endpoint Security Threat Prevention->Policy-Based On Demand Scan->Full or Quick Scan.

The progress bar does 2 green dots, then goes red and says Task Failed. This is what it shows under Subtasks:

9/24/20 3:59:58 PM	Run now task On-Demand Scan - Quick Scan received.
9/24/20 4:00:01 PM	Run now task On-Demand Scan - Quick Scan started.
9/24/20 4:00:08 PM	Run now task On-Demand Scan - Quick Scan is cancelled

Note the system can perform a manual full or quick scan via the local agent. When initiated from EPO it fails every time.

[vivs]

Hello @cgillett 

Thanks for your post.

Couple of things needs to be checked including the masvc.log and On-Demand Scan log.

Also please check how exactly the task has been configured the settings of the task.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[cgillett]

@vivs, thanks for your reply. Where can I find the masvc.log file?

[vivs]

Program data/McAfee/agent/logs

[cdinet]

I would also suggest not using run client task now for an on demand scan task.  The reason being is that when you run a task like that, the datachannel communication channel is kept open the entire duration of the task where epo is waiting on a response from the agent for the status of the task.  You would be better off using a scheduled client task instead.  

Additionally, programdata is a hidden directory, so you would either need to put full path in address bar or show hidden folders.