cancel
Showing results for 
Search instead for 
Did you mean: 
TonMil
Level 7
Report Inappropriate Content
Message 1 of 3

Check when full scan was done on PCs using query in ePO 4.0

Jump to solution

Hi all,

I have one question. I have ePO 4.0 build: 1221 and VirusScan 8.7 Patch 2 + Antispayware.

What I did is: I run full scan task on all PCs (workstation and laptops) from time to time (every 15-30 days). I've created the task and it's working fine.

Second what I would like to have is a query which will check the results. I created a query (see attached pdf document for details) but not able to see information when scan didn't find anything. It should be event 1034 but this event is never registered in my ePO. Is there a way how to set this up? Why this event is never triggered (I tried to run Full scan manually on PC and over ePO).

Thanks for all future help...

Toni

1 Solution

Accepted Solutions

Re: Check when full scan was done on PCs using query in ePO 4.0

Jump to solution

Hi Toni,

First you will have to check if the events 1202 (Scan started) and 1203 (scan completed) are already enabled on ePO or not. By default they are not enabled, this you can check on Configuration - Server Settings - Event Filtering.

After enabling these events you will have to wait that your workstations/servers get this new information or you can force using an agent wake up call.

Then you can create a query to list only the events 1202 and 1203 based on Events Generated within "x" hours or days.

Attached you have a query that you can import on your ePO server to see the results, this might help you.

hope this helps.

Regards,
Bruno

2 Replies

Re: Check when full scan was done on PCs using query in ePO 4.0

Jump to solution

Hi Toni,

First you will have to check if the events 1202 (Scan started) and 1203 (scan completed) are already enabled on ePO or not. By default they are not enabled, this you can check on Configuration - Server Settings - Event Filtering.

After enabling these events you will have to wait that your workstations/servers get this new information or you can force using an agent wake up call.

Then you can create a query to list only the events 1202 and 1203 based on Events Generated within "x" hours or days.

Attached you have a query that you can import on your ePO server to see the results, this might help you.

hope this helps.

Regards,
Bruno

TonMil
Level 7
Report Inappropriate Content
Message 3 of 3

Re: Check when full scan was done on PCs using query in ePO 4.0

Jump to solution

Hi Bruno,

Thanks for your help!

Regards

Toni