cancel
Showing results for 
Search instead for 
Did you mean: 
Sohel
Level 9
Report Inappropriate Content
Message 1 of 7

On-Demand Scan Event ID

Jump to solution

From ePO - Is there any way I can find Event ID 1203 (which is for On-Demand Scan) without running any query, is this possible?

I have already gone through KB87752 & KB86702.

 

 

 

1 Solution

Accepted Solutions
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 7 of 7

Re: On-Demand Scan Event ID

Jump to solution

Priority event forwarding only means what events are sent immediately vs being sent at event forwarding interval, so it is not necessary to change your priority to informational.  Informational events aren't sent as they occur, but at every 5 minutes by default.  So, as long as you have enabled the event in ENS policy, you should be getting those events.  Just make sure that event is enabled under server settings, event filtering.

Run a query for both threat and client events for that event id and see if it returns any data. 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

6 Replies
McAfee Employee hem
McAfee Employee
Report Inappropriate Content
Message 2 of 7

Re: On-Demand Scan Event ID

Jump to solution

Events will be stored in database. To find them, we need to query.

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?please select Accept as Solution in my reply and together we can help other members?
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 3 of 7

Re: On-Demand Scan Event ID

Jump to solution

If you are trying to look at a specific system for it, you can go to that system details and show threat events.  However, that also runs a query.  What exactly are you trying to accomplish without running a query and why can't a query be run?

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Sohel
Level 9
Report Inappropriate Content
Message 4 of 7

Re: On-Demand Scan Event ID

Jump to solution

VirusScan used to show ODS event ID in threat events from the system details .... it's no longer available from ePO if you have Endpoint Security. I was looking for a quick way to find out without running a query. 

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 5 of 7

Re: On-Demand Scan Event ID

Jump to solution

Look at KB87752.  You have to enable that in the ens policy.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Sohel
Level 9
Report Inappropriate Content
Message 6 of 7

Re: On-Demand Scan Event ID

Jump to solution

Thanks, I already mentioned about this KB and another KB in my original posting.

problem is that this KB is asking you to change Agent setting to below under [McAfee Agent > General >Event]

"Click the Events tab and set Priority event forwarding to Informational."......

I'm using "Major" currently and I don't want change it.

 

 

 

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 7 of 7

Re: On-Demand Scan Event ID

Jump to solution

Priority event forwarding only means what events are sent immediately vs being sent at event forwarding interval, so it is not necessary to change your priority to informational.  Informational events aren't sent as they occur, but at every 5 minutes by default.  So, as long as you have enabled the event in ENS policy, you should be getting those events.  Just make sure that event is enabled under server settings, event filtering.

Run a query for both threat and client events for that event id and see if it returns any data. 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator