Event ID 1203 is for ODS completed.
You can query with Event ID not equal to 1203.
1 of 1 people found this helpful
Event ID 1202 is OD scan started. Look for machines with a 1202 event without a corresponding 1203 event. My theory is that if something happened to the machine or McAfee subsystem to cause the scan to fail part of the way through, that you may not see a specific error event like Event ID 1086 or something to that effect.
Hope this helps.
Awesome, thanks for the help.
Hmm..I ran a new query(client events) for any event ID equaling 1203 to just see if the client computers are returning with a completed demand scan and I get back 0 compliant.
I know my computer in specific has completed because I can see the OnDemandScanLog.txt from my computer. All I see are event IDs 2401-2413.
Am I doing something wrong?
1202 and 1203 events are not enabled by default. You have to turn them on in the event filter, wait for all of your machines to get the new policy, then start your scan.
When you run the report, you'll also need to filter it by 'Analyzer Detection Method' in order to limit to just the managed scan you're looking for. Otherwise you'll receive data with on-demand scans other than the managed one you're trying to verify.
edit: Also, the 1203 event is sent even if the scan is canceled. All it means is that the scan completed; it doesn't care why the scan stopped. I think event 1035 indicates that it was canceled, but I found that event to be a little hit and miss on accuracy.I basically just started doing SQL queries directly in the DB that did a diff between the full list of machines that should have done a scan, and the list of machines that had a 1202 event for that scan name during the designated scan period. It's fairly painful and not 100% reliable, but it's the best I've been able to do.